Build has been canceled!

8810740245

Committed 24 Apr 2024 03:50AM UTC coverage: 60.831% (-1.2%) from 62.028%

Build # 8810740245

Build Type

Pull #1304

github

Committed by

web-flow

Commit Message

Merge 9efe32938 into 344a35aaf

Pull Request Pull Request #1304: Update SNTPolicyProcessor to use a map

Run Details

5107 of 12638 branches covered (40.41%)

Branch coverage included in aggregate %.

526 of 545 new or added lines in 2 files covered. (96.51%)

364 existing lines in 2 files now uncovered.

16924 of 23579 relevant lines covered (71.78%)

6548.54 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

88.68

/Source/santad/SNTPolicyProcessorTest.m

/// Copyright 2024 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#include <Foundation/Foundation.h>
#import "Source/santad/SNTPolicyProcessor.h"

#import <XCTest/XCTest.h>
#import "Source/common/SNTCachedDecision.h"
#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTRule.h"

#import "Source/santad/SNTPolicyProcessor.h"

@interface SNTPolicyProcessorTest : XCTestCase
@property SNTPolicyProcessor *processor;
@end

@implementation SNTPolicyProcessorTest
- (void)setUp {
  _processor = [[SNTPolicyProcessor alloc] init];
}

- (void)testRule:(SNTRule *)rule
   transitiveRules:(BOOL)transitiveRules
             final:(BOOL)final
           matches:(BOOL)matches
            silent:(BOOL)silent
  expectedDecision:(SNTEventState)decision {
  SNTCachedDecision *cd = [[SNTCachedDecision alloc] init];
  if (matches) {
    switch (rule.type) {
      case SNTRuleTypeBinary: cd.sha256 = rule.identifier; break;
      case SNTRuleTypeCertificate: cd.certSHA256 = rule.identifier; break;
      case SNTRuleTypeCDHash: cd.cdhash = rule.identifier; break;
      default: break;
    }
  } else {
    switch (rule.type) {
      case SNTRuleTypeBinary:
        cd.sha256 = @"2334567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef";
        break;
      case SNTRuleTypeCertificate:
        cd.certSHA256 = @"2234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef";
        break;
      case SNTRuleTypeCDHash: cd.cdhash = @"b023fbe5361a5bbd793dc3889556e93f41ec9bb8"; break;
      default: break;
    }
  }
  BOOL decisionIsFinal = [self.processor decision:cd
                                          forRule:rule
                              withTransitiveRules:transitiveRules];
  XCTAssertEqual(cd.decision, decision);
  XCTAssertEqual(decisionIsFinal, final);
  XCTAssertEqual(cd.silentBlock, silent);
}

- (void)testDecisionForBlockByCDHashRuleMatches {
  SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{
    @"rule_type" : @"CDHASH",
    @"identifier" : @"a023fbe5361a5bbd793dc3889556e93f41ec9bb8",
    @"policy" : @"BLOCKLIST"
  }];

  XCTAssertNotNil(rule, "invalid test rule dictionary");
  [self testRule:rule
     transitiveRules:YES
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateBlockCDHash];
  [self testRule:rule
     transitiveRules:NO
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateBlockCDHash];
}

- (void)testDecisionForSilentBlockByCDHashRuleMatches {
  SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{
    @"rule_type" : @"CDHASH",
    @"identifier" : @"a023fbe5361a5bbd793dc3889556e93f41ec9bb8",
    @"policy" : @"SILENT_BLOCKLIST"
  }];

  XCTAssertNotNil(rule, "invalid test rule dictionary");
  [self testRule:rule
     transitiveRules:YES
               final:YES
             matches:YES
              silent:YES
    expectedDecision:SNTEventStateBlockCDHash];
  // Ensure that nothing changes when disabling transitive rules.
  [self testRule:rule
     transitiveRules:NO
               final:YES
             matches:YES
              silent:YES
    expectedDecision:SNTEventStateBlockCDHash];
}

- (void)testDecisionForAllowbyCDHashRuleMatches {
  SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{
    @"rule_type" : @"CDHASH",
    @"identifier" : @"a023fbe5361a5bbd793dc3889556e93f41ec9bb8",
    @"policy" : @"ALLOWLIST"
  }];

  XCTAssertNotNil(rule, "invalid test rule dictionary");
  [self testRule:rule
     transitiveRules:YES
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateAllowCDHash];
  // Ensure that nothing changes when disabling transitive rules.
  [self testRule:rule
     transitiveRules:NO
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateAllowCDHash];
}

- (void)testDecisionForBlockBySHA256RuleMatches {
  SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{
    @"rule_type" : @"BINARY",
    @"identifier" : @"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
    @"policy" : @"BLOCKLIST"
  }];

  XCTAssertNotNil(rule, "invalid test rule dictionary");

  [self testRule:rule
     transitiveRules:YES
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateBlockBinary];
  // Ensure that nothing changes when disabling transitive rules.
  [self testRule:rule
     transitiveRules:NO
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateBlockBinary];
}

- (void)testDecisionForSilenBlockBySHA256RuleMatches {
  SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{
    @"rule_type" : @"BINARY",
    @"identifier" : @"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
    @"policy" : @"SILENT_BLOCKLIST"
  }];

  XCTAssertNotNil(rule, "invalid test rule dictionary");

  [self testRule:rule
     transitiveRules:YES
               final:YES
             matches:YES
              silent:YES
    expectedDecision:SNTEventStateBlockBinary];
  // Ensure that nothing changes when disabling transitive rules.
  [self testRule:rule
     transitiveRules:NO
               final:YES
             matches:YES
              silent:YES
    expectedDecision:SNTEventStateBlockBinary];
}

- (void)testDecisionForAllowBySHA256RuleMatches {
  SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{
    @"rule_type" : @"BINARY",
    @"identifier" : @"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
    @"policy" : @"ALLOWLIST"
  }];

  XCTAssertNotNil(rule, "invalid test rule dictionary");
  [self testRule:rule
     transitiveRules:YES
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateAllowBinary];
  // Ensure that nothing changes when disabling transitive rules.
  [self testRule:rule
     transitiveRules:NO
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateAllowBinary];
}

- (void)testDecisionForSigningIDBlockRuleMatches {
  SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{
    @"rule_type" : @"SIGNINGID",
    @"identifier" : @"ABCDEFGHIJ:ABCDEFGHIJ",
    @"policy" : @"BLOCKLIST"
  }];

  XCTAssertNotNil(rule, "invalid test rule dictionary");
  [self testRule:rule
     transitiveRules:YES
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateBlockSigningID];
  // Ensure that nothing changes when disabling transitive rules.
  [self testRule:rule
     transitiveRules:NO
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateBlockSigningID];
}

// Signing ID rules
- (void)testDecisionForSigningIDSilentBlockRuleMatches {
  SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{
    @"rule_type" : @"SIGNINGID",
    @"identifier" : @"TEAMID1234:ABCDEFGHIJ",
    @"policy" : @"SILENT_BLOCKLIST"
  }];

  XCTAssertNotNil(rule, "invalid test rule dictionary");
  [self testRule:rule
     transitiveRules:YES
               final:YES
             matches:YES
              silent:YES
    expectedDecision:SNTEventStateBlockSigningID];
  // Ensure that nothing changes when disabling transitive rules.
  [self testRule:rule
     transitiveRules:NO
               final:YES
             matches:YES
              silent:YES
    expectedDecision:SNTEventStateBlockSigningID];
}

- (void)testDecisionForSigningIDAllowRuleMatches {
  SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{
    @"rule_type" : @"SIGNINGID",
    @"identifier" : @"TEAMID1234:ABCDEFGHIJ",
    @"policy" : @"ALLOWLIST"
  }];

  XCTAssertNotNil(rule, "invalid test rule dictionary");
  [self testRule:rule
     transitiveRules:YES
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateAllowSigningID];
  // Ensure that nothing changes when disabling transitive rules.
  [self testRule:rule
     transitiveRules:NO
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateAllowSigningID];
}

//  Certificate rules
- (void)testDecisionForCertificateBlockRuleMatches {
  SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{
    @"rule_type" : @"CERTIFICATE",
    @"identifier" : @"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
    @"policy" : @"BLOCKLIST"
  }];

  XCTAssertNotNil(rule, "invalid test rule dictionary");
  [self testRule:rule
     transitiveRules:YES
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateBlockCertificate];
  // Ensure that nothing changes when disabling transitive rules.
  [self testRule:rule
     transitiveRules:NO
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateBlockCertificate];
}

- (void)testDecisionForCertificateSilentBlockRuleMatches {
  SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{
    @"rule_type" : @"CERTIFICATE",
    @"identifier" : @"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
    @"policy" : @"SILENT_BLOCKLIST"
  }];

  XCTAssertNotNil(rule, "invalid test rule dictionary");
  [self testRule:rule
     transitiveRules:YES
               final:YES
             matches:YES
              silent:YES
    expectedDecision:SNTEventStateBlockCertificate];
  // Ensure that nothing changes when disabling transitive rules.
  [self testRule:rule
     transitiveRules:NO
               final:YES
             matches:YES
              silent:YES
    expectedDecision:SNTEventStateBlockCertificate];
}

- (void)testDecisionForCertificateAllowRuleMatches {
  SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{
    @"rule_type" : @"CERTIFICATE",
    @"identifier" : @"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
    @"policy" : @"ALLOWLIST"
  }];

  XCTAssertNotNil(rule, "invalid test rule dictionary");
  [self testRule:rule
     transitiveRules:YES
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateAllowCertificate];
  // Ensure that nothing changes when disabling transitive rules.
  [self testRule:rule
     transitiveRules:NO
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateAllowCertificate];
}

// Team ID rules
- (void)testDecisionForTeamIDBlockRuleMatches {
  SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{
    @"rule_type" : @"TEAMID",
    @"identifier" : @"TEAMID1234",
    @"policy" : @"BLOCKLIST"
  }];

  XCTAssertNotNil(rule, "invalid test rule dictionary");
  [self testRule:rule
     transitiveRules:YES
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateBlockTeamID];
  // Ensure that nothing changes when disabling transitive rules.
  [self testRule:rule
     transitiveRules:NO
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateBlockTeamID];
}

- (void)testDecisionForTeamIDSilentBlockRuleMatches {
  SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{
    @"rule_type" : @"TEAMID",
    @"identifier" : @"TEAMID1234",
    @"policy" : @"SILENT_BLOCKLIST"
  }];

  XCTAssertNotNil(rule, "invalid test rule dictionary");
  [self testRule:rule
     transitiveRules:YES
               final:YES
             matches:YES
              silent:YES
    expectedDecision:SNTEventStateBlockTeamID];
  // Ensure that nothing changes when disabling transitive rules.
  [self testRule:rule
     transitiveRules:NO
               final:YES
             matches:YES
              silent:YES
    expectedDecision:SNTEventStateBlockTeamID];
}

- (void)testDecisionForTeamIDAllowRuleMatches {
  SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{
    @"rule_type" : @"TEAMID",
    @"identifier" : @"TEAMID1234",
    @"policy" : @"ALLOWLIST"
  }];

  XCTAssertNotNil(rule, "invalid test rule dictionary");
  [self testRule:rule
     transitiveRules:YES
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateAllowTeamID];
  // Ensure that nothing changes when disabling transitive rules.
  [self testRule:rule
     transitiveRules:NO
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateAllowTeamID];
}

// Compiler rules
// CDHash
- (void)testDecisionForCDHashCompilerRuleMatches {
  SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{
    @"rule_type" : @"CDHASH",
    @"identifier" : @"a023fbe5361a5bbd793dc3889556e93f41ec9bb8",
    @"policy" : @"ALLOWLIST_COMPILER"
  }];

  XCTAssertNotNil(rule, "invalid test rule dictionary");
  [self testRule:rule
     transitiveRules:YES
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateAllowCompiler];
  // Ensure disabling transitive rules results in a binary allow
  [self testRule:rule
     transitiveRules:NO
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateAllowCDHash];
}

// SHA256
- (void)testDecisionForSHA256CompilerRuleMatches {
  SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{
    @"rule_type" : @"BINARY",
    @"identifier" : @"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
    @"policy" : @"ALLOWLIST_COMPILER"
  }];

  XCTAssertNotNil(rule, "invalid test rule dictionary");
  [self testRule:rule
     transitiveRules:YES
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateAllowCompiler];
  // Ensure disabling transitive rules results in a binary allow
  [self testRule:rule
     transitiveRules:NO
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateAllowBinary];
}

// SigningID
- (void)testDecisionForSigningIDCompilerRuleMatches {
  SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{
    @"rule_type" : @"SIGNINGID",
    @"identifier" : @"TEAMID1234:ABCDEFGHIJ",
    @"policy" : @"ALLOWLIST_COMPILER"
  }];

  XCTAssertNotNil(rule, "invalid test rule dictionary");
  [self testRule:rule
     transitiveRules:YES
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateAllowCompiler];
  // Ensure disabling transitive rules results in a Signing ID allow
  [self testRule:rule
     transitiveRules:NO
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateAllowSigningID];
}

// Transitive allowlist rules
- (void)testDecisionForTransitiveAllowlistRuleMatches {
  SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{
    @"rule_type" : @"BINARY",
    @"identifier" : @"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
    @"policy" : @"ALLOWLIST"
  }];

  XCTAssertNotNil(rule, "invalid test rule dictionary");

  rule.state = SNTRuleStateAllowTransitive;

  [self testRule:rule
     transitiveRules:YES
               final:YES
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateAllowTransitive];
  // Ensure that a transitive allowlist rule results in an
  // SNTEventStateUnknown if transitive rules are disabled.
  [self testRule:rule
     transitiveRules:NO
               final:NO
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateUnknown];
}

- (void)testEnsureANonMatchingRuleResultsInUnknown {
  SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{
    @"rule_type" : @"BINARY",
    @"identifier" : @"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
    @"policy" : @"ALLOWLIST"
  }];

  XCTAssertNotNil(rule, "invalid test rule dictionary");

  rule.state = 88888;  // Set to an invalid state

  [self testRule:rule
     transitiveRules:YES
               final:NO
             matches:NO
              silent:NO
    expectedDecision:SNTEventStateUnknown];

  [self testRule:rule
     transitiveRules:NO
               final:NO
             matches:YES
              silent:NO
    expectedDecision:SNTEventStateUnknown];
}

- (void)testEnsureCustomURLAndMessageAreSet {
  SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{
    @"rule_type" : @"BINARY",
    @"identifier" : @"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
    @"policy" : @"ALLOWLIST",
    @"custom_msg" : @"Custom Message",
    @"custom_url" : @"https://example.com"
  }];

  XCTAssertNotNil(rule, "invalid test rule dictionary");

  SNTCachedDecision *cd = [[SNTCachedDecision alloc] init];
  cd.sha256 = rule.identifier;

  [self.processor decision:cd forRule:rule withTransitiveRules:YES];

  XCTAssertEqualObjects(cd.customMsg, @"Custom Message");
  XCTAssertEqualObjects(cd.customURL, @"https://example.com");
}

@end

1	/// Copyright 2024 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#include <Foundation/Foundation.h>
16	#import "Source/santad/SNTPolicyProcessor.h"
17
18	#import <XCTest/XCTest.h>
19	#import "Source/common/SNTCachedDecision.h"
20	#import "Source/common/SNTConfigurator.h"
21	#import "Source/common/SNTRule.h"
22
23	#import "Source/santad/SNTPolicyProcessor.h"
24
25	@interface SNTPolicyProcessorTest : XCTestCase
26	@property SNTPolicyProcessor *processor;
27	@end
28
29	@implementation SNTPolicyProcessorTest
30	- (void)setUp {	21✔
31	_processor = [[SNTPolicyProcessor alloc] init];	21✔
32	}	21✔
33
34	- (void)testRule:(SNTRule *)rule
35	transitiveRules:(BOOL)transitiveRules
36	final:(BOOL)final
37	matches:(BOOL)matches
38	silent:(BOOL)silent
39	expectedDecision:(SNTEventState)decision {	40✔
40	SNTCachedDecision *cd = [[SNTCachedDecision alloc] init];	40✔
41	if (matches) {	40✔
42	switch (rule.type) {	39✔
43	case SNTRuleTypeBinary: cd.sha256 = rule.identifier; break;	11✔
44	case SNTRuleTypeCertificate: cd.certSHA256 = rule.identifier; break;	6✔
45	case SNTRuleTypeCDHash: cd.cdhash = rule.identifier; break;	8✔
46	default: break;	14✔
47	}	39✔
48	} else {	39✔
49	switch (rule.type) {	1✔
50	case SNTRuleTypeBinary:	1!
51	cd.sha256 = @"2334567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef";	1✔
52	break;	1✔
NEW 53	case SNTRuleTypeCertificate:	×
NEW 54	cd.certSHA256 = @"2234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef";	×
NEW 55	break;	×
NEW 56	case SNTRuleTypeCDHash: cd.cdhash = @"b023fbe5361a5bbd793dc3889556e93f41ec9bb8"; break;	×
NEW 57	default: break;	×
58	}	1✔
59	}	1✔
60	BOOL decisionIsFinal = [self.processor decision:cd	40✔
61	forRule:rule	40✔
62	withTransitiveRules:transitiveRules];	40✔
63	XCTAssertEqual(cd.decision, decision);	40!
64	XCTAssertEqual(decisionIsFinal, final);	40!
65	XCTAssertEqual(cd.silentBlock, silent);	40!
66	}	40✔
67
68	- (void)testDecisionForBlockByCDHashRuleMatches {	1✔
69	SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{	1✔
70	@"rule_type" : @"CDHASH",	1✔
71	@"identifier" : @"a023fbe5361a5bbd793dc3889556e93f41ec9bb8",	1✔
72	@"policy" : @"BLOCKLIST"	1✔
73	}];	1✔
74
75	XCTAssertNotNil(rule, "invalid test rule dictionary");	1!
76	[self testRule:rule	1✔
77	transitiveRules:YES	1✔
78	final:YES	1✔
79	matches:YES	1✔
80	silent:NO	1✔
81	expectedDecision:SNTEventStateBlockCDHash];	1✔
82	[self testRule:rule	1✔
83	transitiveRules:NO	1✔
84	final:YES	1✔
85	matches:YES	1✔
86	silent:NO	1✔
87	expectedDecision:SNTEventStateBlockCDHash];	1✔
88	}	1✔
89
90	- (void)testDecisionForSilentBlockByCDHashRuleMatches {	1✔
91	SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{	1✔
92	@"rule_type" : @"CDHASH",	1✔
93	@"identifier" : @"a023fbe5361a5bbd793dc3889556e93f41ec9bb8",	1✔
94	@"policy" : @"SILENT_BLOCKLIST"	1✔
95	}];	1✔
96
97	XCTAssertNotNil(rule, "invalid test rule dictionary");	1!
98	[self testRule:rule	1✔
99	transitiveRules:YES	1✔
100	final:YES	1✔
101	matches:YES	1✔
102	silent:YES	1✔
103	expectedDecision:SNTEventStateBlockCDHash];	1✔
104	// Ensure that nothing changes when disabling transitive rules.
105	[self testRule:rule	1✔
106	transitiveRules:NO	1✔
107	final:YES	1✔
108	matches:YES	1✔
109	silent:YES	1✔
110	expectedDecision:SNTEventStateBlockCDHash];	1✔
111	}	1✔
112
113	- (void)testDecisionForAllowbyCDHashRuleMatches {	1✔
114	SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{	1✔
115	@"rule_type" : @"CDHASH",	1✔
116	@"identifier" : @"a023fbe5361a5bbd793dc3889556e93f41ec9bb8",	1✔
117	@"policy" : @"ALLOWLIST"	1✔
118	}];	1✔
119
120	XCTAssertNotNil(rule, "invalid test rule dictionary");	1!
121	[self testRule:rule	1✔
122	transitiveRules:YES	1✔
123	final:YES	1✔
124	matches:YES	1✔
125	silent:NO	1✔
126	expectedDecision:SNTEventStateAllowCDHash];	1✔
127	// Ensure that nothing changes when disabling transitive rules.
128	[self testRule:rule	1✔
129	transitiveRules:NO	1✔
130	final:YES	1✔
131	matches:YES	1✔
132	silent:NO	1✔
133	expectedDecision:SNTEventStateAllowCDHash];	1✔
134	}	1✔
135
136	- (void)testDecisionForBlockBySHA256RuleMatches {	1✔
137	SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{	1✔
138	@"rule_type" : @"BINARY",	1✔
139	@"identifier" : @"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",	1✔
140	@"policy" : @"BLOCKLIST"	1✔
141	}];	1✔
142
143	XCTAssertNotNil(rule, "invalid test rule dictionary");	1!
144
145	[self testRule:rule	1✔
146	transitiveRules:YES	1✔
147	final:YES	1✔
148	matches:YES	1✔
149	silent:NO	1✔
150	expectedDecision:SNTEventStateBlockBinary];	1✔
151	// Ensure that nothing changes when disabling transitive rules.
152	[self testRule:rule	1✔
153	transitiveRules:NO	1✔
154	final:YES	1✔
155	matches:YES	1✔
156	silent:NO	1✔
157	expectedDecision:SNTEventStateBlockBinary];	1✔
158	}	1✔
159
160	- (void)testDecisionForSilenBlockBySHA256RuleMatches {	1✔
161	SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{	1✔
162	@"rule_type" : @"BINARY",	1✔
163	@"identifier" : @"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",	1✔
164	@"policy" : @"SILENT_BLOCKLIST"	1✔
165	}];	1✔
166
167	XCTAssertNotNil(rule, "invalid test rule dictionary");	1!
168
169	[self testRule:rule	1✔
170	transitiveRules:YES	1✔
171	final:YES	1✔
172	matches:YES	1✔
173	silent:YES	1✔
174	expectedDecision:SNTEventStateBlockBinary];	1✔
175	// Ensure that nothing changes when disabling transitive rules.
176	[self testRule:rule	1✔
177	transitiveRules:NO	1✔
178	final:YES	1✔
179	matches:YES	1✔
180	silent:YES	1✔
181	expectedDecision:SNTEventStateBlockBinary];	1✔
182	}	1✔
183
184	- (void)testDecisionForAllowBySHA256RuleMatches {	1✔
185	SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{	1✔
186	@"rule_type" : @"BINARY",	1✔
187	@"identifier" : @"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",	1✔
188	@"policy" : @"ALLOWLIST"	1✔
189	}];	1✔
190
191	XCTAssertNotNil(rule, "invalid test rule dictionary");	1!
192	[self testRule:rule	1✔
193	transitiveRules:YES	1✔
194	final:YES	1✔
195	matches:YES	1✔
196	silent:NO	1✔
197	expectedDecision:SNTEventStateAllowBinary];	1✔
198	// Ensure that nothing changes when disabling transitive rules.
199	[self testRule:rule	1✔
200	transitiveRules:NO	1✔
201	final:YES	1✔
202	matches:YES	1✔
203	silent:NO	1✔
204	expectedDecision:SNTEventStateAllowBinary];	1✔
205	}	1✔
206
207	- (void)testDecisionForSigningIDBlockRuleMatches {	1✔
208	SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{	1✔
209	@"rule_type" : @"SIGNINGID",	1✔
210	@"identifier" : @"ABCDEFGHIJ:ABCDEFGHIJ",	1✔
211	@"policy" : @"BLOCKLIST"	1✔
212	}];	1✔
213
214	XCTAssertNotNil(rule, "invalid test rule dictionary");	1!
215	[self testRule:rule	1✔
216	transitiveRules:YES	1✔
217	final:YES	1✔
218	matches:YES	1✔
219	silent:NO	1✔
220	expectedDecision:SNTEventStateBlockSigningID];	1✔
221	// Ensure that nothing changes when disabling transitive rules.
222	[self testRule:rule	1✔
223	transitiveRules:NO	1✔
224	final:YES	1✔
225	matches:YES	1✔
226	silent:NO	1✔
227	expectedDecision:SNTEventStateBlockSigningID];	1✔
228	}	1✔
229
230	// Signing ID rules
231	- (void)testDecisionForSigningIDSilentBlockRuleMatches {	1✔
232	SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{	1✔
233	@"rule_type" : @"SIGNINGID",	1✔
234	@"identifier" : @"TEAMID1234:ABCDEFGHIJ",	1✔
235	@"policy" : @"SILENT_BLOCKLIST"	1✔
236	}];	1✔
237
238	XCTAssertNotNil(rule, "invalid test rule dictionary");	1!
239	[self testRule:rule	1✔
240	transitiveRules:YES	1✔
241	final:YES	1✔
242	matches:YES	1✔
243	silent:YES	1✔
244	expectedDecision:SNTEventStateBlockSigningID];	1✔
245	// Ensure that nothing changes when disabling transitive rules.
246	[self testRule:rule	1✔
247	transitiveRules:NO	1✔
248	final:YES	1✔
249	matches:YES	1✔
250	silent:YES	1✔
251	expectedDecision:SNTEventStateBlockSigningID];	1✔
252	}	1✔
253
254	- (void)testDecisionForSigningIDAllowRuleMatches {	1✔
255	SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{	1✔
256	@"rule_type" : @"SIGNINGID",	1✔
257	@"identifier" : @"TEAMID1234:ABCDEFGHIJ",	1✔
258	@"policy" : @"ALLOWLIST"	1✔
259	}];	1✔
260
261	XCTAssertNotNil(rule, "invalid test rule dictionary");	1!
262	[self testRule:rule	1✔
263	transitiveRules:YES	1✔
264	final:YES	1✔
265	matches:YES	1✔
266	silent:NO	1✔
267	expectedDecision:SNTEventStateAllowSigningID];	1✔
268	// Ensure that nothing changes when disabling transitive rules.
269	[self testRule:rule	1✔
270	transitiveRules:NO	1✔
271	final:YES	1✔
272	matches:YES	1✔
273	silent:NO	1✔
274	expectedDecision:SNTEventStateAllowSigningID];	1✔
275	}	1✔
276
277	// Certificate rules
278	- (void)testDecisionForCertificateBlockRuleMatches {	1✔
279	SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{	1✔
280	@"rule_type" : @"CERTIFICATE",	1✔
281	@"identifier" : @"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",	1✔
282	@"policy" : @"BLOCKLIST"	1✔
283	}];	1✔
284
285	XCTAssertNotNil(rule, "invalid test rule dictionary");	1!
286	[self testRule:rule	1✔
287	transitiveRules:YES	1✔
288	final:YES	1✔
289	matches:YES	1✔
290	silent:NO	1✔
291	expectedDecision:SNTEventStateBlockCertificate];	1✔
292	// Ensure that nothing changes when disabling transitive rules.
293	[self testRule:rule	1✔
294	transitiveRules:NO	1✔
295	final:YES	1✔
296	matches:YES	1✔
297	silent:NO	1✔
298	expectedDecision:SNTEventStateBlockCertificate];	1✔
299	}	1✔
300
301	- (void)testDecisionForCertificateSilentBlockRuleMatches {	1✔
302	SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{	1✔
303	@"rule_type" : @"CERTIFICATE",	1✔
304	@"identifier" : @"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",	1✔
305	@"policy" : @"SILENT_BLOCKLIST"	1✔
306	}];	1✔
307
308	XCTAssertNotNil(rule, "invalid test rule dictionary");	1!
309	[self testRule:rule	1✔
310	transitiveRules:YES	1✔
311	final:YES	1✔
312	matches:YES	1✔
313	silent:YES	1✔
314	expectedDecision:SNTEventStateBlockCertificate];	1✔
315	// Ensure that nothing changes when disabling transitive rules.
316	[self testRule:rule	1✔
317	transitiveRules:NO	1✔
318	final:YES	1✔
319	matches:YES	1✔
320	silent:YES	1✔
321	expectedDecision:SNTEventStateBlockCertificate];	1✔
322	}	1✔
323
324	- (void)testDecisionForCertificateAllowRuleMatches {	1✔
325	SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{	1✔
326	@"rule_type" : @"CERTIFICATE",	1✔
327	@"identifier" : @"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",	1✔
328	@"policy" : @"ALLOWLIST"	1✔
329	}];	1✔
330
331	XCTAssertNotNil(rule, "invalid test rule dictionary");	1!
332	[self testRule:rule	1✔
333	transitiveRules:YES	1✔
334	final:YES	1✔
335	matches:YES	1✔
336	silent:NO	1✔
337	expectedDecision:SNTEventStateAllowCertificate];	1✔
338	// Ensure that nothing changes when disabling transitive rules.
339	[self testRule:rule	1✔
340	transitiveRules:NO	1✔
341	final:YES	1✔
342	matches:YES	1✔
343	silent:NO	1✔
344	expectedDecision:SNTEventStateAllowCertificate];	1✔
345	}	1✔
346
347	// Team ID rules
348	- (void)testDecisionForTeamIDBlockRuleMatches {	1✔
349	SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{	1✔
350	@"rule_type" : @"TEAMID",	1✔
351	@"identifier" : @"TEAMID1234",	1✔
352	@"policy" : @"BLOCKLIST"	1✔
353	}];	1✔
354
355	XCTAssertNotNil(rule, "invalid test rule dictionary");	1!
356	[self testRule:rule	1✔
357	transitiveRules:YES	1✔
358	final:YES	1✔
359	matches:YES	1✔
360	silent:NO	1✔
361	expectedDecision:SNTEventStateBlockTeamID];	1✔
362	// Ensure that nothing changes when disabling transitive rules.
363	[self testRule:rule	1✔
364	transitiveRules:NO	1✔
365	final:YES	1✔
366	matches:YES	1✔
367	silent:NO	1✔
368	expectedDecision:SNTEventStateBlockTeamID];	1✔
369	}	1✔
370
371	- (void)testDecisionForTeamIDSilentBlockRuleMatches {	1✔
372	SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{	1✔
373	@"rule_type" : @"TEAMID",	1✔
374	@"identifier" : @"TEAMID1234",	1✔
375	@"policy" : @"SILENT_BLOCKLIST"	1✔
376	}];	1✔
377
378	XCTAssertNotNil(rule, "invalid test rule dictionary");	1!
379	[self testRule:rule	1✔
380	transitiveRules:YES	1✔
381	final:YES	1✔
382	matches:YES	1✔
383	silent:YES	1✔
384	expectedDecision:SNTEventStateBlockTeamID];	1✔
385	// Ensure that nothing changes when disabling transitive rules.
386	[self testRule:rule	1✔
387	transitiveRules:NO	1✔
388	final:YES	1✔
389	matches:YES	1✔
390	silent:YES	1✔
391	expectedDecision:SNTEventStateBlockTeamID];	1✔
392	}	1✔
393
394	- (void)testDecisionForTeamIDAllowRuleMatches {	1✔
395	SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{	1✔
396	@"rule_type" : @"TEAMID",	1✔
397	@"identifier" : @"TEAMID1234",	1✔
398	@"policy" : @"ALLOWLIST"	1✔
399	}];	1✔
400
401	XCTAssertNotNil(rule, "invalid test rule dictionary");	1!
402	[self testRule:rule	1✔
403	transitiveRules:YES	1✔
404	final:YES	1✔
405	matches:YES	1✔
406	silent:NO	1✔
407	expectedDecision:SNTEventStateAllowTeamID];	1✔
408	// Ensure that nothing changes when disabling transitive rules.
409	[self testRule:rule	1✔
410	transitiveRules:NO	1✔
411	final:YES	1✔
412	matches:YES	1✔
413	silent:NO	1✔
414	expectedDecision:SNTEventStateAllowTeamID];	1✔
415	}	1✔
416
417	// Compiler rules
418	// CDHash
419	- (void)testDecisionForCDHashCompilerRuleMatches {	1✔
420	SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{	1✔
421	@"rule_type" : @"CDHASH",	1✔
422	@"identifier" : @"a023fbe5361a5bbd793dc3889556e93f41ec9bb8",	1✔
423	@"policy" : @"ALLOWLIST_COMPILER"	1✔
424	}];	1✔
425
426	XCTAssertNotNil(rule, "invalid test rule dictionary");	1!
427	[self testRule:rule	1✔
428	transitiveRules:YES	1✔
429	final:YES	1✔
430	matches:YES	1✔
431	silent:NO	1✔
432	expectedDecision:SNTEventStateAllowCompiler];	1✔
433	// Ensure disabling transitive rules results in a binary allow
434	[self testRule:rule	1✔
435	transitiveRules:NO	1✔
436	final:YES	1✔
437	matches:YES	1✔
438	silent:NO	1✔
439	expectedDecision:SNTEventStateAllowCDHash];	1✔
440	}	1✔
441
442	// SHA256
443	- (void)testDecisionForSHA256CompilerRuleMatches {	1✔
444	SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{	1✔
445	@"rule_type" : @"BINARY",	1✔
446	@"identifier" : @"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",	1✔
447	@"policy" : @"ALLOWLIST_COMPILER"	1✔
448	}];	1✔
449
450	XCTAssertNotNil(rule, "invalid test rule dictionary");	1!
451	[self testRule:rule	1✔
452	transitiveRules:YES	1✔
453	final:YES	1✔
454	matches:YES	1✔
455	silent:NO	1✔
456	expectedDecision:SNTEventStateAllowCompiler];	1✔
457	// Ensure disabling transitive rules results in a binary allow
458	[self testRule:rule	1✔
459	transitiveRules:NO	1✔
460	final:YES	1✔
461	matches:YES	1✔
462	silent:NO	1✔
463	expectedDecision:SNTEventStateAllowBinary];	1✔
464	}	1✔
465
466	// SigningID
467	- (void)testDecisionForSigningIDCompilerRuleMatches {	1✔
468	SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{	1✔
469	@"rule_type" : @"SIGNINGID",	1✔
470	@"identifier" : @"TEAMID1234:ABCDEFGHIJ",	1✔
471	@"policy" : @"ALLOWLIST_COMPILER"	1✔
472	}];	1✔
473
474	XCTAssertNotNil(rule, "invalid test rule dictionary");	1!
475	[self testRule:rule	1✔
476	transitiveRules:YES	1✔
477	final:YES	1✔
478	matches:YES	1✔
479	silent:NO	1✔
480	expectedDecision:SNTEventStateAllowCompiler];	1✔
481	// Ensure disabling transitive rules results in a Signing ID allow
482	[self testRule:rule	1✔
483	transitiveRules:NO	1✔
484	final:YES	1✔
485	matches:YES	1✔
486	silent:NO	1✔
487	expectedDecision:SNTEventStateAllowSigningID];	1✔
488	}	1✔
489
490	// Transitive allowlist rules
491	- (void)testDecisionForTransitiveAllowlistRuleMatches {	1✔
492	SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{	1✔
493	@"rule_type" : @"BINARY",	1✔
494	@"identifier" : @"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",	1✔
495	@"policy" : @"ALLOWLIST"	1✔
496	}];	1✔
497
498	XCTAssertNotNil(rule, "invalid test rule dictionary");	1!
499
500	rule.state = SNTRuleStateAllowTransitive;	1✔
501
502	[self testRule:rule	1✔
503	transitiveRules:YES	1✔
504	final:YES	1✔
505	matches:YES	1✔
506	silent:NO	1✔
507	expectedDecision:SNTEventStateAllowTransitive];	1✔
508	// Ensure that a transitive allowlist rule results in an
509	// SNTEventStateUnknown if transitive rules are disabled.
510	[self testRule:rule	1✔
511	transitiveRules:NO	1✔
512	final:NO	1✔
513	matches:YES	1✔
514	silent:NO	1✔
515	expectedDecision:SNTEventStateUnknown];	1✔
516	}	1✔
517
518	- (void)testEnsureANonMatchingRuleResultsInUnknown {	1✔
519	SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{	1✔
520	@"rule_type" : @"BINARY",	1✔
521	@"identifier" : @"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",	1✔
522	@"policy" : @"ALLOWLIST"	1✔
523	}];	1✔
524
525	XCTAssertNotNil(rule, "invalid test rule dictionary");	1!
526
527	rule.state = 88888; // Set to an invalid state	1✔
528
529	[self testRule:rule	1✔
530	transitiveRules:YES	1✔
531	final:NO	1✔
532	matches:NO	1✔
533	silent:NO	1✔
534	expectedDecision:SNTEventStateUnknown];	1✔
535
536	[self testRule:rule	1✔
537	transitiveRules:NO	1✔
538	final:NO	1✔
539	matches:YES	1✔
540	silent:NO	1✔
541	expectedDecision:SNTEventStateUnknown];	1✔
542	}	1✔
543
544	- (void)testEnsureCustomURLAndMessageAreSet {	1✔
545	SNTRule *rule = [[SNTRule alloc] initWithDictionary:@{	1✔
546	@"rule_type" : @"BINARY",	1✔
547	@"identifier" : @"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",	1✔
548	@"policy" : @"ALLOWLIST",	1✔
549	@"custom_msg" : @"Custom Message",	1✔
550	@"custom_url" : @"https://example.com"	1✔
551	}];	1✔
552
553	XCTAssertNotNil(rule, "invalid test rule dictionary");	1!
554
555	SNTCachedDecision *cd = [[SNTCachedDecision alloc] init];	1✔
556	cd.sha256 = rule.identifier;	1✔
557
558	[self.processor decision:cd forRule:rule withTransitiveRules:YES];	1✔
559
560	XCTAssertEqualObjects(cd.customMsg, @"Custom Message");	1!
561	XCTAssertEqualObjects(cd.customURL, @"https://example.com");	1!
562	}	1✔
563
564	@end

google / santa / 8810740245

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous