9271431202

Committed 28 May 2024 02:40PM UTC coverage: 62.471% (-0.2%) from 62.648%

Build # 9271431202

Build Type

Pull #1359

github

Committed by

web-flow

Commit Message

Merge 5c369faa3 into 7502bc247

Pull Request Pull Request #1359: sync: Add a protobuf for the existing sync protocol

Run Details

5301 of 12856 branches covered (41.23%)

Branch coverage included in aggregate %.

237 of 285 new or added lines in 5 files covered. (83.16%)

6 existing lines in 1 file now uncovered.

17807 of 24134 relevant lines covered (73.78%)

6831.73 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

63.5

/Source/santasyncservice/SNTSyncRuleDownload.mm

/// Copyright 2015 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santasyncservice/SNTSyncRuleDownload.h"
#include "Source/santasyncservice/SNTPushNotificationsTracker.h"

#import <MOLXPCConnection/MOLXPCConnection.h>

#import "Source/common/SNTRule.h"
#import "Source/common/SNTSyncConstants.h"
#import "Source/common/SNTXPCControlInterface.h"
#import "Source/common/String.h"
#import "Source/santasyncservice/SNTPushNotificationsTracker.h"
#import "Source/santasyncservice/SNTSyncLogging.h"
#import "Source/santasyncservice/SNTSyncState.h"

#include <google/protobuf/arena.h>
#include "Source/santasyncservice/syncv1.pb.h"
namespace pbv1 = ::santa::sync::v1;

using santa::common::NSStringToUTF8String;
using santa::common::StringToNSString;

SNTRuleCleanup SyncTypeToRuleCleanup(SNTSyncType syncType) {
  switch (syncType) {
    case SNTSyncTypeNormal: return SNTRuleCleanupNone;
    case SNTSyncTypeClean: return SNTRuleCleanupNonTransitive;
    case SNTSyncTypeCleanAll: return SNTRuleCleanupAll;
    default: return SNTRuleCleanupNone;
  }
}

@implementation SNTSyncRuleDownload

- (NSURL *)stageURL {
  NSString *stageName = [@"ruledownload" stringByAppendingFormat:@"/%@", self.syncState.machineID];
  return [NSURL URLWithString:stageName relativeToURL:self.syncState.syncBaseURL];
}

- (BOOL)sync {
  // Grab the new rules from server
  NSArray<SNTRule *> *newRules = [self downloadNewRulesFromServer];
  if (!newRules) return NO;         // encountered a problem with the download
  if (!newRules.count) return YES;  // successfully completed request, but no new rules

  // Tell santad to add the new rules to the database.
  // Wait until finished or until 5 minutes pass.
  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
  __block NSError *error;
  [[self.daemonConn remoteObjectProxy]
    databaseRuleAddRules:newRules
             ruleCleanup:SyncTypeToRuleCleanup(self.syncState.syncType)
                   reply:^(NSError *e) {
                     error = e;
                     dispatch_semaphore_signal(sema);
                   }];
  if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 300 * NSEC_PER_SEC))) {
    SLOGE(@"Failed to add rule(s) to database: timeout sending rules to daemon");
    return NO;
  }

  if (error) {
    SLOGE(@"Failed to add rule(s) to database: %@", error.localizedDescription);
    SLOGD(@"Failure reason: %@", error.localizedFailureReason);
    return NO;
  }

  // Tell santad to record a successful rules sync and wait for it to finish.
  sema = dispatch_semaphore_create(0);
  [[self.daemonConn remoteObjectProxy] setRuleSyncLastSuccess:[NSDate date]
                                                        reply:^{
                                                          dispatch_semaphore_signal(sema);
                                                        }];
  dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC));

  SLOGI(@"Processed %lu rules", newRules.count);

  // Send out push notifications about any newly allowed binaries
  // that had been previously blocked by santad.
  [self announceUnblockingRules:newRules];
  return YES;
}

// Downloads new rules from server and converts them into SNTRule.
// Returns an array of all converted rules, or nil if there was a server problem.
// Note that rules from the server are filtered.  We only keep those whose rule_type
// is either BINARY or CERTIFICATE.  PACKAGE rules are dropped.
- (NSArray<SNTRule *> *)downloadNewRulesFromServer {
  google::protobuf::Arena arena;

  self.syncState.rulesReceived = 0;
  NSMutableArray<SNTRule *> *newRules = [NSMutableArray array];
  std::string cursor;

  do {
    auto req = google::protobuf::Arena::Create<::pbv1::RuleDownloadRequest>(&arena);
    if (!cursor.empty()) {
      req->set_cursor(cursor);
    }
    ::pbv1::RuleDownloadResponse response;
    NSError *err = [self performRequest:[self requestWithMessage:req]
                            intoMessage:&response
                                timeout:30];

    if (err) {
      SLOGE(@"Error downloading rules: %@", err);
      return nil;
    }

    for (const ::pbv1::Rule &rule : response.rules()) {
      SNTRule *r = [self ruleFromProtoRule:rule];
      if (!r) {
        SLOGD(@"Ignoring bad rule: %s", rule.Utf8DebugString().c_str());
        continue;
      }
      // [self processBundleNotificationsForRule:rule fromDictionary:ruleDict];
      [newRules addObject:r];
    }

    cursor = response.cursor();
    SLOGI(@"Received %lu rules", (unsigned long)response.rules_size());
    self.syncState.rulesReceived += response.rules_size();
  } while (!cursor.empty());

  self.syncState.rulesProcessed = newRules.count;

  return newRules;
}

- (SNTRule *)ruleFromProtoRule:(::pbv1::Rule)rule {
  SNTRule *r = [[SNTRule alloc] init];

  r.identifier = StringToNSString(rule.identifier());
  if (!r.identifier.length) r.identifier = StringToNSString(rule.sha256());

  SNTRuleState state;
  switch (rule.policy()) {
    case ::pbv1::ALLOWLIST: state = SNTRuleStateAllow; break;
    case ::pbv1::ALLOWLIST_COMPILER: state = SNTRuleStateAllowCompiler; break;
    case ::pbv1::BLOCKLIST: state = SNTRuleStateBlock; break;
    case ::pbv1::SILENT_BLOCKLIST: state = SNTRuleStateSilentBlock; break;
    case ::pbv1::REMOVE: state = SNTRuleStateRemove; break;
    default: LOGE(@"Failed to process rule with unknown policy: %d", rule.policy()); return nil;
  }
  r.state = state;

  SNTRuleType type;
  switch (rule.rule_type()) {
    case ::pbv1::BINARY: type = SNTRuleTypeBinary; break;
    case ::pbv1::CERTIFICATE: type = SNTRuleTypeCertificate; break;
    case ::pbv1::TEAMID: type = SNTRuleTypeTeamID; break;
    case ::pbv1::SIGNINGID: type = SNTRuleTypeSigningID; break;
    case ::pbv1::CDHASH: type = SNTRuleTypeCDHash; break;
    default: LOGE(@"Failed to process rule with unknown type: %d", rule.rule_type()); return nil;
  }
  r.type = type;

  auto custom_msg = rule.custom_msg();
  if (!custom_msg.empty()) r.customMsg = StringToNSString(custom_msg);

  auto custom_url = rule.custom_url();
  if (!custom_url.empty()) r.customURL = StringToNSString(custom_url);

  return r;
}

// Send out push notifications for allowed bundles/binaries whose rule download was preceded by
// an associated announcing FCM message.
- (void)announceUnblockingRules:(NSArray<SNTRule *> *)newRules {
  NSMutableArray *processed = [NSMutableArray array];
  SNTPushNotificationsTracker *tracker = [SNTPushNotificationsTracker tracker];
  [[tracker all]
    enumerateKeysAndObjectsUsingBlock:^(NSString *key, NSDictionary *notifier, BOOL *stop) {
      // Each notifier object is a dictionary with name and count keys. If the count has been
      // decremented to zero, then this means that we have downloaded all of the rules associated
      // with this SHA256 hash (which might be a bundle hash or a binary hash), in which case we are
      // OK to show a notification that the named bundle/binary can be run.
      NSNumber *remaining = notifier[kFileBundleBinaryCount];
      if (remaining && [remaining intValue] == 0) {
        [processed addObject:key];
        NSString *message = [NSString stringWithFormat:@"%@ can now be run", notifier[kFileName]];
        [[self.daemonConn remoteObjectProxy] postRuleSyncNotificationWithCustomMessage:message
                                                                                 reply:^{
                                                                                 }];
      }
    }];

  [tracker removeNotificationsForHashes:processed];
}

- (void)processBundleNotificationsForRule:(SNTRule *)rule fromDictionary:(NSDictionary *)dict {
  // Check rule for extra notification related info.
  if (rule.state == SNTRuleStateAllow || rule.state == SNTRuleStateAllowCompiler) {
    // primaryHash is the bundle hash if there was a bundle hash included in the rule, otherwise
    // it is simply the binary hash.
    NSString *primaryHash = dict[kFileBundleHash];
    if (primaryHash.length != 64) {
      primaryHash = rule.identifier;
    }

    // As we read in rules, we update the "remaining count" information. This count represents the
    // number of rules associated with the primary hash that still need to be downloaded and added.
    [[SNTPushNotificationsTracker tracker]
      decrementPendingRulesForHash:primaryHash
                    totalRuleCount:dict[kFileBundleBinaryCount]];
  }
}

@end

1	/// Copyright 2015 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santasyncservice/SNTSyncRuleDownload.h"
16	#include "Source/santasyncservice/SNTPushNotificationsTracker.h"
17
18	#import <MOLXPCConnection/MOLXPCConnection.h>
19
20	#import "Source/common/SNTRule.h"
21	#import "Source/common/SNTSyncConstants.h"
22	#import "Source/common/SNTXPCControlInterface.h"
23	#import "Source/common/String.h"
24	#import "Source/santasyncservice/SNTPushNotificationsTracker.h"
25	#import "Source/santasyncservice/SNTSyncLogging.h"
26	#import "Source/santasyncservice/SNTSyncState.h"
27
28	#include <google/protobuf/arena.h>
29	#include "Source/santasyncservice/syncv1.pb.h"
30	namespace pbv1 = ::santa::sync::v1;
31
32	using santa::common::NSStringToUTF8String;
33	using santa::common::StringToNSString;
34
35	SNTRuleCleanup SyncTypeToRuleCleanup(SNTSyncType syncType) {	1✔
36	switch (syncType) {	1✔
37	case SNTSyncTypeNormal: return SNTRuleCleanupNone;	1!
38	case SNTSyncTypeClean: return SNTRuleCleanupNonTransitive;	×
39	case SNTSyncTypeCleanAll: return SNTRuleCleanupAll;	×
40	default: return SNTRuleCleanupNone;	×
41	}	1✔
42	}	1✔
43
44	@implementation SNTSyncRuleDownload
45
46	- (NSURL *)stageURL {	2✔
47	NSString *stageName = [@"ruledownload" stringByAppendingFormat:@"/%@", self.syncState.machineID];	2✔
48	return [NSURL URLWithString:stageName relativeToURL:self.syncState.syncBaseURL];	2✔
49	}	2✔
50
51	- (BOOL)sync {	1✔
52	// Grab the new rules from server
53	NSArray<SNTRule > newRules = [self downloadNewRulesFromServer];	1✔
54	if (!newRules) return NO; // encountered a problem with the download	1!
55	if (!newRules.count) return YES; // successfully completed request, but no new rules	1!
56
57	// Tell santad to add the new rules to the database.
58	// Wait until finished or until 5 minutes pass.
59	dispatch_semaphore_t sema = dispatch_semaphore_create(0);	1✔
60	__block NSError *error;	1✔
61	[[self.daemonConn remoteObjectProxy]	1✔
62	databaseRuleAddRules:newRules	1✔
63	ruleCleanup:SyncTypeToRuleCleanup(self.syncState.syncType)	1✔
64	reply:^(NSError *e) {	1✔
65	error = e;	1✔
66	dispatch_semaphore_signal(sema);	1✔
67	}];	1✔
68	if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 300 * NSEC_PER_SEC))) {	1!
69	SLOGE(@"Failed to add rule(s) to database: timeout sending rules to daemon");	×
70	return NO;	×
71	}	×
72
73	if (error) {	1!
74	SLOGE(@"Failed to add rule(s) to database: %@", error.localizedDescription);	×
75	SLOGD(@"Failure reason: %@", error.localizedFailureReason);	×
76	return NO;	×
77	}	×
78
79	// Tell santad to record a successful rules sync and wait for it to finish.
80	sema = dispatch_semaphore_create(0);	1✔
81	[[self.daemonConn remoteObjectProxy] setRuleSyncLastSuccess:[NSDate date]	1✔
82	reply:^{	1✔
83	dispatch_semaphore_signal(sema);	×
84	}];	×
85	dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC));	1✔
86
87	SLOGI(@"Processed %lu rules", newRules.count);	1✔
88
89	// Send out push notifications about any newly allowed binaries
90	// that had been previously blocked by santad.
91	[self announceUnblockingRules:newRules];	1✔
92	return YES;	1✔
93	}	1✔
94
95	// Downloads new rules from server and converts them into SNTRule.
96	// Returns an array of all converted rules, or nil if there was a server problem.
97	// Note that rules from the server are filtered. We only keep those whose rule_type
98	// is either BINARY or CERTIFICATE. PACKAGE rules are dropped.
99	- (NSArray<SNTRule > )downloadNewRulesFromServer {	1✔
100	google::protobuf::Arena arena;	1✔
101
102	self.syncState.rulesReceived = 0;	1✔
103	NSMutableArray<SNTRule > newRules = [NSMutableArray array];	1✔
104	std::string cursor;	1✔
105
106	do {	2✔
107	auto req = google::protobuf::Arena::Create<::pbv1::RuleDownloadRequest>(&arena);	2✔
108	if (!cursor.empty()) {	2✔
109	req->set_cursor(cursor);	1✔
110	}	1✔
111	::pbv1::RuleDownloadResponse response;	2✔
112	NSError *err = [self performRequest:[self requestWithMessage:req]	2✔
113	intoMessage:&response	2✔
114	timeout:30];	2✔
115
116	if (err) {	2!
NEW 117	SLOGE(@"Error downloading rules: %@", err);	×
118	return nil;	×
119	}	×
120
121	for (const ::pbv1::Rule &rule : response.rules()) {	4✔
122	SNTRule *r = [self ruleFromProtoRule:rule];	4✔
123	if (!r) {	4!
NEW 124	SLOGD(@"Ignoring bad rule: %s", rule.Utf8DebugString().c_str());	×
125	continue;	×
126	}	×
127	// [self processBundleNotificationsForRule:rule fromDictionary:ruleDict];
128	[newRules addObject:r];	4✔
129	}	4✔
130
131	cursor = response.cursor();	2✔
132	SLOGI(@"Received %lu rules", (unsigned long)response.rules_size());	2✔
133	self.syncState.rulesReceived += response.rules_size();	2✔
134	} while (!cursor.empty());	2✔
135
136	self.syncState.rulesProcessed = newRules.count;	1✔
137
138	return newRules;	1✔
139	}	1✔
140
141	- (SNTRule *)ruleFromProtoRule:(::pbv1::Rule)rule {	4✔
142	SNTRule *r = [[SNTRule alloc] init];	4✔
143
144	r.identifier = StringToNSString(rule.identifier());	4✔
145	if (!r.identifier.length) r.identifier = StringToNSString(rule.sha256());	4✔
146
147	SNTRuleState state;	4✔
148	switch (rule.policy()) {	4✔
149	case ::pbv1::ALLOWLIST: state = SNTRuleStateAllow; break;	1✔
NEW 150	case ::pbv1::ALLOWLIST_COMPILER: state = SNTRuleStateAllowCompiler; break;	×
151	case ::pbv1::BLOCKLIST: state = SNTRuleStateBlock; break;	3✔
NEW 152	case ::pbv1::SILENT_BLOCKLIST: state = SNTRuleStateSilentBlock; break;	×
NEW 153	case ::pbv1::REMOVE: state = SNTRuleStateRemove; break;	×
NEW 154	default: LOGE(@"Failed to process rule with unknown policy: %d", rule.policy()); return nil;	×
155	}	4✔
156	r.state = state;	4✔
157
158	SNTRuleType type;	4✔
159	switch (rule.rule_type()) {	4✔
160	case ::pbv1::BINARY: type = SNTRuleTypeBinary; break;	1✔
161	case ::pbv1::CERTIFICATE: type = SNTRuleTypeCertificate; break;	2✔
162	case ::pbv1::TEAMID: type = SNTRuleTypeTeamID; break;	1✔
NEW 163	case ::pbv1::SIGNINGID: type = SNTRuleTypeSigningID; break;	×
NEW 164	case ::pbv1::CDHASH: type = SNTRuleTypeCDHash; break;	×
NEW 165	default: LOGE(@"Failed to process rule with unknown type: %d", rule.rule_type()); return nil;	×
166	}	4✔
167	r.type = type;	4✔
168
169	auto custom_msg = rule.custom_msg();	4✔
170	if (!custom_msg.empty()) r.customMsg = StringToNSString(custom_msg);	4✔
171
172	auto custom_url = rule.custom_url();	4✔
173	if (!custom_url.empty()) r.customURL = StringToNSString(custom_url);	4!
174
175	return r;	4✔
176	}	4✔
177
178	// Send out push notifications for allowed bundles/binaries whose rule download was preceded by
179	// an associated announcing FCM message.
180	- (void)announceUnblockingRules:(NSArray<SNTRule > )newRules {	1✔
181	NSMutableArray *processed = [NSMutableArray array];	1✔
182	SNTPushNotificationsTracker *tracker = [SNTPushNotificationsTracker tracker];	1✔
183	[[tracker all]	1✔
184	enumerateKeysAndObjectsUsingBlock:^(NSString key, NSDictionary notifier, BOOL *stop) {	1✔
185	// Each notifier object is a dictionary with name and count keys. If the count has been
186	// decremented to zero, then this means that we have downloaded all of the rules associated
187	// with this SHA256 hash (which might be a bundle hash or a binary hash), in which case we are
188	// OK to show a notification that the named bundle/binary can be run.
189	NSNumber *remaining = notifier[kFileBundleBinaryCount];	×
190	if (remaining && [remaining intValue] == 0) {	×
191	[processed addObject:key];	×
192	NSString *message = [NSString stringWithFormat:@"%@ can now be run", notifier[kFileName]];	×
193	[[self.daemonConn remoteObjectProxy] postRuleSyncNotificationWithCustomMessage:message	×
194	reply:^{	×
195	}];	×
196	}	×
197	}];	×
198
199	[tracker removeNotificationsForHashes:processed];	1✔
200	}	1✔
201
202	- (void)processBundleNotificationsForRule:(SNTRule )rule fromDictionary:(NSDictionary )dict {	×
203	// Check rule for extra notification related info.
204	if (rule.state == SNTRuleStateAllow \|\| rule.state == SNTRuleStateAllowCompiler) {	×
205	// primaryHash is the bundle hash if there was a bundle hash included in the rule, otherwise
206	// it is simply the binary hash.
207	NSString *primaryHash = dict[kFileBundleHash];	×
208	if (primaryHash.length != 64) {	×
209	primaryHash = rule.identifier;	×
210	}	×
211
212	// As we read in rules, we update the "remaining count" information. This count represents the
213	// number of rules associated with the primary hash that still need to be downloaded and added.
214	[[SNTPushNotificationsTracker tracker]	×
215	decrementPendingRulesForHash:primaryHash	×
216	totalRuleCount:dict[kFileBundleBinaryCount]];	×
217	}	×
218	}	×
219
220	@end

google / santa / 9271431202

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous