Proto serializer

Source/common/BUILD

@@ -1,5 +1,5 @@
 load("//:helper.bzl", "santa_unit_test")
-load("@rules_proto_grpc//objc:defs.bzl", "objc_proto_library")
+load("@rules_cc//cc:defs.bzl", "cc_proto_library")
 
 package(
     default_visibility = ["//:santa_package_group"],
@@ -16,11 +16,18 @@ proto_library(
     ],
 )
 
-objc_proto_library(
-    name = "santa_objc_proto",
-    copts = ["-fno-objc-arc"],
-    non_arc_srcs = ["Santa.pbobjc.m"],
-    protos = [":santa_proto"],
+cc_proto_library(
+    name = "santa_cc_proto",
+    deps = [":santa_proto"],
+)
+
+# Note: Simple wrapper for a `cc_proto_library` target which cannot be directly
+# depended upon by an `objc_library` target.
+cc_library(
+    name = "santa_cc_proto_library_wrapper",
+    deps = [
+        ":santa_cc_proto",
+    ],
 )
 
 cc_library(

Source/common/SNTCachedDecisionTest.mm

@@ -24,7 +24,7 @@ @implementation SNTCachedDecisionTest
 
 - (void)testSNTCachedDecisionInit {
   // Ensure the vnodeId field is properly set from the es_file_t
-  struct stat sb = MakeStat(1234, 5678);
+  struct stat sb = MakeStat();
   es_file_t file = MakeESFile("foo", sb);
 
   SNTCachedDecision *cd = [[SNTCachedDecision alloc] initWithEndpointSecurityFile:&file];

Source/common/TestUtils.h

@@ -23,7 +23,7 @@
 #include <sys/stat.h>
 
 #define NOBODY_UID ((unsigned int)-2)
-#define NOBODY_GID ((unsigned int)-2)
+#define NOGROUP_GID ((unsigned int)-1)
 
 // Bubble up googletest expectation failures to XCTest failures
 #define XCTBubbleMockVerifyAndClearExpectations(mock)              \
@@ -47,14 +47,25 @@ enum class ActionType {
   Notify,
 };
 
+//
 // Helpers to construct various ES structs
+//
+
 audit_token_t MakeAuditToken(pid_t pid, pid_t pidver);
-struct stat MakeStat(ino_t ino, dev_t devno = 0);
+
+/// Construct a `struct stat` buffer with each member having a unique value.
+/// @param offset An optional offset to be added to each member. useful when
+///   a test has multiple stats and you'd like for them each to have different
+///   values across the members.
+struct stat MakeStat(int offset = 0);
+
 es_string_token_t MakeESStringToken(const char *s);
 es_file_t MakeESFile(const char *path, struct stat sb = {});
 es_process_t MakeESProcess(es_file_t *file, audit_token_t tok = {}, audit_token_t parent_tok = {});
 es_message_t MakeESMessage(es_event_type_t et, es_process_t *proc,
                            ActionType action_type = ActionType::Notify,
                            uint64_t future_deadline_ms = 100000);
 
+uint32_t MaxSupportedESMessageVersionForCurrentOS();
+
 #endif

Source/common/TestUtils.mm

@@ -18,27 +18,42 @@
 #include <dispatch/dispatch.h>
 #include <mach/mach_time.h>
 #include <time.h>
+#include <uuid/uuid.h>
 
 audit_token_t MakeAuditToken(pid_t pid, pid_t pidver) {
   return audit_token_t{
     .val =
       {
         0,
         NOBODY_UID,
-        NOBODY_GID,
+        NOGROUP_GID,
         NOBODY_UID,
-        NOBODY_GID,
+        NOGROUP_GID,
         (unsigned int)pid,
         0,
         (unsigned int)pidver,
       },
   };
 }
 
-struct stat MakeStat(ino_t ino, dev_t devno) {
+struct stat MakeStat(int offset) {
   return (struct stat){
-    .st_dev = devno,
-    .st_ino = ino,
+    .st_dev = 1 + offset,
+    .st_mode = (mode_t)(2 + offset),
+    .st_nlink = (nlink_t)(3 + offset),
+    .st_ino = (uint64_t)(4 + offset),
+    .st_uid = NOBODY_UID,
+    .st_gid = NOGROUP_GID,
+    .st_rdev = 5 + offset,
+    .st_atimespec = {.tv_sec = 100 + offset, .tv_nsec = 200 + offset},
+    .st_mtimespec = {.tv_sec = 101 + offset, .tv_nsec = 21 + offset},
+    .st_ctimespec = {.tv_sec = 102 + offset, .tv_nsec = 202 + offset},
+    .st_birthtimespec = {.tv_sec = 103 + offset, .tv_nsec = 203 + offset},
+    .st_size = 6 + offset,
+    .st_blocks = 7 + offset,
+    .st_blksize = 8 + offset,
+    .st_flags = (uint32_t)(9 + offset),
+    .st_gen = (uint32_t)(10 + offset),
   };
 }
 
@@ -62,6 +77,10 @@ es_process_t MakeESProcess(es_file_t *file, audit_token_t tok, audit_token_t par
     .audit_token = tok,
     .ppid = audit_token_to_pid(parent_tok),
     .original_ppid = audit_token_to_pid(parent_tok),
+    .group_id = 111,
+    .session_id = 222,
+    .is_platform_binary = true,
+    .is_es_client = true,
     .executable = file,
     .parent_audit_token = parent_tok,
   };
@@ -85,15 +104,34 @@ static uint64_t AddMillisToMachTime(uint64_t ms, uint64_t machTime) {
   return nanoTime * timebase.denom / timebase.numer;
 }
 
+uint32_t MaxSupportedESMessageVersionForCurrentOS() {
+  // Note: ES message v3 was only in betas.
+  if (@available(macOS 13.0, *)) {
+    return 6;
+  } else if (@available(macOS 12.3, *)) {
+    return 5;
+  } else if (@available(macOS 11.0, *)) {
+    return 4;
+  } else if (@available(macOS 10.15.4, *)) {
+    return 2;
+  } else {
+    return 1;
+  }
+}
+
 es_message_t MakeESMessage(es_event_type_t et, es_process_t *proc, ActionType action_type,
                            uint64_t future_deadline_ms) {
-  return es_message_t{
+  es_message_t es_msg = {
     .deadline = AddMillisToMachTime(future_deadline_ms, mach_absolute_time()),
     .process = proc,
     .action_type =
       (action_type == ActionType::Notify) ? ES_ACTION_TYPE_NOTIFY : ES_ACTION_TYPE_AUTH,
     .event_type = et,
   };
+
+  es_msg.version = MaxSupportedESMessageVersionForCurrentOS();
+
+  return es_msg;
 }
 
 void SleepMS(long ms) {