9271133483

Committed 28 May 2024 02:22PM UTC coverage: 62.547% (-0.1%) from 62.648%

Build # 9271133483

Build Type

Pull #1359

github

Committed by

web-flow

Commit Message

Merge 14a07ce02 into 7502bc247

Pull Request Pull Request #1359: sync: Add a protobuf for the existing sync protocol

Run Details

5270 of 12750 branches covered (41.33%)

Branch coverage included in aggregate %.

241 of 288 new or added lines in 5 files covered. (83.68%)

13 existing lines in 2 files now uncovered.

17800 of 24134 relevant lines covered (73.75%)

6991.9 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

84.97

/Source/santasyncservice/SNTSyncPreflight.mm

/// Copyright 2015 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santasyncservice/SNTSyncPreflight.h"
#include "Source/common/SNTCommonEnums.h"

#import <MOLXPCConnection/MOLXPCConnection.h>

#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTLogging.h"
#import "Source/common/SNTSyncConstants.h"
#import "Source/common/SNTSystemInfo.h"
#import "Source/common/SNTXPCControlInterface.h"
#import "Source/common/String.h"
#import "Source/santasyncservice/SNTSyncLogging.h"
#import "Source/santasyncservice/SNTSyncState.h"

#include <google/protobuf/arena.h>
#include "Source/santasyncservice/syncv1.pb.h"
namespace pbv1 = ::santa::sync::v1;

using santa::common::NSStringToUTF8String;
using santa::common::StringToNSString;

/*

Clean Sync Implementation Notes

The clean sync implementation seems a bit complex at first glance, but boils
down to the following rules:

1. If the server says to do a "clean" sync, a "clean" sync is performed, unless the
   client specified a "clean all" sync, in which case "clean all" is performed.
2. If the server responded that it is performing a "clean all" sync, a "clean all" is performed.
3. All other server responses result in a "normal" sync.

The following table expands upon the above logic to list most of the permutations:

| Client Sync State | Clean Sync Request? | Server Response    | Sync Type Performed |
| ----------------- | ------------------- | ------------------ | ------------------- |
| normal            | No                  | normal OR <empty>  | normal              |
| normal            | No                  | clean              | clean               |
| normal            | No                  | clean_all          | clean_all           |
| normal            | No                  | clean_sync (dep)   | clean               |
| normal            | Yes                 | New AND Dep Key    | Dep key ignored     |
| clean             | Yes                 | normal OR <empty>  | normal              |
| clean             | Yes                 | clean              | clean               |
| clean             | Yes                 | clean_all          | clean_all           |
| clean             | Yes                 | clean_sync (dep)   | clean               |
| clean             | Yes                 | New AND Dep Key    | Dep key ignored     |
| clean_all         | Yes                 | normal OR <empty>  | normal              |
| clean_all         | Yes                 | clean              | clean_all           |
| clean_all         | Yes                 | clean_all          | clean_all           |
| clean_all         | Yes                 | clean_sync (dep)   | clean_all           |
| clean_all         | Yes                 | New AND Dep Key    | Dep key ignored     |

*/
@implementation SNTSyncPreflight

- (NSURL *)stageURL {
  NSString *stageName = [@"preflight" stringByAppendingFormat:@"/%@", self.syncState.machineID];
  return [NSURL URLWithString:stageName relativeToURL:self.syncState.syncBaseURL];
}

- (BOOL)sync {
  google::protobuf::Arena arena;
  auto req = google::protobuf::Arena::Create<::pbv1::PreflightRequest>(&arena);
  req->set_serial_number(NSStringToUTF8String([SNTSystemInfo serialNumber]));
  req->set_hostname(NSStringToUTF8String([SNTSystemInfo longHostname]));
  req->set_os_version(NSStringToUTF8String([SNTSystemInfo osVersion]));
  req->set_os_build(NSStringToUTF8String([SNTSystemInfo osBuild]));
  req->set_model_identifier(NSStringToUTF8String([SNTSystemInfo modelIdentifier]));
  req->set_santa_version(
    NSStringToUTF8String([[NSBundle mainBundle] objectForInfoDictionaryKey:@"CFBundleVersion"]));
  req->set_primary_user(NSStringToUTF8String(self.syncState.machineOwner));

  if (self.syncState.pushNotificationsToken) {
    req->set_push_notification_token(NSStringToUTF8String(self.syncState.pushNotificationsToken));
  }

  id<SNTDaemonControlXPC> rop = [self.daemonConn synchronousRemoteObjectProxy];

  [rop databaseRuleCounts:^(struct RuleCounts counts) {
    req->set_binary_rule_count(uint32(counts.binary));
    req->set_certificate_rule_count(uint32(counts.certificate));
    req->set_compiler_rule_count(uint32(counts.compiler));
    req->set_transitive_rule_count(uint32(counts.transitive));
    req->set_teamid_rule_count(uint32(counts.teamID));
    req->set_signingid_rule_count(uint32(counts.signingID));
    req->set_cdhash_rule_count(uint32(counts.cdhash));
  }];

  [rop clientMode:^(SNTClientMode cm) {
    switch (cm) {
      case SNTClientModeMonitor: req->set_client_mode(::pbv1::MONITOR); break;
      case SNTClientModeLockdown: req->set_client_mode(::pbv1::LOCKDOWN); break;
      default: break;
    }
  }];

  __block SNTSyncType requestSyncType = SNTSyncTypeNormal;
  [rop syncTypeRequired:^(SNTSyncType syncTypeRequired) {
    requestSyncType = syncTypeRequired;
  }];

  // If user requested it or we've never had a successful sync, try from a clean slate.
  if (requestSyncType == SNTSyncTypeClean || requestSyncType == SNTSyncTypeCleanAll) {
    SLOGD(@"%@ sync requested by user",
          (requestSyncType == SNTSyncTypeCleanAll) ? @"Clean All" : @"Clean");
    req->set_request_clean_sync(true);
  }

  ::pbv1::PreflightResponse resp;
  NSError *err = [self performRequest:[self requestWithMessage:req] intoMessage:&resp timeout:30];

  if (err) {
    SLOGE(@"Failed preflight request: %@", err);
    return NO;
  }

  self.syncState.enableBundles = @(resp.enable_bundles() || resp.deprecated_bundles_enabled());
  self.syncState.enableTransitiveRules =
    @(resp.enable_transitive_rules() || resp.deprecated_enabled_transitive_whitelisting() ||
      resp.deprecated_transitive_whitelisting_enabled());
  self.syncState.enableAllEventUpload = @(resp.enable_all_event_upload());
  self.syncState.disableUnknownEventUpload = @(resp.disable_unknown_event_upload());
  self.syncState.eventBatchSize = resp.batch_size();

  // Don't let these go too low
  auto value = resp.push_notification_full_sync_interval();
  if (value == 0) {
    value = resp.deprecated_fcm_full_sync_interval();
  }
  self.syncState.pushNotificationsFullSyncInterval =
    (value < kDefaultFullSyncInterval) ? kDefaultPushNotificationsFullSyncInterval : value;

  value = resp.push_notification_global_rule_sync_interval();
  if (value == 0) {
    value = resp.deprecated_fcm_global_rule_sync_deadline();
  }
  self.syncState.pushNotificationsFullSyncInterval =
    (value < kDefaultFullSyncInterval) ? kDefaultPushNotificationsFullSyncInterval : value;

  // Check if our sync interval has changed
  value = resp.full_sync_interval();
  self.syncState.fullSyncInterval = (value < 60) ? kDefaultFullSyncInterval : value;

  switch (resp.client_mode()) {
    case ::pbv1::MONITOR: self.syncState.clientMode = SNTClientModeMonitor; break;
    case ::pbv1::LOCKDOWN: self.syncState.clientMode = SNTClientModeLockdown; break;
    default: break;
  }

  if (resp.has_allowed_path_regex()) {
    self.syncState.allowlistRegex = StringToNSString(resp.allowed_path_regex());
  } else if (resp.has_deprecated_whitelist_regex()) {
    self.syncState.allowlistRegex = StringToNSString(resp.deprecated_whitelist_regex());
  }

  if (resp.has_blocked_path_regex()) {
    self.syncState.blocklistRegex = StringToNSString(resp.blocked_path_regex());
  } else if (resp.has_deprecated_blacklist_regex()) {
    self.syncState.blocklistRegex = StringToNSString(resp.deprecated_blacklist_regex());
  }

  if (resp.has_block_usb_mount()) {
    self.syncState.blockUSBMount = @(resp.block_usb_mount());
  }

  self.syncState.remountUSBMode = [NSMutableArray array];
  for (auto mode : resp.remount_usb_mode()) {
    [(NSMutableArray *)self.syncState.remountUSBMode addObject:StringToNSString(mode)];
  }

  if (resp.has_override_file_access_action()) {
    self.syncState.overrideFileAccessAction = StringToNSString(resp.override_file_access_action());
  }

  // Default sync type is SNTSyncTypeNormal
  //
  // Logic overview:
  // The requested sync type (clean or normal) is merely informative. The server
  // can choose to respond with a normal, clean or clean_all.
  //
  // If the server responds that it will perform a clean sync, santa will
  // treat it as either a clean or clean_all depending on which was requested.
  //
  // The server can also "override" the requested clean operation. If a normal
  // sync was requested, but the server responded that it was doing a clean or
  // clean_all sync, that will take precedence. Similarly, if only a clean sync
  // was requested, the server can force a "clean_all" operation to take place.
  self.syncState.syncType = SNTSyncTypeNormal;

  // If kSyncType response key exists, it overrides the kCleanSyncDeprecated value
  // First check if the kSyncType reponse key exists. If so, it takes precedence
  // over the kCleanSyncDeprecated key.
  auto responseSyncType = resp.sync_type();
  if (!responseSyncType.empty()) {
    // If the client wants to Clean All, this takes precedence. The server
    // cannot override the client wanting to remove all rules.
    if (responseSyncType == "clean") {
      SLOGD(@"Clean sync requested by server");
      if (requestSyncType == SNTSyncTypeCleanAll) {
        self.syncState.syncType = SNTSyncTypeCleanAll;
      } else {
        self.syncState.syncType = SNTSyncTypeClean;
      }
    } else if (responseSyncType == "clean_all") {
      self.syncState.syncType = SNTSyncTypeCleanAll;
    }
  } else if (resp.deprecated_clean_sync()) {
    // If the deprecated key is set, the type of sync clean performed should be
    // the type that was requested. This must be set appropriately so that it
    // can be propagated during the Rule Download stage so SNTRuleTable knows
    // which rules to delete.
    SLOGD(@"Clean sync requested by server");
    if (requestSyncType == SNTSyncTypeCleanAll) {
      self.syncState.syncType = SNTSyncTypeCleanAll;
    } else {
      self.syncState.syncType = SNTSyncTypeClean;
    }
  }

  return YES;
}

@end

1	/// Copyright 2015 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santasyncservice/SNTSyncPreflight.h"
16	#include "Source/common/SNTCommonEnums.h"
17
18	#import <MOLXPCConnection/MOLXPCConnection.h>
19
20	#import "Source/common/SNTConfigurator.h"
21	#import "Source/common/SNTLogging.h"
22	#import "Source/common/SNTSyncConstants.h"
23	#import "Source/common/SNTSystemInfo.h"
24	#import "Source/common/SNTXPCControlInterface.h"
25	#import "Source/common/String.h"
26	#import "Source/santasyncservice/SNTSyncLogging.h"
27	#import "Source/santasyncservice/SNTSyncState.h"
28
29	#include <google/protobuf/arena.h>
30	#include "Source/santasyncservice/syncv1.pb.h"
31	namespace pbv1 = ::santa::sync::v1;
32
33	using santa::common::NSStringToUTF8String;
34	using santa::common::StringToNSString;
35
36	/*
37
38	Clean Sync Implementation Notes
39
40	The clean sync implementation seems a bit complex at first glance, but boils
41	down to the following rules:
42
43	1. If the server says to do a "clean" sync, a "clean" sync is performed, unless the
44	client specified a "clean all" sync, in which case "clean all" is performed.
45	2. If the server responded that it is performing a "clean all" sync, a "clean all" is performed.
46	3. All other server responses result in a "normal" sync.
47
48	The following table expands upon the above logic to list most of the permutations:
49
50	\| Client Sync State \| Clean Sync Request? \| Server Response \| Sync Type Performed \|
51	\| ----------------- \| ------------------- \| ------------------ \| ------------------- \|
52	\| normal \| No \| normal OR <empty> \| normal \|
53	\| normal \| No \| clean \| clean \|
54	\| normal \| No \| clean_all \| clean_all \|
55	\| normal \| No \| clean_sync (dep) \| clean \|
56	\| normal \| Yes \| New AND Dep Key \| Dep key ignored \|
57	\| clean \| Yes \| normal OR <empty> \| normal \|
58	\| clean \| Yes \| clean \| clean \|
59	\| clean \| Yes \| clean_all \| clean_all \|
60	\| clean \| Yes \| clean_sync (dep) \| clean \|
61	\| clean \| Yes \| New AND Dep Key \| Dep key ignored \|
62	\| clean_all \| Yes \| normal OR <empty> \| normal \|
63	\| clean_all \| Yes \| clean \| clean_all \|
64	\| clean_all \| Yes \| clean_all \| clean_all \|
65	\| clean_all \| Yes \| clean_sync (dep) \| clean_all \|
66	\| clean_all \| Yes \| New AND Dep Key \| Dep key ignored \|
67
68	*/
69	@implementation SNTSyncPreflight
70
71	- (NSURL *)stageURL {	25✔
72	NSString *stageName = [@"preflight" stringByAppendingFormat:@"/%@", self.syncState.machineID];	25✔
73	return [NSURL URLWithString:stageName relativeToURL:self.syncState.syncBaseURL];	25✔
74	}	25✔
75
76	- (BOOL)sync {	25✔
77	google::protobuf::Arena arena;	25✔
78	auto req = google::protobuf::Arena::Create<::pbv1::PreflightRequest>(&arena);	25✔
79	req->set_serial_number(NSStringToUTF8String([SNTSystemInfo serialNumber]));	25✔
80	req->set_hostname(NSStringToUTF8String([SNTSystemInfo longHostname]));	25✔
81	req->set_os_version(NSStringToUTF8String([SNTSystemInfo osVersion]));	25✔
82	req->set_os_build(NSStringToUTF8String([SNTSystemInfo osBuild]));	25✔
83	req->set_model_identifier(NSStringToUTF8String([SNTSystemInfo modelIdentifier]));	25✔
84	req->set_santa_version(	25✔
85	NSStringToUTF8String([[NSBundle mainBundle] objectForInfoDictionaryKey:@"CFBundleVersion"]));	25✔
86	req->set_primary_user(NSStringToUTF8String(self.syncState.machineOwner));	25✔
87
88	if (self.syncState.pushNotificationsToken) {	25!
NEW 89	req->set_push_notification_token(NSStringToUTF8String(self.syncState.pushNotificationsToken));	×
90	}	×
91
92	id<SNTDaemonControlXPC> rop = [self.daemonConn synchronousRemoteObjectProxy];	25✔
93
94	[rop databaseRuleCounts:^(struct RuleCounts counts) {	25✔
95	req->set_binary_rule_count(uint32(counts.binary));	25✔
96	req->set_certificate_rule_count(uint32(counts.certificate));	25✔
97	req->set_compiler_rule_count(uint32(counts.compiler));	25✔
98	req->set_transitive_rule_count(uint32(counts.transitive));	25✔
99	req->set_teamid_rule_count(uint32(counts.teamID));	25✔
100	req->set_signingid_rule_count(uint32(counts.signingID));	25✔
101	req->set_cdhash_rule_count(uint32(counts.cdhash));	25✔
102	}];	25✔
103
104	[rop clientMode:^(SNTClientMode cm) {	25✔
105	switch (cm) {	24✔
106	case SNTClientModeMonitor: req->set_client_mode(::pbv1::MONITOR); break;	24!
NEW 107	case SNTClientModeLockdown: req->set_client_mode(::pbv1::LOCKDOWN); break;	×
108	default: break;	×
109	}	24✔
110	}];	24✔
111
112	__block SNTSyncType requestSyncType = SNTSyncTypeNormal;	25✔
113	[rop syncTypeRequired:^(SNTSyncType syncTypeRequired) {	25✔
114	requestSyncType = syncTypeRequired;	24✔
115	}];	24✔
116
117	// If user requested it or we've never had a successful sync, try from a clean slate.
118	if (requestSyncType == SNTSyncTypeClean \|\| requestSyncType == SNTSyncTypeCleanAll) {	25✔
119	SLOGD(@"%@ sync requested by user",	12✔
120	(requestSyncType == SNTSyncTypeCleanAll) ? @"Clean All" : @"Clean");	12✔
121	req->set_request_clean_sync(true);	12✔
122	}	12✔
123
124	::pbv1::PreflightResponse resp;	25✔
125	NSError *err = [self performRequest:[self requestWithMessage:req] intoMessage:&resp timeout:30];	25✔
126
127	if (err) {	25!
NEW 128	SLOGE(@"Failed preflight request: %@", err);	×
NEW 129	return NO;	×
NEW 130	}	×
131
132	self.syncState.enableBundles = @(resp.enable_bundles() \|\| resp.deprecated_bundles_enabled());	25✔
133	self.syncState.enableTransitiveRules =	25✔
134	@(resp.enable_transitive_rules() \|\| resp.deprecated_enabled_transitive_whitelisting() \|\|	25✔
135	resp.deprecated_transitive_whitelisting_enabled());	25✔
136	self.syncState.enableAllEventUpload = @(resp.enable_all_event_upload());	25✔
137	self.syncState.disableUnknownEventUpload = @(resp.disable_unknown_event_upload());	25✔
138	self.syncState.eventBatchSize = resp.batch_size();	25✔
139
140	// Don't let these go too low
141	auto value = resp.push_notification_full_sync_interval();	25✔
142	if (value == 0) {	25!
143	value = resp.deprecated_fcm_full_sync_interval();	25✔
144	}	25✔
145	self.syncState.pushNotificationsFullSyncInterval =	25✔
146	(value < kDefaultFullSyncInterval) ? kDefaultPushNotificationsFullSyncInterval : value;	25✔
147
148	value = resp.push_notification_global_rule_sync_interval();	25✔
149	if (value == 0) {	25!
150	value = resp.deprecated_fcm_global_rule_sync_deadline();	25✔
151	}	25✔
152	self.syncState.pushNotificationsFullSyncInterval =	25✔
153	(value < kDefaultFullSyncInterval) ? kDefaultPushNotificationsFullSyncInterval : value;	25✔
154
155	// Check if our sync interval has changed
156	value = resp.full_sync_interval();	25✔
157	self.syncState.fullSyncInterval = (value < 60) ? kDefaultFullSyncInterval : value;	25✔
158
159	switch (resp.client_mode()) {	25✔
160	case ::pbv1::MONITOR: self.syncState.clientMode = SNTClientModeMonitor; break;	19✔
161	case ::pbv1::LOCKDOWN: self.syncState.clientMode = SNTClientModeLockdown; break;	6✔
NEW 162	default: break;	×
163	}	25✔
164
165	if (resp.has_allowed_path_regex()) {	25!
NEW 166	self.syncState.allowlistRegex = StringToNSString(resp.allowed_path_regex());	×
167	} else if (resp.has_deprecated_whitelist_regex()) {	25!
NEW 168	self.syncState.allowlistRegex = StringToNSString(resp.deprecated_whitelist_regex());	×
NEW 169	}	×
170
171	if (resp.has_blocked_path_regex()) {	25!
NEW 172	self.syncState.blocklistRegex = StringToNSString(resp.blocked_path_regex());	×
173	} else if (resp.has_deprecated_blacklist_regex()) {	25!
NEW 174	self.syncState.blocklistRegex = StringToNSString(resp.deprecated_blacklist_regex());	×
NEW 175	}	×
176
177	if (resp.has_block_usb_mount()) {	25✔
178	self.syncState.blockUSBMount = @(resp.block_usb_mount());	2✔
179	}	2✔
180
181	self.syncState.remountUSBMode = [NSMutableArray array];	25✔
182	for (auto mode : resp.remount_usb_mode()) {	25✔
183	[(NSMutableArray *)self.syncState.remountUSBMode addObject:StringToNSString(mode)];	2✔
184	}	2✔
185
186	if (resp.has_override_file_access_action()) {	25✔
187	self.syncState.overrideFileAccessAction = StringToNSString(resp.override_file_access_action());	1✔
188	}	1✔
189
190	// Default sync type is SNTSyncTypeNormal
191	//
192	// Logic overview:
193	// The requested sync type (clean or normal) is merely informative. The server
194	// can choose to respond with a normal, clean or clean_all.
195	//
196	// If the server responds that it will perform a clean sync, santa will
197	// treat it as either a clean or clean_all depending on which was requested.
198	//
199	// The server can also "override" the requested clean operation. If a normal
200	// sync was requested, but the server responded that it was doing a clean or
201	// clean_all sync, that will take precedence. Similarly, if only a clean sync
202	// was requested, the server can force a "clean_all" operation to take place.
203	self.syncState.syncType = SNTSyncTypeNormal;	25✔
204
205	// If kSyncType response key exists, it overrides the kCleanSyncDeprecated value
206	// First check if the kSyncType reponse key exists. If so, it takes precedence
207	// over the kCleanSyncDeprecated key.
208	auto responseSyncType = resp.sync_type();	25✔
209	if (!responseSyncType.empty()) {	25✔
210	// If the client wants to Clean All, this takes precedence. The server
211	// cannot override the client wanting to remove all rules.
212	if (responseSyncType == "clean") {	11✔
213	SLOGD(@"Clean sync requested by server");	3✔
214	if (requestSyncType == SNTSyncTypeCleanAll) {	3✔
215	self.syncState.syncType = SNTSyncTypeCleanAll;	1✔
216	} else {	2✔
217	self.syncState.syncType = SNTSyncTypeClean;	2✔
218	}	2✔
219	} else if (responseSyncType == "clean_all") {	8✔
220	self.syncState.syncType = SNTSyncTypeCleanAll;	3✔
221	}	3✔
222	} else if (resp.deprecated_clean_sync()) {	14✔
223	// If the deprecated key is set, the type of sync clean performed should be
224	// the type that was requested. This must be set appropriately so that it
225	// can be propagated during the Rule Download stage so SNTRuleTable knows
226	// which rules to delete.
227	SLOGD(@"Clean sync requested by server");	3✔
228	if (requestSyncType == SNTSyncTypeCleanAll) {	3✔
229	self.syncState.syncType = SNTSyncTypeCleanAll;	1✔
230	} else {	2✔
231	self.syncState.syncType = SNTSyncTypeClean;	2✔
232	}	2✔
233	}	3✔
234
235	return YES;	25✔
236	}	25✔
237
238	@end

google / santa / 9271133483

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous