9880446365

Committed 10 Jul 2024 07:43PM UTC coverage: 61.046% (-2.1%) from 63.151%

Build # 9880446365

Build Type

push

github

Committed by

web-flow

Commit Message

Handle non-200 HTTP responses in SNTSyncStage performRequest (#1392)

* Handle non-200 HTTP responses in SNTSyncStage performRequest

If we receive a non-200 HTTP response, we should return an error
instead of parsing the response to an empty protobuf message.

* Fix nil check

---------

Co-authored-by: Matt W <436037+mlw@users.noreply.github.com>

Run Details

5301 of 12874 branches covered (41.18%)

Branch coverage included in aggregate %.

0 of 25 new or added lines in 1 file covered. (0.0%)

584 existing lines in 12 files now uncovered.

17636 of 24699 relevant lines covered (71.4%)

7077.65 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/Source/santasyncservice/SNTSyncEventUpload.mm

/// Copyright 2015 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santasyncservice/SNTSyncEventUpload.h"

#import <MOLCertificate/MOLCertificate.h>
#import <MOLXPCConnection/MOLXPCConnection.h>

#import "Source/common/SNTCommonEnums.h"
#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTFileInfo.h"
#import "Source/common/SNTLogging.h"
#import "Source/common/SNTStoredEvent.h"
#import "Source/common/SNTSyncConstants.h"
#import "Source/common/SNTXPCControlInterface.h"
#import "Source/common/String.h"
#import "Source/santasyncservice/NSData+Zlib.h"
#import "Source/santasyncservice/SNTSyncLogging.h"
#import "Source/santasyncservice/SNTSyncState.h"

#include <google/protobuf/arena.h>
#include "Source/santasyncservice/syncv1.pb.h"
namespace pbv1 = ::santa::sync::v1;

using santa::NSStringToUTF8String;

@implementation SNTSyncEventUpload

- (NSURL *)stageURL {
  NSString *stageName = [@"eventupload" stringByAppendingFormat:@"/%@", self.syncState.machineID];
  return [NSURL URLWithString:stageName relativeToURL:self.syncState.syncBaseURL];
}

- (BOOL)sync {
  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
  [[self.daemonConn remoteObjectProxy] databaseEventsPending:^(NSArray *events) {
    if (events.count) {
      [self uploadEvents:events];
    }
    dispatch_semaphore_signal(sema);
  }];
  return (dispatch_semaphore_wait(sema, DISPATCH_TIME_FOREVER) == 0);
}

- (BOOL)uploadEvents:(NSArray *)events {
  google::protobuf::Arena arena;
  auto req = google::protobuf::Arena::Create<::pbv1::EventUploadRequest>(&arena);
  req->set_machine_id(NSStringToUTF8String(self.syncState.machineID));

  google::protobuf::RepeatedPtrField<::pbv1::Event> *uploadEvents = req->mutable_events();

  NSMutableSet *eventIds = [NSMutableSet setWithCapacity:events.count];
  for (SNTStoredEvent *event in events) {
    uploadEvents->Add([self messageForEvent:event]);
    if (event.idx) [eventIds addObject:event.idx];
    if (uploadEvents->size() >= self.syncState.eventBatchSize) break;
  }

  if (self.syncState.syncType == SNTSyncTypeNormal ||
      [[SNTConfigurator configurator] enableCleanSyncEventUpload]) {
    ::pbv1::EventUploadResponse response;
    NSError *err = [self performRequest:[self requestWithMessage:req]
                            intoMessage:&response
                                timeout:30];
    if (err) {
      SLOGE(@"Failed to upload events: %@", err);
      return NO;
    }

    // A list of bundle hashes that require their related binary events to be uploaded.
    if (response.event_upload_bundle_binaries_size()) {
      self.syncState.bundleBinaryRequests =
        [NSMutableArray arrayWithCapacity:response.event_upload_bundle_binaries_size()];
      for (const std::string &bundle_binary : response.event_upload_bundle_binaries()) {
        [(NSMutableArray *)self.syncState.bundleBinaryRequests
          addObject:santa::StringToNSString(bundle_binary)];
      }
    }
    SLOGI(@"Uploaded %d events", uploadEvents->size());
  }

  // Remove event IDs. For Bundle Events the ID is 0 so nothing happens.
  [[self.daemonConn remoteObjectProxy] databaseRemoveEventsWithIDs:[eventIds allObjects]];

  // See if there are any events remaining to upload
  if (uploadEvents->size() < events.count) {
    NSRange nextEventsRange =
      NSMakeRange(uploadEvents->size(), events.count - uploadEvents->size());
    NSArray *nextEvents = [events subarrayWithRange:nextEventsRange];
    return [self uploadEvents:nextEvents];
  }

  return YES;
}

- (::pbv1::Event)messageForEvent:(SNTStoredEvent *)event {
  google::protobuf::Arena arena;
  auto e = google::protobuf::Arena::Create<::pbv1::Event>(&arena);

  e->set_file_sha256(NSStringToUTF8String(event.fileSHA256));
  e->set_file_path(NSStringToUTF8String([event.filePath stringByDeletingLastPathComponent]));
  e->set_file_name(NSStringToUTF8String([event.filePath lastPathComponent]));
  e->set_executing_user(NSStringToUTF8String(event.executingUser));
  e->set_execution_time([event.occurrenceDate timeIntervalSince1970]);

  for (NSString *user in event.loggedInUsers) {
    e->add_logged_in_users(NSStringToUTF8String(user));
  }
  for (NSString *session in event.currentSessions) {
    e->add_current_sessions(NSStringToUTF8String(session));
  }

  switch (event.decision) {
    case SNTEventStateAllowUnknown: e->set_decision(::pbv1::ALLOW_UNKNOWN); break;
    case SNTEventStateAllowBinary: e->set_decision(::pbv1::ALLOW_BINARY); break;
    case SNTEventStateAllowCertificate: e->set_decision(::pbv1::ALLOW_CERTIFICATE); break;
    case SNTEventStateAllowScope: e->set_decision(::pbv1::ALLOW_SCOPE); break;
    case SNTEventStateAllowTeamID: e->set_decision(::pbv1::ALLOW_TEAMID); break;
    case SNTEventStateAllowSigningID: e->set_decision(::pbv1::ALLOW_SIGNINGID); break;
    case SNTEventStateAllowCDHash: e->set_decision(::pbv1::ALLOW_CDHASH); break;
    case SNTEventStateBlockUnknown: e->set_decision(::pbv1::BLOCK_UNKNOWN); break;
    case SNTEventStateBlockBinary: e->set_decision(::pbv1::BLOCK_BINARY); break;
    case SNTEventStateBlockCertificate: e->set_decision(::pbv1::BLOCK_CERTIFICATE); break;
    case SNTEventStateBlockScope: e->set_decision(::pbv1::BLOCK_SCOPE); break;
    case SNTEventStateBlockTeamID: e->set_decision(::pbv1::BLOCK_TEAMID); break;
    case SNTEventStateBlockSigningID: e->set_decision(::pbv1::BLOCK_SIGNINGID); break;
    case SNTEventStateBlockCDHash: e->set_decision(::pbv1::BLOCK_CDHASH); break;
    case SNTEventStateBundleBinary:
      e->set_decision(::pbv1::BUNDLE_BINARY);
      e->clear_execution_time();
      break;
    default: e->set_decision(::pbv1::DECISION_UNKNOWN);
  }

  e->set_file_bundle_id(NSStringToUTF8String(event.fileBundleID));
  e->set_file_bundle_path(NSStringToUTF8String(event.fileBundlePath));
  e->set_file_bundle_executable_rel_path(NSStringToUTF8String(event.fileBundleExecutableRelPath));
  e->set_file_bundle_name(NSStringToUTF8String(event.fileBundleName));
  e->set_file_bundle_version(NSStringToUTF8String(event.fileBundleVersion));
  e->set_file_bundle_version_string(NSStringToUTF8String(event.fileBundleVersionString));
  e->set_file_bundle_hash(NSStringToUTF8String(event.fileBundleHash));
  e->set_file_bundle_hash_millis([event.fileBundleHashMilliseconds longLongValue]);
  e->set_file_bundle_binary_count([event.fileBundleBinaryCount longLongValue]);

  e->set_pid([event.pid unsignedIntValue]);
  e->set_ppid([event.ppid unsignedIntValue]);
  e->set_parent_name(NSStringToUTF8String(event.parentName));

  e->set_quarantine_data_url(NSStringToUTF8String(event.quarantineDataURL));
  e->set_quarantine_referer_url(NSStringToUTF8String(event.quarantineRefererURL));
  e->set_quarantine_timestamp([event.quarantineTimestamp timeIntervalSince1970]);
  e->set_quarantine_agent_bundle_id(NSStringToUTF8String(event.quarantineAgentBundleID));

  e->set_team_id(NSStringToUTF8String(event.teamID));
  e->set_signing_id(NSStringToUTF8String(event.signingID));
  e->set_cdhash(NSStringToUTF8String(event.cdhash));

  for (MOLCertificate *cert in event.signingChain) {
    ::pbv1::Certificate *c = e->add_signing_chain();
    c->set_sha256(NSStringToUTF8String(cert.SHA256));
    c->set_cn(NSStringToUTF8String(cert.commonName));
    c->set_org(NSStringToUTF8String(cert.orgName));
    c->set_ou(NSStringToUTF8String(cert.orgUnit));
    c->set_valid_from([cert.validFrom timeIntervalSince1970]);
    c->set_valid_until([cert.validUntil timeIntervalSince1970]);
  }

  return *e;
}

@end

1	/// Copyright 2015 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santasyncservice/SNTSyncEventUpload.h"
16
17	#import <MOLCertificate/MOLCertificate.h>
18	#import <MOLXPCConnection/MOLXPCConnection.h>
19
20	#import "Source/common/SNTCommonEnums.h"
21	#import "Source/common/SNTConfigurator.h"
22	#import "Source/common/SNTFileInfo.h"
23	#import "Source/common/SNTLogging.h"
24	#import "Source/common/SNTStoredEvent.h"
25	#import "Source/common/SNTSyncConstants.h"
26	#import "Source/common/SNTXPCControlInterface.h"
27	#import "Source/common/String.h"
28	#import "Source/santasyncservice/NSData+Zlib.h"
29	#import "Source/santasyncservice/SNTSyncLogging.h"
30	#import "Source/santasyncservice/SNTSyncState.h"
31
32	#include <google/protobuf/arena.h>
33	#include "Source/santasyncservice/syncv1.pb.h"
34	namespace pbv1 = ::santa::sync::v1;
35
36	using santa::NSStringToUTF8String;
37
38	@implementation SNTSyncEventUpload
39
UNCOV 40	- (NSURL *)stageURL {	×
UNCOV 41	NSString *stageName = [@"eventupload" stringByAppendingFormat:@"/%@", self.syncState.machineID];	×
UNCOV 42	return [NSURL URLWithString:stageName relativeToURL:self.syncState.syncBaseURL];	×
UNCOV 43	}	×
44
UNCOV 45	- (BOOL)sync {	×
UNCOV 46	dispatch_semaphore_t sema = dispatch_semaphore_create(0);	×
UNCOV 47	[[self.daemonConn remoteObjectProxy] databaseEventsPending:^(NSArray *events) {	×
UNCOV 48	if (events.count) {	×
UNCOV 49	[self uploadEvents:events];	×
UNCOV 50	}	×
UNCOV 51	dispatch_semaphore_signal(sema);	×
UNCOV 52	}];	×
UNCOV 53	return (dispatch_semaphore_wait(sema, DISPATCH_TIME_FOREVER) == 0);	×
UNCOV 54	}	×
55
UNCOV 56	- (BOOL)uploadEvents:(NSArray *)events {	×
UNCOV 57	google::protobuf::Arena arena;	×
UNCOV 58	auto req = google::protobuf::Arena::Create<::pbv1::EventUploadRequest>(&arena);	×
UNCOV 59	req->set_machine_id(NSStringToUTF8String(self.syncState.machineID));	×
60
UNCOV 61	google::protobuf::RepeatedPtrField<::pbv1::Event> *uploadEvents = req->mutable_events();	×
62
UNCOV 63	NSMutableSet *eventIds = [NSMutableSet setWithCapacity:events.count];	×
UNCOV 64	for (SNTStoredEvent *event in events) {	×
UNCOV 65	uploadEvents->Add([self messageForEvent:event]);	×
UNCOV 66	if (event.idx) [eventIds addObject:event.idx];	×
UNCOV 67	if (uploadEvents->size() >= self.syncState.eventBatchSize) break;	×
UNCOV 68	}	×
69
UNCOV 70	if (self.syncState.syncType == SNTSyncTypeNormal \|\|	×
UNCOV 71	[[SNTConfigurator configurator] enableCleanSyncEventUpload]) {	×
UNCOV 72	::pbv1::EventUploadResponse response;	×
UNCOV 73	NSError *err = [self performRequest:[self requestWithMessage:req]	×
UNCOV 74	intoMessage:&response	×
UNCOV 75	timeout:30];	×
UNCOV 76	if (err) {	×
77	SLOGE(@"Failed to upload events: %@", err);	×
78	return NO;	×
79	}	×
80
81	// A list of bundle hashes that require their related binary events to be uploaded.
UNCOV 82	if (response.event_upload_bundle_binaries_size()) {	×
83	self.syncState.bundleBinaryRequests =	×
84	[NSMutableArray arrayWithCapacity:response.event_upload_bundle_binaries_size()];	×
85	for (const std::string &bundle_binary : response.event_upload_bundle_binaries()) {	×
86	[(NSMutableArray *)self.syncState.bundleBinaryRequests	×
87	addObject:santa::StringToNSString(bundle_binary)];	×
88	}	×
89	}	×
UNCOV 90	SLOGI(@"Uploaded %d events", uploadEvents->size());	×
UNCOV 91	}	×
92
93	// Remove event IDs. For Bundle Events the ID is 0 so nothing happens.
UNCOV 94	[[self.daemonConn remoteObjectProxy] databaseRemoveEventsWithIDs:[eventIds allObjects]];	×
95
96	// See if there are any events remaining to upload
UNCOV 97	if (uploadEvents->size() < events.count) {	×
UNCOV 98	NSRange nextEventsRange =	×
UNCOV 99	NSMakeRange(uploadEvents->size(), events.count - uploadEvents->size());	×
UNCOV 100	NSArray *nextEvents = [events subarrayWithRange:nextEventsRange];	×
UNCOV 101	return [self uploadEvents:nextEvents];	×
UNCOV 102	}	×
103
UNCOV 104	return YES;	×
UNCOV 105	}	×
106
UNCOV 107	- (::pbv1::Event)messageForEvent:(SNTStoredEvent *)event {	×
UNCOV 108	google::protobuf::Arena arena;	×
UNCOV 109	auto e = google::protobuf::Arena::Create<::pbv1::Event>(&arena);	×
110
UNCOV 111	e->set_file_sha256(NSStringToUTF8String(event.fileSHA256));	×
UNCOV 112	e->set_file_path(NSStringToUTF8String([event.filePath stringByDeletingLastPathComponent]));	×
UNCOV 113	e->set_file_name(NSStringToUTF8String([event.filePath lastPathComponent]));	×
UNCOV 114	e->set_executing_user(NSStringToUTF8String(event.executingUser));	×
UNCOV 115	e->set_execution_time([event.occurrenceDate timeIntervalSince1970]);	×
116
UNCOV 117	for (NSString *user in event.loggedInUsers) {	×
UNCOV 118	e->add_logged_in_users(NSStringToUTF8String(user));	×
UNCOV 119	}	×
UNCOV 120	for (NSString *session in event.currentSessions) {	×
UNCOV 121	e->add_current_sessions(NSStringToUTF8String(session));	×
UNCOV 122	}	×
123
UNCOV 124	switch (event.decision) {	×
125	case SNTEventStateAllowUnknown: e->set_decision(::pbv1::ALLOW_UNKNOWN); break;	×
126	case SNTEventStateAllowBinary: e->set_decision(::pbv1::ALLOW_BINARY); break;	×
127	case SNTEventStateAllowCertificate: e->set_decision(::pbv1::ALLOW_CERTIFICATE); break;	×
128	case SNTEventStateAllowScope: e->set_decision(::pbv1::ALLOW_SCOPE); break;	×
129	case SNTEventStateAllowTeamID: e->set_decision(::pbv1::ALLOW_TEAMID); break;	×
130	case SNTEventStateAllowSigningID: e->set_decision(::pbv1::ALLOW_SIGNINGID); break;	×
131	case SNTEventStateAllowCDHash: e->set_decision(::pbv1::ALLOW_CDHASH); break;	×
132	case SNTEventStateBlockUnknown: e->set_decision(::pbv1::BLOCK_UNKNOWN); break;	×
UNCOV 133	case SNTEventStateBlockBinary: e->set_decision(::pbv1::BLOCK_BINARY); break;	×
134	case SNTEventStateBlockCertificate: e->set_decision(::pbv1::BLOCK_CERTIFICATE); break;	×
135	case SNTEventStateBlockScope: e->set_decision(::pbv1::BLOCK_SCOPE); break;	×
136	case SNTEventStateBlockTeamID: e->set_decision(::pbv1::BLOCK_TEAMID); break;	×
137	case SNTEventStateBlockSigningID: e->set_decision(::pbv1::BLOCK_SIGNINGID); break;	×
138	case SNTEventStateBlockCDHash: e->set_decision(::pbv1::BLOCK_CDHASH); break;	×
UNCOV 139	case SNTEventStateBundleBinary:	×
UNCOV 140	e->set_decision(::pbv1::BUNDLE_BINARY);	×
UNCOV 141	e->clear_execution_time();	×
UNCOV 142	break;	×
143	default: e->set_decision(::pbv1::DECISION_UNKNOWN);	×
UNCOV 144	}	×
145
UNCOV 146	e->set_file_bundle_id(NSStringToUTF8String(event.fileBundleID));	×
UNCOV 147	e->set_file_bundle_path(NSStringToUTF8String(event.fileBundlePath));	×
UNCOV 148	e->set_file_bundle_executable_rel_path(NSStringToUTF8String(event.fileBundleExecutableRelPath));	×
UNCOV 149	e->set_file_bundle_name(NSStringToUTF8String(event.fileBundleName));	×
UNCOV 150	e->set_file_bundle_version(NSStringToUTF8String(event.fileBundleVersion));	×
UNCOV 151	e->set_file_bundle_version_string(NSStringToUTF8String(event.fileBundleVersionString));	×
UNCOV 152	e->set_file_bundle_hash(NSStringToUTF8String(event.fileBundleHash));	×
UNCOV 153	e->set_file_bundle_hash_millis([event.fileBundleHashMilliseconds longLongValue]);	×
UNCOV 154	e->set_file_bundle_binary_count([event.fileBundleBinaryCount longLongValue]);	×
155
UNCOV 156	e->set_pid([event.pid unsignedIntValue]);	×
UNCOV 157	e->set_ppid([event.ppid unsignedIntValue]);	×
UNCOV 158	e->set_parent_name(NSStringToUTF8String(event.parentName));	×
159
UNCOV 160	e->set_quarantine_data_url(NSStringToUTF8String(event.quarantineDataURL));	×
UNCOV 161	e->set_quarantine_referer_url(NSStringToUTF8String(event.quarantineRefererURL));	×
UNCOV 162	e->set_quarantine_timestamp([event.quarantineTimestamp timeIntervalSince1970]);	×
UNCOV 163	e->set_quarantine_agent_bundle_id(NSStringToUTF8String(event.quarantineAgentBundleID));	×
164
UNCOV 165	e->set_team_id(NSStringToUTF8String(event.teamID));	×
UNCOV 166	e->set_signing_id(NSStringToUTF8String(event.signingID));	×
UNCOV 167	e->set_cdhash(NSStringToUTF8String(event.cdhash));	×
168
UNCOV 169	for (MOLCertificate *cert in event.signingChain) {	×
UNCOV 170	::pbv1::Certificate *c = e->add_signing_chain();	×
UNCOV 171	c->set_sha256(NSStringToUTF8String(cert.SHA256));	×
UNCOV 172	c->set_cn(NSStringToUTF8String(cert.commonName));	×
UNCOV 173	c->set_org(NSStringToUTF8String(cert.orgName));	×
UNCOV 174	c->set_ou(NSStringToUTF8String(cert.orgUnit));	×
UNCOV 175	c->set_valid_from([cert.validFrom timeIntervalSince1970]);	×
UNCOV 176	c->set_valid_until([cert.validUntil timeIntervalSince1970]);	×
UNCOV 177	}	×
178
UNCOV 179	return *e;	×
UNCOV 180	}	×
181
182	@end

google / santa / 9880446365

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous