sync: Send a hash of all database rules at beginning and end of sync

Source/common/SNTXPCControlInterface.h

@@ -35,6 +35,7 @@
 - (void)databaseRemoveEventsWithIDs:(NSArray *)ids;
 - (void)databaseRuleForIdentifiers:(SNTRuleIdentifiers *)identifiers
                              reply:(void (^)(SNTRule *))reply;
+- (void)databaseRulesHash:(void (^)(NSString *hash))reply;
 - (void)retrieveAllRules:(void (^)(NSArray<SNTRule *> *rules, NSError *error))reply;
 
 ///

Source/santad/BUILD

@@ -19,10 +19,11 @@ objc_library(
 
 objc_library(
     name = "SNTRuleTable",
-    srcs = ["DataLayer/SNTRuleTable.m"],
+    srcs = ["DataLayer/SNTRuleTable.mm"],
     hdrs = ["DataLayer/SNTRuleTable.h"],
     sdk_dylibs = [
         "EndpointSecurity",
+        "libz",
     ],
     deps = [
         ":SNTDatabaseTable",
@@ -911,11 +912,12 @@ santa_unit_test(
         "DataLayer/SNTDatabaseTable.h",
         "DataLayer/SNTDatabaseTable.m",
         "DataLayer/SNTRuleTable.h",
-        "DataLayer/SNTRuleTable.m",
+        "DataLayer/SNTRuleTable.mm",
         "DataLayer/SNTRuleTableTest.m",
     ],
     sdk_dylibs = [
         "EndpointSecurity",
+        "libz",
     ],
     deps = [
         "//Source/common:Platform",

Source/santad/DataLayer/SNTRuleTable.h

@@ -110,6 +110,11 @@
 ///
 - (NSArray<SNTRule *> *)retrieveAllRules;
 
+///
+///  Retrieve a hash of the hashes of all rules.
+///
+- (NSString *)hashOfHashes;
+
 ///
 ///  A map of a file hashes to cached decisions. This is used to pre-validate and whitelist
 ///  certain critical system binaries that are integral to Santa's functionality.

Source/santad/DataLayer/SNTRuleTable.m → Source/santad/DataLayer/SNTRuleTable.mm

@@ -17,6 +17,7 @@
 #import <EndpointSecurity/EndpointSecurity.h>
 #import <MOLCertificate/MOLCertificate.h>
 #import <MOLCodesignChecker/MOLCodesignChecker.h>
+#include <zlib.h>
 
 #import "Source/common/Platform.h"
 #import "Source/common/SNTCachedDecision.h"
@@ -309,11 +310,12 @@ - (int64_t)cdhashRuleCount {
 }
 
 - (SNTRule *)ruleFromResultSet:(FMResultSet *)rs {
-  SNTRule *r = [[SNTRule alloc] initWithIdentifier:[rs stringForColumn:@"identifier"]
-                                             state:[rs intForColumn:@"state"]
-                                              type:[rs intForColumn:@"type"]
-                                         customMsg:[rs stringForColumn:@"custommsg"]
-                                         timestamp:[rs intForColumn:@"timestamp"]];
+  SNTRule *r =
+    [[SNTRule alloc] initWithIdentifier:[rs stringForColumn:@"identifier"]
+                                  state:static_cast<SNTRuleState>([rs intForColumn:@"state"])
+                                   type:static_cast<SNTRuleType>([rs intForColumn:@"type"])
+                              customMsg:[rs stringForColumn:@"custommsg"]
+                              timestamp:[rs intForColumn:@"timestamp"]];
   r.customURL = [rs stringForColumn:@"customurl"];
   return r;
 }
@@ -589,4 +591,22 @@ - (BOOL)fillError:(NSError **)error code:(SNTRuleTableError)code message:(NSStri
   return rules;
 }
 
+- (NSString *)hashOfHashes {
+  __block uint64_t crc = 0LL;
+  [self inDatabase:^(FMDatabase *db) {
+    FMResultSet *rs =
+      [db executeQuery:@"SELECT identifier, state, type, timestamp FROM rules WHERE type!=?",
+                       @(SNTRuleStateAllowTransitive)];
+    while ([rs next]) {
+      char digest[128];
+      uint32_t len = snprintf(
+        digest, 128, "%s:%d:%d:%u", [rs stringForColumn:@"identifier"].UTF8String,
+        [rs intForColumn:@"state"], [rs intForColumn:@"type"], [rs intForColumn:@"timestamp"]);
+      crc = crc32(crc, reinterpret_cast<const unsigned char *>(digest), len);
+    }
+    [rs close];
+  }];
+  return [NSString stringWithFormat:@"%llx", crc];
+}
+
 @end

Source/santad/DataLayer/SNTRuleTableTest.m

@@ -17,6 +17,7 @@
 #import <OCMock/OCMock.h>
 #import <XCTest/XCTest.h>
 
+#include "Source/common/SNTCommonEnums.h"
 #import "Source/common/SNTConfigurator.h"
 #import "Source/common/SNTRule.h"
 #import "Source/common/SNTRuleIdentifiers.h"
@@ -513,4 +514,27 @@ - (void)testAddedRulesShouldFlushDecisionCacheWithRemoveRule {
   XCTAssertEqual(YES, [self.sut addedRulesShouldFlushDecisionCache:@[ r ]]);
 }
 
+- (void)testHashOfHashes {
+  NSArray<SNTRule *> *rules = @[
+    [self _exampleCertRule],
+    [self _exampleBinaryRule],
+    [self _exampleTeamIDRule],
+    [self _exampleSigningIDRuleIsPlatform:NO],
+  ];
+  [self.sut addRules:rules ruleCleanup:SNTRuleCleanupAll error:nil];
+
+  NSString *hash = [self.sut hashOfHashes];
+  XCTAssertEqual(hash.length, 8);
+  XCTAssertEqualObjects(hash, @"d03a2a03");
+
+  SNTRule *removeRule = self._exampleBinaryRule;
+  removeRule.state = SNTRuleStateRemove;
+
+  [self.sut addRules:@[ removeRule ] ruleCleanup:SNTRuleCleanupNone error:nil];
+
+  hash = [self.sut hashOfHashes];
+  XCTAssertEqual(hash.length, 8);
+  XCTAssertEqualObjects(hash, @"99e67481");
+}
+
 @end

Source/santad/SNTDaemonControlController.mm

@@ -175,6 +175,10 @@ - (void)retrieveAllRules:(void (^)(NSArray<SNTRule *> *, NSError *))reply {
   reply(rules, nil);
 }
 
+- (void)databaseRulesHash:(void (^)(NSString *hash))reply {
+  reply([[SNTDatabaseController ruleTable] hashOfHashes]);
+}
+
 #pragma mark Decision Ops
 
 - (void)decisionForFilePath:(NSString *)filePath

Source/santasyncservice/SNTSyncPostflight.mm

@@ -16,6 +16,7 @@
 
 #import <MOLXPCConnection/MOLXPCConnection.h>
 
+#import "Source/common/SNTLogging.h"
 #import "Source/common/SNTSyncConstants.h"
 #import "Source/common/SNTXPCControlInterface.h"
 #import "Source/common/String.h"
@@ -41,11 +42,14 @@ - (BOOL)sync {
   req->set_rules_received(static_cast<uint32_t>(self.syncState.rulesReceived));
   req->set_rules_processed(static_cast<uint32_t>(self.syncState.rulesProcessed));
 
+  id<SNTDaemonControlXPC> rop = [self.daemonConn synchronousRemoteObjectProxy];
+  [rop databaseRulesHash:^(NSString *hash) {
+    req->set_rules_hash(NSStringToUTF8String(hash));
+  }];
+
   ::pbv1::PostflightResponse response;
   [self performRequest:[self requestWithMessage:req] intoMessage:&response timeout:30];
 
-  id<SNTDaemonControlXPC> rop = [self.daemonConn synchronousRemoteObjectProxy];
-
   // Set client mode if it changed
   if (self.syncState.clientMode) {
     [rop setClientMode:self.syncState.clientMode

Source/santasyncservice/SNTSyncPreflight.mm

@@ -106,6 +106,10 @@ - (BOOL)sync {
     req->set_cdhash_rule_count(uint32(counts.cdhash));
   }];
 
+  [rop databaseRulesHash:^(NSString *hash) {
+    req->set_rules_hash(NSStringToUTF8String(hash));
+  }];
+
   [rop clientMode:^(SNTClientMode cm) {
     switch (cm) {
       case SNTClientModeMonitor: req->set_client_mode(::pbv1::MONITOR); break;

Source/santasyncservice/SNTSyncTest.mm

@@ -161,6 +161,7 @@ - (void)setupDefaultDaemonConnResponses {
     databaseRuleCounts:([OCMArg invokeBlockWithArgs:OCMOCK_VALUE(ruleCounts), nil])]);
   OCMStub([self.daemonConnRop
     syncTypeRequired:([OCMArg invokeBlockWithArgs:OCMOCK_VALUE(SNTSyncTypeNormal), nil])]);
+  OCMStub([self.daemonConnRop databaseRulesHash:([OCMArg invokeBlockWithArgs:@"the-hash", nil])]);
   OCMStub([self.daemonConnRop
     clientMode:([OCMArg invokeBlockWithArgs:OCMOCK_VALUE(SNTClientModeMonitor), nil])]);
 }

Source/santasyncservice/syncv1.proto

@@ -54,8 +54,12 @@ message PreflightRequest {
   uint32 teamid_rule_count = 15      [json_name="teamid_rule_count"];
   uint32 signingid_rule_count = 16   [json_name="signingid_rule_count"];
   uint32 cdhash_rule_count = 17      [json_name="cdhash_rule_count"];
+
   // The UUID of the machine that is sending this preflight.
   string machine_id = 18             [json_name="machine_id"];
+
+  // A hash of the hashes of all current rules.
+  string rules_hash = 19             [json_name="rules_hash"];
 }
 
 enum SyncType {
@@ -309,6 +313,9 @@ message PostflightRequest {
   uint32 rules_processed = 2  [json_name="rules_processed"];
   // The UUID of the machine that is sending this postflight.
   string machine_id = 3       [json_name="machine_id"];
+
+  // A hash of the hashes of all current rules.
+  string rules_hash = 4       [json_name="rules_hash"];
 }
 
 message PostflightResponse { }

Source/santasyncservice/testdata/sync_preflight_request.json

@@ -1 +1 @@
-{"serial_num":"QYGF4QM373","hostname":"full-hostname.example.com","os_version":"14.5","os_build":"23F79","model_identifier":"MacBookPro18,3","santa_version":"2024.6.655965194","primary_user":"username1","client_mode":"MONITOR","machine_id":"50C7E1EB-2EF5-42D4-A084-A7966FC45A95"}
+{"serial_num":"QYGF4QM373","hostname":"full-hostname.example.com","os_version":"14.5","os_build":"23F79","model_identifier":"MacBookPro18,3","santa_version":"2024.6.655965194","primary_user":"username1","client_mode":"MONITOR","machine_id":"50C7E1EB-2EF5-42D4-A084-A7966FC45A95","rules_hash":"the-hash"}