9272684788

Committed 28 May 2024 04:04PM UTC coverage: 62.536% (-0.1%) from 62.648%

Build # 9272684788

Build Type

Pull #1359

github

Committed by

web-flow

Commit Message

Merge 66ad2d6d8 into 7502bc247

Pull Request Pull Request #1359: sync: Add a protobuf for the existing sync protocol

Run Details

5215 of 12696 branches covered (41.08%)

Branch coverage included in aggregate %.

237 of 288 new or added lines in 6 files covered. (82.29%)

7 existing lines in 1 file now uncovered.

17810 of 24123 relevant lines covered (73.83%)

7007.07 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

70.52

/Source/santasyncservice/SNTSyncEventUpload.mm

/// Copyright 2015 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santasyncservice/SNTSyncEventUpload.h"

#import <MOLCertificate/MOLCertificate.h>
#import <MOLXPCConnection/MOLXPCConnection.h>

#import "Source/common/SNTCommonEnums.h"
#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTFileInfo.h"
#import "Source/common/SNTLogging.h"
#import "Source/common/SNTStoredEvent.h"
#import "Source/common/SNTSyncConstants.h"
#import "Source/common/SNTXPCControlInterface.h"
#import "Source/common/String.h"
#import "Source/santasyncservice/NSData+Zlib.h"
#import "Source/santasyncservice/SNTSyncLogging.h"
#import "Source/santasyncservice/SNTSyncState.h"

#include <google/protobuf/arena.h>
#include "Source/santasyncservice/syncv1.pb.h"
namespace pbv1 = ::santa::sync::v1;

using santa::common::NSStringToUTF8String;

@implementation SNTSyncEventUpload

- (NSURL *)stageURL {
  NSString *stageName = [@"eventupload" stringByAppendingFormat:@"/%@", self.syncState.machineID];
  return [NSURL URLWithString:stageName relativeToURL:self.syncState.syncBaseURL];
}

- (BOOL)sync {
  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
  [[self.daemonConn remoteObjectProxy] databaseEventsPending:^(NSArray *events) {
    if (events.count) {
      [self uploadEvents:events];
    }
    dispatch_semaphore_signal(sema);
  }];
  return (dispatch_semaphore_wait(sema, DISPATCH_TIME_FOREVER) == 0);
}

- (BOOL)uploadEvents:(NSArray *)events {
  google::protobuf::Arena arena;
  auto req = google::protobuf::Arena::Create<::pbv1::EventUploadRequest>(&arena);
  auto uploadEvents = req->mutable_events();

  NSMutableSet *eventIds = [NSMutableSet setWithCapacity:events.count];
  for (SNTStoredEvent *event in events) {
    uploadEvents->Add([self messageForEvent:event]);
    if (event.idx) [eventIds addObject:event.idx];
    if (uploadEvents->size() >= self.syncState.eventBatchSize) break;
  }

  if (self.syncState.syncType == SNTSyncTypeNormal ||
      [[SNTConfigurator configurator] enableCleanSyncEventUpload]) {
    ::pbv1::EventUploadResponse response;
    NSError *err = [self performRequest:[self requestWithMessage:req]
                            intoMessage:&response
                                timeout:30];
    if (err) {
      SLOGE(@"Failed to upload events: %@", err);
      return NO;
    }

    // A list of bundle hashes that require their related binary events to be uploaded.
    if (response.event_upload_bundle_binaries_size()) {
      self.syncState.bundleBinaryRequests =
        [NSMutableArray arrayWithCapacity:response.event_upload_bundle_binaries_size()];
      for (auto bundle_binary : response.event_upload_bundle_binaries()) {
        [(NSMutableArray *)self.syncState.bundleBinaryRequests
          addObject:santa::common::StringToNSString(bundle_binary)];
      }
    }
    SLOGI(@"Uploaded %d events", uploadEvents->size());
  }

  // Remove event IDs. For Bundle Events the ID is 0 so nothing happens.
  [[self.daemonConn remoteObjectProxy] databaseRemoveEventsWithIDs:[eventIds allObjects]];

  // See if there are any events remaining to upload
  if (uploadEvents->size() < events.count) {
    NSRange nextEventsRange =
      NSMakeRange(uploadEvents->size(), events.count - uploadEvents->size());
    NSArray *nextEvents = [events subarrayWithRange:nextEventsRange];
    return [self uploadEvents:nextEvents];
  }

  return YES;
}

- (::pbv1::Event)messageForEvent:(SNTStoredEvent *)event {
  google::protobuf::Arena arena;
  ::pbv1::Event *e = google::protobuf::Arena::Create<::pbv1::Event>(&arena);

  e->set_file_sha256(NSStringToUTF8String(event.fileSHA256));
  e->set_file_path(NSStringToUTF8String([event.filePath stringByDeletingLastPathComponent]));
  e->set_file_name(NSStringToUTF8String([event.filePath lastPathComponent]));
  e->set_executing_user(NSStringToUTF8String(event.executingUser));
  e->set_execution_time([event.occurrenceDate timeIntervalSince1970]);

  for (NSString *user in event.loggedInUsers) {
    e->add_logged_in_users(NSStringToUTF8String(user));
  }
  for (NSString *session in event.currentSessions) {
    e->add_current_sessions(NSStringToUTF8String(session));
  }

  switch (event.decision) {
    case SNTEventStateAllowUnknown: e->set_decision(::pbv1::ALLOW_UNKNOWN); break;
    case SNTEventStateAllowBinary: e->set_decision(::pbv1::ALLOW_BINARY); break;
    case SNTEventStateAllowCertificate:
      e->set_decision(::pbv1::ALLOW_CERTIFICATE);
      break;
      break;
    case SNTEventStateAllowScope: e->set_decision(::pbv1::ALLOW_SCOPE); break;
    case SNTEventStateAllowTeamID: e->set_decision(::pbv1::ALLOW_TEAMID); break;
    case SNTEventStateAllowSigningID: e->set_decision(::pbv1::ALLOW_SIGNINGID); break;
    case SNTEventStateAllowCDHash: e->set_decision(::pbv1::ALLOW_CDHASH); break;
    case SNTEventStateBlockUnknown: e->set_decision(::pbv1::BLOCK_UNKNOWN); break;
    case SNTEventStateBlockBinary: e->set_decision(::pbv1::BLOCK_BINARY); break;
    case SNTEventStateBlockCertificate: e->set_decision(::pbv1::BLOCK_CERTIFICATE); break;
    case SNTEventStateBlockScope: e->set_decision(::pbv1::BLOCK_SCOPE); break;
    case SNTEventStateBlockTeamID: e->set_decision(::pbv1::BLOCK_TEAMID); break;
    case SNTEventStateBlockSigningID: e->set_decision(::pbv1::BLOCK_SIGNINGID); break;
    case SNTEventStateBlockCDHash: e->set_decision(::pbv1::BLOCK_CDHASH); break;
    case SNTEventStateBundleBinary:
      e->set_decision(::pbv1::BUNDLE_BINARY);
      e->clear_execution_time();
      break;
    default: e->set_decision(::pbv1::DECISION_UNKNOWN);
  }

  e->set_file_bundle_id(NSStringToUTF8String(event.fileBundleID));
  e->set_file_bundle_path(NSStringToUTF8String(event.fileBundlePath));
  e->set_file_bundle_executable_rel_path(NSStringToUTF8String(event.fileBundleExecutableRelPath));
  e->set_file_bundle_name(NSStringToUTF8String(event.fileBundleName));
  e->set_file_bundle_version(NSStringToUTF8String(event.fileBundleVersion));
  e->set_file_bundle_version_string(NSStringToUTF8String(event.fileBundleVersionString));
  e->set_file_bundle_hash(NSStringToUTF8String(event.fileBundleHash));
  e->set_file_bundle_hash_millis([event.fileBundleHashMilliseconds longLongValue]);
  e->set_file_bundle_binary_count([event.fileBundleBinaryCount longLongValue]);

  e->set_pid([event.pid unsignedIntValue]);
  e->set_ppid([event.ppid unsignedIntValue]);
  e->set_parent_name(NSStringToUTF8String(event.parentName));

  e->set_quarantine_data_url(NSStringToUTF8String(event.quarantineDataURL));
  e->set_quarantine_referer_url(NSStringToUTF8String(event.quarantineRefererURL));
  e->set_quarantine_timestamp([event.quarantineTimestamp timeIntervalSince1970]);
  e->set_quarantine_agent_bundle_id(NSStringToUTF8String(event.quarantineAgentBundleID));

  e->set_team_id(NSStringToUTF8String(event.teamID));
  e->set_signing_id(NSStringToUTF8String(event.signingID));
  e->set_cdhash(NSStringToUTF8String(event.cdhash));

  for (MOLCertificate *cert in event.signingChain) {
    auto c = e->add_signing_chain();
    c->set_sha256(NSStringToUTF8String(cert.SHA256));
    c->set_cn(NSStringToUTF8String(cert.commonName));
    c->set_org(NSStringToUTF8String(cert.orgName));
    c->set_ou(NSStringToUTF8String(cert.orgUnit));
    c->set_valid_from([cert.validFrom timeIntervalSince1970]);
    c->set_valid_until([cert.validUntil timeIntervalSince1970]);
  }

  return *e;
}

@end

1	/// Copyright 2015 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santasyncservice/SNTSyncEventUpload.h"
16
17	#import <MOLCertificate/MOLCertificate.h>
18	#import <MOLXPCConnection/MOLXPCConnection.h>
19
20	#import "Source/common/SNTCommonEnums.h"
21	#import "Source/common/SNTConfigurator.h"
22	#import "Source/common/SNTFileInfo.h"
23	#import "Source/common/SNTLogging.h"
24	#import "Source/common/SNTStoredEvent.h"
25	#import "Source/common/SNTSyncConstants.h"
26	#import "Source/common/SNTXPCControlInterface.h"
27	#import "Source/common/String.h"
28	#import "Source/santasyncservice/NSData+Zlib.h"
29	#import "Source/santasyncservice/SNTSyncLogging.h"
30	#import "Source/santasyncservice/SNTSyncState.h"
31
32	#include <google/protobuf/arena.h>
33	#include "Source/santasyncservice/syncv1.pb.h"
34	namespace pbv1 = ::santa::sync::v1;
35
36	using santa::common::NSStringToUTF8String;
37
38	@implementation SNTSyncEventUpload
39
40	- (NSURL *)stageURL {	4✔
41	NSString *stageName = [@"eventupload" stringByAppendingFormat:@"/%@", self.syncState.machineID];	4✔
42	return [NSURL URLWithString:stageName relativeToURL:self.syncState.syncBaseURL];	4✔
43	}	4✔
44
45	- (BOOL)sync {	3✔
46	dispatch_semaphore_t sema = dispatch_semaphore_create(0);	3✔
47	[[self.daemonConn remoteObjectProxy] databaseEventsPending:^(NSArray *events) {	3✔
48	if (events.count) {	3!
49	[self uploadEvents:events];	3✔
50	}	3✔
51	dispatch_semaphore_signal(sema);	3✔
52	}];	3✔
53	return (dispatch_semaphore_wait(sema, DISPATCH_TIME_FOREVER) == 0);	3✔
54	}	3✔
55
56	- (BOOL)uploadEvents:(NSArray *)events {	4✔
57	google::protobuf::Arena arena;	4✔
58	auto req = google::protobuf::Arena::Create<::pbv1::EventUploadRequest>(&arena);	4✔
59	auto uploadEvents = req->mutable_events();	4✔
60
61	NSMutableSet *eventIds = [NSMutableSet setWithCapacity:events.count];	4✔
62	for (SNTStoredEvent *event in events) {	5✔
63	uploadEvents->Add([self messageForEvent:event]);	5✔
64	if (event.idx) [eventIds addObject:event.idx];	5!
65	if (uploadEvents->size() >= self.syncState.eventBatchSize) break;	5✔
66	}	5✔
67
68	if (self.syncState.syncType == SNTSyncTypeNormal \|\|	4!
69	[[SNTConfigurator configurator] enableCleanSyncEventUpload]) {	4!
70	::pbv1::EventUploadResponse response;	4✔
71	NSError *err = [self performRequest:[self requestWithMessage:req]	4✔
72	intoMessage:&response	4✔
73	timeout:30];	4✔
74	if (err) {	4!
NEW 75	SLOGE(@"Failed to upload events: %@", err);	×
NEW 76	return NO;	×
NEW 77	}	×
78
79	// A list of bundle hashes that require their related binary events to be uploaded.
80	if (response.event_upload_bundle_binaries_size()) {	4!
NEW 81	self.syncState.bundleBinaryRequests =	×
NEW 82	[NSMutableArray arrayWithCapacity:response.event_upload_bundle_binaries_size()];	×
NEW 83	for (auto bundle_binary : response.event_upload_bundle_binaries()) {	×
NEW 84	[(NSMutableArray *)self.syncState.bundleBinaryRequests	×
NEW 85	addObject:santa::common::StringToNSString(bundle_binary)];	×
NEW 86	}	×
NEW 87	}	×
88	SLOGI(@"Uploaded %d events", uploadEvents->size());	4✔
89	}	4✔
90
91	// Remove event IDs. For Bundle Events the ID is 0 so nothing happens.
92	[[self.daemonConn remoteObjectProxy] databaseRemoveEventsWithIDs:[eventIds allObjects]];	4✔
93
94	// See if there are any events remaining to upload
95	if (uploadEvents->size() < events.count) {	4✔
96	NSRange nextEventsRange =	1✔
97	NSMakeRange(uploadEvents->size(), events.count - uploadEvents->size());	1✔
98	NSArray *nextEvents = [events subarrayWithRange:nextEventsRange];	1✔
99	return [self uploadEvents:nextEvents];	1✔
100	}	1✔
101
102	return YES;	3✔
103	}	4✔
104
105	- (::pbv1::Event)messageForEvent:(SNTStoredEvent *)event {	5✔
106	google::protobuf::Arena arena;	5✔
107	::pbv1::Event *e = google::protobuf::Arena::Create<::pbv1::Event>(&arena);	5✔
108
109	e->set_file_sha256(NSStringToUTF8String(event.fileSHA256));	5✔
110	e->set_file_path(NSStringToUTF8String([event.filePath stringByDeletingLastPathComponent]));	5✔
111	e->set_file_name(NSStringToUTF8String([event.filePath lastPathComponent]));	5✔
112	e->set_executing_user(NSStringToUTF8String(event.executingUser));	5✔
113	e->set_execution_time([event.occurrenceDate timeIntervalSince1970]);	5✔
114
115	for (NSString *user in event.loggedInUsers) {	5✔
116	e->add_logged_in_users(NSStringToUTF8String(user));	5✔
117	}	5✔
118	for (NSString *session in event.currentSessions) {	10✔
119	e->add_current_sessions(NSStringToUTF8String(session));	10✔
120	}	10✔
121
122	switch (event.decision) {	5✔
NEW 123	case SNTEventStateAllowUnknown: e->set_decision(::pbv1::ALLOW_UNKNOWN); break;	×
NEW 124	case SNTEventStateAllowBinary: e->set_decision(::pbv1::ALLOW_BINARY); break;	×
NEW 125	case SNTEventStateAllowCertificate:	×
NEW 126	e->set_decision(::pbv1::ALLOW_CERTIFICATE);	×
NEW 127	break;	×
NEW 128	break;	×
NEW 129	case SNTEventStateAllowScope: e->set_decision(::pbv1::ALLOW_SCOPE); break;	×
NEW 130	case SNTEventStateAllowTeamID: e->set_decision(::pbv1::ALLOW_TEAMID); break;	×
NEW 131	case SNTEventStateAllowSigningID: e->set_decision(::pbv1::ALLOW_SIGNINGID); break;	×
NEW 132	case SNTEventStateAllowCDHash: e->set_decision(::pbv1::ALLOW_CDHASH); break;	×
NEW 133	case SNTEventStateBlockUnknown: e->set_decision(::pbv1::BLOCK_UNKNOWN); break;	×
134	case SNTEventStateBlockBinary: e->set_decision(::pbv1::BLOCK_BINARY); break;	2✔
NEW 135	case SNTEventStateBlockCertificate: e->set_decision(::pbv1::BLOCK_CERTIFICATE); break;	×
NEW 136	case SNTEventStateBlockScope: e->set_decision(::pbv1::BLOCK_SCOPE); break;	×
NEW 137	case SNTEventStateBlockTeamID: e->set_decision(::pbv1::BLOCK_TEAMID); break;	×
NEW 138	case SNTEventStateBlockSigningID: e->set_decision(::pbv1::BLOCK_SIGNINGID); break;	×
NEW 139	case SNTEventStateBlockCDHash: e->set_decision(::pbv1::BLOCK_CDHASH); break;	×
140	case SNTEventStateBundleBinary:	3✔
141	e->set_decision(::pbv1::BUNDLE_BINARY);	3✔
142	e->clear_execution_time();	3✔
143	break;	3✔
NEW 144	default: e->set_decision(::pbv1::DECISION_UNKNOWN);	×
145	}	5✔
146
147	e->set_file_bundle_id(NSStringToUTF8String(event.fileBundleID));	5✔
148	e->set_file_bundle_path(NSStringToUTF8String(event.fileBundlePath));	5✔
149	e->set_file_bundle_executable_rel_path(NSStringToUTF8String(event.fileBundleExecutableRelPath));	5✔
150	e->set_file_bundle_name(NSStringToUTF8String(event.fileBundleName));	5✔
151	e->set_file_bundle_version(NSStringToUTF8String(event.fileBundleVersion));	5✔
152	e->set_file_bundle_version_string(NSStringToUTF8String(event.fileBundleVersionString));	5✔
153	e->set_file_bundle_hash(NSStringToUTF8String(event.fileBundleHash));	5✔
154	e->set_file_bundle_hash_millis([event.fileBundleHashMilliseconds longLongValue]);	5✔
155	e->set_file_bundle_binary_count([event.fileBundleBinaryCount longLongValue]);	5✔
156
157	e->set_pid([event.pid unsignedIntValue]);	5✔
158	e->set_ppid([event.ppid unsignedIntValue]);	5✔
159	e->set_parent_name(NSStringToUTF8String(event.parentName));	5✔
160
161	e->set_quarantine_data_url(NSStringToUTF8String(event.quarantineDataURL));	5✔
162	e->set_quarantine_referer_url(NSStringToUTF8String(event.quarantineRefererURL));	5✔
163	e->set_quarantine_timestamp([event.quarantineTimestamp timeIntervalSince1970]);	5✔
164	e->set_quarantine_agent_bundle_id(NSStringToUTF8String(event.quarantineAgentBundleID));	5✔
165
166	e->set_team_id(NSStringToUTF8String(event.teamID));	5✔
167	e->set_signing_id(NSStringToUTF8String(event.signingID));	5✔
168	e->set_cdhash(NSStringToUTF8String(event.cdhash));	5✔
169
170	for (MOLCertificate *cert in event.signingChain) {	9✔
171	auto c = e->add_signing_chain();	9✔
172	c->set_sha256(NSStringToUTF8String(cert.SHA256));	9✔
173	c->set_cn(NSStringToUTF8String(cert.commonName));	9✔
174	c->set_org(NSStringToUTF8String(cert.orgName));	9✔
175	c->set_ou(NSStringToUTF8String(cert.orgUnit));	9✔
176	c->set_valid_from([cert.validFrom timeIntervalSince1970]);	9✔
177	c->set_valid_until([cert.validUntil timeIntervalSince1970]);	9✔
178	}	9✔
179
180	return *e;	5✔
181	}	5✔
182
183	@end

google / santa / 9272684788

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous