9960437494

Committed 16 Jul 2024 04:15PM UTC coverage: 62.997% (-0.2%) from 63.187%

Build # 9960437494

Build Type

Pull #1395

github

Committed by

web-flow

Commit Message

Merge 4d1a1249e into 52ffe5fc5

Pull Request Pull Request #1395: Improve handling of sync response default values

Run Details

5616 of 13462 branches covered (41.72%)

Branch coverage included in aggregate %.

114 of 131 new or added lines in 4 files covered. (87.02%)

17 existing lines in 1 file now uncovered.

18816 of 25321 relevant lines covered (74.31%)

6895.87 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

76.42

/Source/santasyncservice/SNTSyncPreflight.mm

/// Copyright 2015 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/santasyncservice/SNTSyncPreflight.h"
#include "Source/common/SNTCommonEnums.h"

#import <MOLXPCConnection/MOLXPCConnection.h>

#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTLogging.h"
#import "Source/common/SNTSyncConstants.h"
#import "Source/common/SNTSystemInfo.h"
#import "Source/common/SNTXPCControlInterface.h"
#import "Source/common/String.h"
#import "Source/santasyncservice/SNTSyncLogging.h"
#import "Source/santasyncservice/SNTSyncState.h"

#include <google/protobuf/arena.h>
#include "Source/santasyncservice/syncv1.pb.h"
namespace pbv1 = ::santa::sync::v1;

using santa::NSStringToUTF8String;
using santa::StringToNSString;

// Ignoring warning regarding deprecated declarations because of large number of
// reported issues due to checking deprecated proto fields.
#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Wdeprecated-declarations"

/*

Clean Sync Implementation Notes

The clean sync implementation seems a bit complex at first glance, but boils
down to the following rules:

1. If the server says to do a "CLEAN" sync, a "CLEAN" sync is performed, unless the
   client specified a "CLEAN_ALL" sync, in which case "CLEAN_ALL" is performed.
2. If the server responded that it is performing a "CLEAN_ALL" sync, a "CLEAN_ALL" is performed.
3. All other server responses result in a "NORMAL" sync.

The following table expands upon the above logic to list most of the permutations:

| Client Sync State | Clean Sync Request? | Server Response    | Sync Type Performed |
| ----------------- | ------------------- | ------------------ | ------------------- |
| NORMAL            | No                  | NORMAL OR <empty>  | NORMAL              |
| NORMAL            | No                  | CLEAN              | CLEAN               |
| NORMAL            | No                  | CLEAN_ALL          | CLEAN_ALL           |
| NORMAL            | No                  | clean_sync (dep)   | CLEAN               |
| NORMAL            | Yes                 | New AND Dep Key    | Dep key ignored     |
| CLEAN             | Yes                 | NORMAL OR <empty>  | NORMAL              |
| CLEAN             | Yes                 | CLEAN              | CLEAN               |
| CLEAN             | Yes                 | CLEAN_ALL          | CLEAN_ALL           |
| CLEAN             | Yes                 | clean_sync (dep)   | CLEAN               |
| CLEAN             | Yes                 | New AND Dep Key    | Dep key ignored     |
| CLEAN_ALL         | Yes                 | NORMAL OR <empty>  | NORMAL              |
| CLEAN_ALL         | Yes                 | CLEAN              | CLEAN_ALL           |
| CLEAN_ALL         | Yes                 | CLEAN_ALL          | CLEAN_ALL           |
| CLEAN_ALL         | Yes                 | clean_sync (dep)   | CLEAN_ALL           |
| CLEAN_ALL         | Yes                 | New AND Dep Key    | Dep key ignored     |

*/
@implementation SNTSyncPreflight

- (NSURL *)stageURL {
  NSString *stageName = [@"preflight" stringByAppendingFormat:@"/%@", self.syncState.machineID];
  return [NSURL URLWithString:stageName relativeToURL:self.syncState.syncBaseURL];
}

- (BOOL)sync {
  google::protobuf::Arena arena;
  auto req = google::protobuf::Arena::Create<::pbv1::PreflightRequest>(&arena);
  req->set_machine_id(NSStringToUTF8String(self.syncState.machineID));
  req->set_serial_number(NSStringToUTF8String([SNTSystemInfo serialNumber]));
  req->set_hostname(NSStringToUTF8String([SNTSystemInfo longHostname]));
  req->set_os_version(NSStringToUTF8String([SNTSystemInfo osVersion]));
  req->set_os_build(NSStringToUTF8String([SNTSystemInfo osBuild]));
  req->set_model_identifier(NSStringToUTF8String([SNTSystemInfo modelIdentifier]));
  req->set_santa_version(
    NSStringToUTF8String([[NSBundle mainBundle] objectForInfoDictionaryKey:@"CFBundleVersion"]));
  req->set_primary_user(NSStringToUTF8String(self.syncState.machineOwner));

  if (self.syncState.pushNotificationsToken) {
    req->set_push_notification_token(NSStringToUTF8String(self.syncState.pushNotificationsToken));
  }

  id<SNTDaemonControlXPC> rop = [self.daemonConn synchronousRemoteObjectProxy];

  [rop databaseRuleCounts:^(struct RuleCounts counts) {
    req->set_binary_rule_count(uint32(counts.binary));
    req->set_certificate_rule_count(uint32(counts.certificate));
    req->set_compiler_rule_count(uint32(counts.compiler));
    req->set_transitive_rule_count(uint32(counts.transitive));
    req->set_teamid_rule_count(uint32(counts.teamID));
    req->set_signingid_rule_count(uint32(counts.signingID));
    req->set_cdhash_rule_count(uint32(counts.cdhash));
  }];

  [rop clientMode:^(SNTClientMode cm) {
    switch (cm) {
      case SNTClientModeMonitor: req->set_client_mode(::pbv1::MONITOR); break;
      case SNTClientModeLockdown: req->set_client_mode(::pbv1::LOCKDOWN); break;
      default: break;
    }
  }];

  __block SNTSyncType requestSyncType = SNTSyncTypeNormal;
  [rop syncTypeRequired:^(SNTSyncType syncTypeRequired) {
    requestSyncType = syncTypeRequired;
  }];

  // If user requested it or we've never had a successful sync, try from a clean slate.
  if (requestSyncType == SNTSyncTypeClean || requestSyncType == SNTSyncTypeCleanAll) {
    SLOGD(@"%@ sync requested by user",
          (requestSyncType == SNTSyncTypeCleanAll) ? @"Clean All" : @"Clean");
    req->set_request_clean_sync(true);
  }

  ::pbv1::PreflightResponse resp;
  NSError *err = [self performRequest:[self requestWithMessage:req] intoMessage:&resp timeout:30];

  if (err) {
    SLOGE(@"Failed preflight request: %@", err);
    return NO;
  }

  if (resp.has_enable_bundles()) {
    self.syncState.enableBundles = @(resp.enable_bundles());
  } else if (resp.has_deprecated_bundles_enabled()) {
    self.syncState.enableBundles = @(resp.deprecated_bundles_enabled());
  }

  if (resp.has_enable_transitive_rules()) {
    self.syncState.enableTransitiveRules = @(resp.enable_transitive_rules());
  } else if (resp.has_deprecated_enabled_transitive_whitelisting()) {
    self.syncState.enableTransitiveRules = @(resp.deprecated_enabled_transitive_whitelisting());
  } else if (resp.has_deprecated_transitive_whitelisting_enabled()) {
    self.syncState.enableTransitiveRules = @(resp.deprecated_transitive_whitelisting_enabled());
  }

  if (resp.has_enable_all_event_upload()) {
    self.syncState.enableAllEventUpload = @(resp.enable_all_event_upload());
  }

  if (resp.has_disable_unknown_event_upload()) {
    self.syncState.disableUnknownEventUpload = @(resp.disable_unknown_event_upload());
  }

  self.syncState.eventBatchSize = kDefaultEventBatchSize;
  if (resp.batch_size() > 0) {
    self.syncState.eventBatchSize = resp.batch_size();
  }

  // Don't let these go too low
  uint64_t value = resp.push_notification_full_sync_interval_seconds()
                     ?: resp.deprecated_fcm_full_sync_interval_seconds();
  self.syncState.pushNotificationsFullSyncInterval =
    (value < kDefaultFullSyncInterval) ? kDefaultPushNotificationsFullSyncInterval : value;

  value = resp.push_notification_global_rule_sync_deadline_seconds()
            ?: resp.deprecated_fcm_global_rule_sync_deadline_seconds();
  self.syncState.pushNotificationsGlobalRuleSyncDeadline =
    (value < kDefaultPushNotificationsGlobalRuleSyncDeadline)
      ? kDefaultPushNotificationsGlobalRuleSyncDeadline
      : value;

  // Check if our sync interval has changed
  value = resp.full_sync_interval_seconds();
  self.syncState.fullSyncInterval = (value < 60) ? kDefaultFullSyncInterval : value;

  switch (resp.client_mode()) {
    case ::pbv1::MONITOR: self.syncState.clientMode = SNTClientModeMonitor; break;
    case ::pbv1::LOCKDOWN: self.syncState.clientMode = SNTClientModeLockdown; break;
    default: break;
  }

  if (resp.has_allowed_path_regex()) {
    self.syncState.allowlistRegex = StringToNSString(resp.allowed_path_regex());
  } else if (resp.has_deprecated_whitelist_regex()) {
    self.syncState.allowlistRegex = StringToNSString(resp.deprecated_whitelist_regex());
  }

  if (resp.has_blocked_path_regex()) {
    self.syncState.blocklistRegex = StringToNSString(resp.blocked_path_regex());
  } else if (resp.has_deprecated_blacklist_regex()) {
    self.syncState.blocklistRegex = StringToNSString(resp.deprecated_blacklist_regex());
  }

  if (resp.has_block_usb_mount()) {
    self.syncState.blockUSBMount = @(resp.block_usb_mount());

    self.syncState.remountUSBMode = [NSMutableArray array];
    for (const std::string &mode : resp.remount_usb_mode()) {
      [(NSMutableArray *)self.syncState.remountUSBMode addObject:StringToNSString(mode)];
    }
  }

  if (resp.has_override_file_access_action()) {
    switch (resp.override_file_access_action()) {
      case ::pbv1::NONE: self.syncState.overrideFileAccessAction = @"NONE"; break;
      case ::pbv1::AUDIT_ONLY: self.syncState.overrideFileAccessAction = @"AUDIT_ONLY"; break;
      case ::pbv1::DISABLE: self.syncState.overrideFileAccessAction = @"DISABLE"; break;
      case ::pbv1::FILE_ACCESS_ACTION_UNSPECIFIED:  // Intentional fallthrough
      default: self.syncState.overrideFileAccessAction = nil; break;
    }
  }

  // Default sync type is SNTSyncTypeNormal
  //
  // Logic overview:
  // The requested sync type (clean or normal) is merely informative. The server
  // can choose to respond with a NORMAL, CLEAN or CLEAN_ALL.
  //
  // If the server responds that it will perform a clean sync, santa will
  // treat it as either a clean or CLEAN_ALL depending on which was requested.
  //
  // The server can also "override" the requested clean operation. If a normal
  // sync was requested, but the server responded that it was doing a clean or
  // CLEAN_ALL sync, that will take precedence. Similarly, if only a clean sync
  // was requested, the server can force a "CLEAN_ALL" operation to take place.

  // If kSyncType response key exists, it overrides the kCleanSyncDeprecated value
  // First check if the kSyncType reponse key exists. If so, it takes precedence
  // over the kCleanSyncDeprecated key.
  if (resp.has_sync_type()) {
    switch (resp.sync_type()) {
      case ::pbv1::CLEAN:
        // If the client wants to Clean All, this takes precedence. The server
        // cannot override the client wanting to remove all rules.
        SLOGD(@"Clean sync requested by server");
        if (requestSyncType == SNTSyncTypeCleanAll) {
          self.syncState.syncType = SNTSyncTypeCleanAll;
        } else {
          self.syncState.syncType = SNTSyncTypeClean;
        }
        break;
      case ::pbv1::CLEAN_ALL: self.syncState.syncType = SNTSyncTypeCleanAll; break;
      case ::pbv1::SYNC_TYPE_UNSPECIFIED:  // Intentional fallthrough
      case ::pbv1::NORMAL:                 // Intentional fallthrough
      default: self.syncState.syncType = SNTSyncTypeNormal; break;
    }
  } else if (resp.has_deprecated_clean_sync()) {
    // If the deprecated key is set, the type of sync clean performed should be
    // the type that was requested. This must be set appropriately so that it
    // can be propagated during the Rule Download stage so SNTRuleTable knows
    // which rules to delete.
    SLOGD(@"Clean sync requested by server");
    if (requestSyncType == SNTSyncTypeCleanAll) {
      self.syncState.syncType = SNTSyncTypeCleanAll;
    } else {
      self.syncState.syncType = SNTSyncTypeClean;
    }
  } else {
    // Fallback if unspecified is a normal sync
    self.syncState.syncType = SNTSyncTypeNormal;
  }

  return YES;
}

@end

#pragma clang diagnostic pop

1	/// Copyright 2015 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/santasyncservice/SNTSyncPreflight.h"
16	#include "Source/common/SNTCommonEnums.h"
17
18	#import <MOLXPCConnection/MOLXPCConnection.h>
19
20	#import "Source/common/SNTConfigurator.h"
21	#import "Source/common/SNTLogging.h"
22	#import "Source/common/SNTSyncConstants.h"
23	#import "Source/common/SNTSystemInfo.h"
24	#import "Source/common/SNTXPCControlInterface.h"
25	#import "Source/common/String.h"
26	#import "Source/santasyncservice/SNTSyncLogging.h"
27	#import "Source/santasyncservice/SNTSyncState.h"
28
29	#include <google/protobuf/arena.h>
30	#include "Source/santasyncservice/syncv1.pb.h"
31	namespace pbv1 = ::santa::sync::v1;
32
33	using santa::NSStringToUTF8String;
34	using santa::StringToNSString;
35
36	// Ignoring warning regarding deprecated declarations because of large number of
37	// reported issues due to checking deprecated proto fields.
38	#pragma clang diagnostic push
39	#pragma clang diagnostic ignored "-Wdeprecated-declarations"
40
41	/*
42
43	Clean Sync Implementation Notes
44
45	The clean sync implementation seems a bit complex at first glance, but boils
46	down to the following rules:
47
48	1. If the server says to do a "CLEAN" sync, a "CLEAN" sync is performed, unless the
49	client specified a "CLEAN_ALL" sync, in which case "CLEAN_ALL" is performed.
50	2. If the server responded that it is performing a "CLEAN_ALL" sync, a "CLEAN_ALL" is performed.
51	3. All other server responses result in a "NORMAL" sync.
52
53	The following table expands upon the above logic to list most of the permutations:
54
55	\| Client Sync State \| Clean Sync Request? \| Server Response \| Sync Type Performed \|
56	\| ----------------- \| ------------------- \| ------------------ \| ------------------- \|
57	\| NORMAL \| No \| NORMAL OR <empty> \| NORMAL \|
58	\| NORMAL \| No \| CLEAN \| CLEAN \|
59	\| NORMAL \| No \| CLEAN_ALL \| CLEAN_ALL \|
60	\| NORMAL \| No \| clean_sync (dep) \| CLEAN \|
61	\| NORMAL \| Yes \| New AND Dep Key \| Dep key ignored \|
62	\| CLEAN \| Yes \| NORMAL OR <empty> \| NORMAL \|
63	\| CLEAN \| Yes \| CLEAN \| CLEAN \|
64	\| CLEAN \| Yes \| CLEAN_ALL \| CLEAN_ALL \|
65	\| CLEAN \| Yes \| clean_sync (dep) \| CLEAN \|
66	\| CLEAN \| Yes \| New AND Dep Key \| Dep key ignored \|
67	\| CLEAN_ALL \| Yes \| NORMAL OR <empty> \| NORMAL \|
68	\| CLEAN_ALL \| Yes \| CLEAN \| CLEAN_ALL \|
69	\| CLEAN_ALL \| Yes \| CLEAN_ALL \| CLEAN_ALL \|
70	\| CLEAN_ALL \| Yes \| clean_sync (dep) \| CLEAN_ALL \|
71	\| CLEAN_ALL \| Yes \| New AND Dep Key \| Dep key ignored \|
72
73	*/
74	@implementation SNTSyncPreflight
75
76	- (NSURL *)stageURL {	34✔
77	NSString *stageName = [@"preflight" stringByAppendingFormat:@"/%@", self.syncState.machineID];	34✔
78	return [NSURL URLWithString:stageName relativeToURL:self.syncState.syncBaseURL];	34✔
79	}	34✔
80
81	- (BOOL)sync {	34✔
82	google::protobuf::Arena arena;	34✔
83	auto req = google::protobuf::Arena::Create<::pbv1::PreflightRequest>(&arena);	34✔
84	req->set_machine_id(NSStringToUTF8String(self.syncState.machineID));	34✔
85	req->set_serial_number(NSStringToUTF8String([SNTSystemInfo serialNumber]));	34✔
86	req->set_hostname(NSStringToUTF8String([SNTSystemInfo longHostname]));	34✔
87	req->set_os_version(NSStringToUTF8String([SNTSystemInfo osVersion]));	34✔
88	req->set_os_build(NSStringToUTF8String([SNTSystemInfo osBuild]));	34✔
89	req->set_model_identifier(NSStringToUTF8String([SNTSystemInfo modelIdentifier]));	34✔
90	req->set_santa_version(	34✔
91	NSStringToUTF8String([[NSBundle mainBundle] objectForInfoDictionaryKey:@"CFBundleVersion"]));	34✔
92	req->set_primary_user(NSStringToUTF8String(self.syncState.machineOwner));	34✔
93
94	if (self.syncState.pushNotificationsToken) {	34!
95	req->set_push_notification_token(NSStringToUTF8String(self.syncState.pushNotificationsToken));	×
96	}	×
97
98	id<SNTDaemonControlXPC> rop = [self.daemonConn synchronousRemoteObjectProxy];	34✔
99
100	[rop databaseRuleCounts:^(struct RuleCounts counts) {	34✔
101	req->set_binary_rule_count(uint32(counts.binary));	34✔
102	req->set_certificate_rule_count(uint32(counts.certificate));	34✔
103	req->set_compiler_rule_count(uint32(counts.compiler));	34✔
104	req->set_transitive_rule_count(uint32(counts.transitive));	34✔
105	req->set_teamid_rule_count(uint32(counts.teamID));	34✔
106	req->set_signingid_rule_count(uint32(counts.signingID));	34✔
107	req->set_cdhash_rule_count(uint32(counts.cdhash));	34✔
108	}];	34✔
109
110	[rop clientMode:^(SNTClientMode cm) {	34✔
111	switch (cm) {	33✔
112	case SNTClientModeMonitor: req->set_client_mode(::pbv1::MONITOR); break;	33!
113	case SNTClientModeLockdown: req->set_client_mode(::pbv1::LOCKDOWN); break;	×
114	default: break;	×
115	}	33✔
116	}];	33✔
117
118	__block SNTSyncType requestSyncType = SNTSyncTypeNormal;	34✔
119	[rop syncTypeRequired:^(SNTSyncType syncTypeRequired) {	34✔
120	requestSyncType = syncTypeRequired;	33✔
121	}];	33✔
122
123	// If user requested it or we've never had a successful sync, try from a clean slate.
124	if (requestSyncType == SNTSyncTypeClean \|\| requestSyncType == SNTSyncTypeCleanAll) {	34✔
125	SLOGD(@"%@ sync requested by user",	18✔
126	(requestSyncType == SNTSyncTypeCleanAll) ? @"Clean All" : @"Clean");	18✔
127	req->set_request_clean_sync(true);	18✔
128	}	18✔
129
130	::pbv1::PreflightResponse resp;	34✔
131	NSError *err = [self performRequest:[self requestWithMessage:req] intoMessage:&resp timeout:30];	34✔
132
133	if (err) {	34!
134	SLOGE(@"Failed preflight request: %@", err);	×
135	return NO;	×
136	}	×
137
138	if (resp.has_enable_bundles()) {	34!
NEW 139	self.syncState.enableBundles = @(resp.enable_bundles());	×
140	} else if (resp.has_deprecated_bundles_enabled()) {	34!
NEW 141	self.syncState.enableBundles = @(resp.deprecated_bundles_enabled());	×
NEW 142	}	×
143
144	if (resp.has_enable_transitive_rules()) {	34!
NEW 145	self.syncState.enableTransitiveRules = @(resp.enable_transitive_rules());	×
146	} else if (resp.has_deprecated_enabled_transitive_whitelisting()) {	34!
NEW 147	self.syncState.enableTransitiveRules = @(resp.deprecated_enabled_transitive_whitelisting());	×
148	} else if (resp.has_deprecated_transitive_whitelisting_enabled()) {	34!
NEW 149	self.syncState.enableTransitiveRules = @(resp.deprecated_transitive_whitelisting_enabled());	×
NEW 150	}	×
151
152	if (resp.has_enable_all_event_upload()) {	34!
NEW 153	self.syncState.enableAllEventUpload = @(resp.enable_all_event_upload());	×
NEW 154	}	×
155
156	if (resp.has_disable_unknown_event_upload()) {	34!
NEW 157	self.syncState.disableUnknownEventUpload = @(resp.disable_unknown_event_upload());	×
NEW 158	}	×
159
160	self.syncState.eventBatchSize = kDefaultEventBatchSize;	34✔
161	if (resp.batch_size() > 0) {	34✔
162	self.syncState.eventBatchSize = resp.batch_size();	7✔
163	}	7✔
164
165	// Don't let these go too low
166	uint64_t value = resp.push_notification_full_sync_interval_seconds()	34!
167	?: resp.deprecated_fcm_full_sync_interval_seconds();	34✔
168	self.syncState.pushNotificationsFullSyncInterval =	34✔
169	(value < kDefaultFullSyncInterval) ? kDefaultPushNotificationsFullSyncInterval : value;	34✔
170
171	value = resp.push_notification_global_rule_sync_deadline_seconds()	34!
172	?: resp.deprecated_fcm_global_rule_sync_deadline_seconds();	34✔
173	self.syncState.pushNotificationsGlobalRuleSyncDeadline =	34✔
174	(value < kDefaultPushNotificationsGlobalRuleSyncDeadline)	34✔
175	? kDefaultPushNotificationsGlobalRuleSyncDeadline	34✔
176	: value;	34✔
177
178	// Check if our sync interval has changed
179	value = resp.full_sync_interval_seconds();	34✔
180	self.syncState.fullSyncInterval = (value < 60) ? kDefaultFullSyncInterval : value;	34✔
181
182	switch (resp.client_mode()) {	34✔
183	case ::pbv1::MONITOR: self.syncState.clientMode = SNTClientModeMonitor; break;	1✔
184	case ::pbv1::LOCKDOWN: self.syncState.clientMode = SNTClientModeLockdown; break;	6✔
185	default: break;	27✔
186	}	34✔
187
188	if (resp.has_allowed_path_regex()) {	34!
189	self.syncState.allowlistRegex = StringToNSString(resp.allowed_path_regex());	×
190	} else if (resp.has_deprecated_whitelist_regex()) {	34!
191	self.syncState.allowlistRegex = StringToNSString(resp.deprecated_whitelist_regex());	×
192	}	×
193
194	if (resp.has_blocked_path_regex()) {	34!
195	self.syncState.blocklistRegex = StringToNSString(resp.blocked_path_regex());	×
196	} else if (resp.has_deprecated_blacklist_regex()) {	34!
197	self.syncState.blocklistRegex = StringToNSString(resp.deprecated_blacklist_regex());	×
198	}	×
199
200	if (resp.has_block_usb_mount()) {	34✔
201	self.syncState.blockUSBMount = @(resp.block_usb_mount());	2✔
202
203	self.syncState.remountUSBMode = [NSMutableArray array];	2✔
204	for (const std::string &mode : resp.remount_usb_mode()) {	2✔
205	[(NSMutableArray *)self.syncState.remountUSBMode addObject:StringToNSString(mode)];	2✔
206	}	2✔
207	}	2✔
208
209	if (resp.has_override_file_access_action()) {	34✔
210	switch (resp.override_file_access_action()) {	1✔
NEW 211	case ::pbv1::NONE: self.syncState.overrideFileAccessAction = @"NONE"; break;	×
212	case ::pbv1::AUDIT_ONLY: self.syncState.overrideFileAccessAction = @"AUDIT_ONLY"; break;	1!
NEW 213	case ::pbv1::DISABLE: self.syncState.overrideFileAccessAction = @"DISABLE"; break;	×
NEW 214	case ::pbv1::FILE_ACCESS_ACTION_UNSPECIFIED: // Intentional fallthrough	×
NEW 215	default: self.syncState.overrideFileAccessAction = nil; break;	×
216	}	1✔
217	}	1✔
218
219	// Default sync type is SNTSyncTypeNormal
220	//
221	// Logic overview:
222	// The requested sync type (clean or normal) is merely informative. The server
223	// can choose to respond with a NORMAL, CLEAN or CLEAN_ALL.
224	//
225	// If the server responds that it will perform a clean sync, santa will
226	// treat it as either a clean or CLEAN_ALL depending on which was requested.
227	//
228	// The server can also "override" the requested clean operation. If a normal
229	// sync was requested, but the server responded that it was doing a clean or
230	// CLEAN_ALL sync, that will take precedence. Similarly, if only a clean sync
231	// was requested, the server can force a "CLEAN_ALL" operation to take place.
232
233	// If kSyncType response key exists, it overrides the kCleanSyncDeprecated value
234	// First check if the kSyncType reponse key exists. If so, it takes precedence
235	// over the kCleanSyncDeprecated key.
236	if (resp.has_sync_type()) {	34✔
237	switch (resp.sync_type()) {	19✔
238	case ::pbv1::CLEAN:	6✔
239	// If the client wants to Clean All, this takes precedence. The server
240	// cannot override the client wanting to remove all rules.
241	SLOGD(@"Clean sync requested by server");	6✔
242	if (requestSyncType == SNTSyncTypeCleanAll) {	6✔
243	self.syncState.syncType = SNTSyncTypeCleanAll;	2✔
244	} else {	4✔
245	self.syncState.syncType = SNTSyncTypeClean;	4✔
246	}	4✔
247	break;	6✔
248	case ::pbv1::CLEAN_ALL: self.syncState.syncType = SNTSyncTypeCleanAll; break;	6✔
NEW 249	case ::pbv1::SYNC_TYPE_UNSPECIFIED: // Intentional fallthrough	×
250	case ::pbv1::NORMAL: // Intentional fallthrough	7✔
251	default: self.syncState.syncType = SNTSyncTypeNormal; break;	7!
252	}	19✔
253	} else if (resp.has_deprecated_clean_sync()) {	19✔
254	// If the deprecated key is set, the type of sync clean performed should be
255	// the type that was requested. This must be set appropriately so that it
256	// can be propagated during the Rule Download stage so SNTRuleTable knows
257	// which rules to delete.
258	SLOGD(@"Clean sync requested by server");	3✔
259	if (requestSyncType == SNTSyncTypeCleanAll) {	3✔
260	self.syncState.syncType = SNTSyncTypeCleanAll;	1✔
261	} else {	2✔
262	self.syncState.syncType = SNTSyncTypeClean;	2✔
263	}	2✔
264	} else {	12✔
265	// Fallback if unspecified is a normal sync
266	self.syncState.syncType = SNTSyncTypeNormal;	12✔
267	}	12✔
268
269	return YES;	34✔
270	}	34✔
271
272	@end
273
274	#pragma clang diagnostic pop

google / santa / 9960437494

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous