santad: Improve SNTFileWatcher, update config file permissions if they change

The block expects int64_t, not NSNumber. For some reason this didn't fail in Xcode but does from the command-line. Using OCMOCK_VALUE works properly.

.travis.yml

@@ -7,6 +7,7 @@ osx_image: xcode7
 before_install:
  - gem install activesupport
  - gem install cocoapods xcpretty
+ - pod setup >/dev/null
 
 script:
  - xcodebuild -workspace Santa.xcworkspace -scheme All -derivedDataPath build build test CODE_SIGN_IDENTITY='' | xcpretty -sc && exit ${PIPESTATUS[0]}

Podfile

@@ -2,22 +2,15 @@ platform :osx, "10.9"
 
 inhibit_all_warnings!
 
-target :Santa do
+def mol_pods
   pod 'MOLCertificate'
   pod 'MOLCodesignChecker'
 end
 
-target :santactl do
-  pod 'MOLCertificate'
-  pod 'MOLCodesignChecker'
-  pod 'FMDB'
-end
-
-target :santad do
-  pod 'MOLCertificate'
-  pod 'MOLCodesignChecker'
+def fmdb_pod
   pod 'FMDB'
 
+  # This is necessary to get FMDB to not NSLog stuff.
   post_install do |installer|
     installer.pods_project.targets.each do |target|
       target.build_configurations.each do |config|
@@ -32,9 +25,24 @@ target :santad do
   end
 end
 
+target :Santa do
+  mol_pods
+end
+
+target :santad do
+  mol_pods
+  fmdb_pod
+end
+
+target :santactl do
+  mol_pods
+  fmdb_pod
+  pod 'MOLAuthenticatingURLSession'
+end
+
 target :LogicTests do
-  pod 'FMDB'
-  pod 'MOLCertificate'
-  pod 'MOLCodesignChecker'
+  mol_pods
+  fmdb_pod
+  pod 'MOLAuthenticatingURLSession'
   pod 'OCMock'
 end

Podfile.lock

@@ -1,22 +1,28 @@
 PODS:
-  - FMDB (2.6):
-    - FMDB/standard (= 2.6)
-  - FMDB/standard (2.6)
-  - MOLCertificate (1.3)
-  - MOLCodesignChecker (1.4):
+  - FMDB (2.6.2):
+    - FMDB/standard (= 2.6.2)
+  - FMDB/standard (2.6.2)
+  - MOLAuthenticatingURLSession (1.6):
     - MOLCertificate (~> 1.3)
-  - OCMock (3.2.2)
+  - MOLCertificate (1.4)
+  - MOLCodesignChecker (1.5):
+    - MOLCertificate (~> 1.3)
+  - OCMock (3.3)
 
 DEPENDENCIES:
   - FMDB
+  - MOLAuthenticatingURLSession
   - MOLCertificate
   - MOLCodesignChecker
   - OCMock
 
 SPEC CHECKSUMS:
-  FMDB: c1968bab3ab0aed38f66cb778ae1e7fa9a652b6e
-  MOLCertificate: a776221906b5a46dd1bd749d0682bef3ee68c1f5
-  MOLCodesignChecker: 34e60cc6beadabfb4762b6e5087e12837774f85f
-  OCMock: 18c9b7e67d4c2770e95bb77a9cc1ae0c91fe3835
+  FMDB: 854a0341b4726e53276f2a8996f06f1b80f9259a
+  MOLAuthenticatingURLSession: f956240458fb24b61e5607d735948dc9babfb4e3
+  MOLCertificate: da0bfeb5fa968bb4ac284569fa3f7d5f8f7abe23
+  MOLCodesignChecker: fc9c64147811d7b0d0739127003e0630dff9213a
+  OCMock: d68685bde31f69cb61d518dcb39269080c78b5ed
 
-COCOAPODS: 0.39.0
+PODFILE CHECKSUM: 3a8673334ffd78cdbd6576c85e6635248eb1b504
+
+COCOAPODS: 1.0.0

Santa.xcodeproj/project.pbxproj

@@ -26,7 +26,6 @@
 /* End PBXAggregateTarget section */
 
 /* Begin PBXBuildFile section */
-		02D7203A6CEE2A946FB08ECE /* libPods-santactl.a in Frameworks */ = {isa = PBXBuildFile; fileRef = A2EA300312100AE62218F84E /* libPods-santactl.a */; };
 		0D0016A3192BCD3C005E7FCD /* Foundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 0D9A7F3E1759330500035EB5 /* Foundation.framework */; };
 		0D0016A6192BCD3C005E7FCD /* main.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D0016A5192BCD3C005E7FCD /* main.m */; };
 		0D0016AE192BCD8C005E7FCD /* IOKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 0D3AFBF718FB4C870087BCEE /* IOKit.framework */; };
@@ -35,10 +34,13 @@
 		0D10BE861A0AABD600C0C944 /* SNTDropRootPrivs.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D10BE851A0AABD600C0C944 /* SNTDropRootPrivs.m */; };
 		0D10BE871A0AABD600C0C944 /* SNTDropRootPrivs.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D10BE851A0AABD600C0C944 /* SNTDropRootPrivs.m */; };
 		0D10BE891A0AAF6700C0C944 /* SNTDropRootPrivs.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D10BE851A0AABD600C0C944 /* SNTDropRootPrivs.m */; };
-		0D10BE8B1A0AB23300C0C944 /* SNTDERDecoderTest.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D10BE8A1A0AB23300C0C944 /* SNTDERDecoderTest.m */; };
-		0D10BE8C1A0AB3FD00C0C944 /* SNTDERDecoder.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D7FFD4A1A017D4B00F34435 /* SNTDERDecoder.m */; };
 		0D1B477019A53419008CADD3 /* SNTAboutWindowController.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D1B476E19A53419008CADD3 /* SNTAboutWindowController.m */; };
 		0D1B477119A53419008CADD3 /* AboutWindow.xib in Resources */ = {isa = PBXBuildFile; fileRef = 0D1B476F19A53419008CADD3 /* AboutWindow.xib */; };
+		0D202D191CDD2EE500A88F16 /* SNTCommandSyncTest.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D202D181CDD2EE500A88F16 /* SNTCommandSyncTest.m */; };
+		0D202D1A1CDD464B00A88F16 /* SNTCommandSyncPreflight.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DCD605B19117A90006B445C /* SNTCommandSyncPreflight.m */; };
+		0D202D1B1CDD465400A88F16 /* SNTCommandSyncState.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D416400191974F1006A356A /* SNTCommandSyncState.m */; };
+		0D202D1E1CDD479400A88F16 /* libz.tbd in Frameworks */ = {isa = PBXBuildFile; fileRef = 0D202D1D1CDD479400A88F16 /* libz.tbd */; };
+		0D202D201CE4E90E00A88F16 /* sync_preflight_basic.json in Resources */ = {isa = PBXBuildFile; fileRef = 0D202D1F1CE4E90E00A88F16 /* sync_preflight_basic.json */; };
 		0D20710E1A7C4A86008B0A9A /* SNTStoredEvent.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DCD604A19105433006B445C /* SNTStoredEvent.m */; };
 		0D28D53819D9F5910015C5EB /* SNTConfigurator.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D42D2B719D2042900955F08 /* SNTConfigurator.m */; };
 		0D2CD4611A81C7B100C9C910 /* dn.plist in Resources */ = {isa = PBXBuildFile; fileRef = 0D2CD4601A81C7B100C9C910 /* dn.plist */; };
@@ -87,7 +89,6 @@
 		0D7A7AF3174FCF4C00B77646 /* SantaCachedDecision.cc in Sources */ = {isa = PBXBuildFile; fileRef = 0D7A7AF1174FCF4C00B77646 /* SantaCachedDecision.cc */; };
 		0D7A7AF4174FCF4C00B77646 /* SantaCachedDecision.h in Headers */ = {isa = PBXBuildFile; fileRef = 0D7A7AF2174FCF4C00B77646 /* SantaCachedDecision.h */; };
 		0D7D01871774F93A005DBAB4 /* SNTDriverManager.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D7D01861774F93A005DBAB4 /* SNTDriverManager.m */; };
-		0D7FFD4B1A017D4B00F34435 /* SNTDERDecoder.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D7FFD4A1A017D4B00F34435 /* SNTDERDecoder.m */; };
 		0D827E6519DF392E006EC811 /* SNTConfigurator.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D42D2B719D2042900955F08 /* SNTConfigurator.m */; };
 		0D827E6719DF3C74006EC811 /* SNTCommandStatus.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D827E6619DF3C74006EC811 /* SNTCommandStatus.m */; };
 		0D8868091AC48A1100B86659 /* SNTSystemInfo.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D42D2B419D1D98A00955F08 /* SNTSystemInfo.m */; };
@@ -98,6 +99,8 @@
 		0D89310F1C931986002E8D74 /* SNTRule.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DE50F671912716A007B2B0C /* SNTRule.m */; };
 		0D8C200C180F359A00CE2BF8 /* Security.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 0D8C200B180F359A00CE2BF8 /* Security.framework */; };
 		0D8E18CD19107B56000F89B8 /* SNTDaemonControlController.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D8E18CC19107B56000F89B8 /* SNTDaemonControlController.m */; };
+		0D9184B81CD2F32D0004E859 /* SNTCommandSyncStage.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D9184B71CD2F32D0004E859 /* SNTCommandSyncStage.m */; };
+		0D9184B91CD2F32D0004E859 /* SNTCommandSyncStage.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D9184B71CD2F32D0004E859 /* SNTCommandSyncStage.m */; };
 		0D9A7F331759144800035EB5 /* SantaDriver.cc in Sources */ = {isa = PBXBuildFile; fileRef = 0D9A7F311759144800035EB5 /* SantaDriver.cc */; };
 		0D9A7F341759144800035EB5 /* SantaDriver.h in Headers */ = {isa = PBXBuildFile; fileRef = 0D9A7F321759144800035EB5 /* SantaDriver.h */; };
 		0D9A7F371759148E00035EB5 /* SantaDriverClient.cc in Sources */ = {isa = PBXBuildFile; fileRef = 0D9A7F351759148E00035EB5 /* SantaDriverClient.cc */; };
@@ -109,6 +112,11 @@
 		0DA73CA21934F88D0056D7C4 /* SNTLogging.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DA73C9E1934F8100056D7C4 /* SNTLogging.m */; };
 		0DB390991AB1E11400614002 /* SNTCommandVersion.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DB390981AB1E11400614002 /* SNTCommandVersion.m */; };
 		0DB537871AFD36EB00487F92 /* SNTRuleTableTest.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DB537861AFD36EB00487F92 /* SNTRuleTableTest.m */; };
+		0DB77FD81CCE824A004DF060 /* SNTBlockMessage.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DB77FD71CCE824A004DF060 /* SNTBlockMessage.m */; };
+		0DB77FD91CCE824A004DF060 /* SNTBlockMessage.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DB77FD71CCE824A004DF060 /* SNTBlockMessage.m */; };
+		0DB77FDA1CD14092004DF060 /* SNTBlockMessage.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DB77FD71CCE824A004DF060 /* SNTBlockMessage.m */; };
+		0DB77FDB1CD14093004DF060 /* SNTBlockMessage.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DB77FD71CCE824A004DF060 /* SNTBlockMessage.m */; };
+		0DB77FFB1CD7AC5A004DF060 /* SNTCommandSyncConstants.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DEFB7BF1ACB28B000B92AAE /* SNTCommandSyncConstants.m */; };
 		0DB8ACC1185662DC00FEF9C7 /* SNTApplication.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DB8ACC0185662DC00FEF9C7 /* SNTApplication.m */; };
 		0DB98BFA1C1B9F3000B65DB1 /* SantaPIDAndPPID.cc in Sources */ = {isa = PBXBuildFile; fileRef = 0DB98BF81C1B9F3000B65DB1 /* SantaPIDAndPPID.cc */; };
 		0DB98BFB1C1B9F3000B65DB1 /* SantaPIDAndPPID.h in Headers */ = {isa = PBXBuildFile; fileRef = 0DB98BF91C1B9F3000B65DB1 /* SantaPIDAndPPID.h */; };
@@ -132,7 +140,6 @@
 		0DCD605819115E57006B445C /* SNTXPCControlInterface.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DCD605419115D17006B445C /* SNTXPCControlInterface.m */; };
 		0DCD605919115E5A006B445C /* SNTXPCNotifierInterface.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DCD604E19115A06006B445C /* SNTXPCNotifierInterface.m */; };
 		0DCD605C19117A90006B445C /* SNTCommandSyncPreflight.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DCD605B19117A90006B445C /* SNTCommandSyncPreflight.m */; };
-		0DCD6062191188B1006B445C /* SNTAuthenticatingURLSession.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DCD6061191188B1006B445C /* SNTAuthenticatingURLSession.m */; };
 		0DD0D487194F5187005F27EB /* IOKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 0D3AFBF718FB4C870087BCEE /* IOKit.framework */; };
 		0DD0D48F194F78F8005F27EB /* SNTFileInfoTest.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DD0D48E194F78F8005F27EB /* SNTFileInfoTest.m */; };
 		0DD0D491194F9947005F27EB /* SNTExecutionControllerTest.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DD0D490194F9947005F27EB /* SNTExecutionControllerTest.m */; };
@@ -149,6 +156,13 @@
 		0DE6788D1784A8C2007A9E52 /* SNTExecutionController.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DE6788C1784A8C2007A9E52 /* SNTExecutionController.m */; };
 		0DE71A751B95F7F900518526 /* SNTCachedDecision.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DE71A741B95F7F900518526 /* SNTCachedDecision.m */; };
 		0DE71A761B95F7F900518526 /* SNTCachedDecision.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DE71A741B95F7F900518526 /* SNTCachedDecision.m */; };
+		0DEA5F651CF6057D00704398 /* SNTCommandSyncEventUpload.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D41640419197AD7006A356A /* SNTCommandSyncEventUpload.m */; };
+		0DEA5F6C1CF6254900704398 /* sync_preflight_lockdown.json in Resources */ = {isa = PBXBuildFile; fileRef = 0DEA5F641CF6000600704398 /* sync_preflight_lockdown.json */; };
+		0DEA5F741CF63B9600704398 /* sync_eventupload_input_quarantine.plist in Resources */ = {isa = PBXBuildFile; fileRef = 0DEA5F731CF639BE00704398 /* sync_eventupload_input_quarantine.plist */; };
+		0DEA5F761CF6482E00704398 /* sync_eventupload_input_basic.plist in Resources */ = {isa = PBXBuildFile; fileRef = 0DEA5F751CF647E200704398 /* sync_eventupload_input_basic.plist */; };
+		0DEA5F7A1CF64C9200704398 /* sync_ruledownload_batch1.json in Resources */ = {isa = PBXBuildFile; fileRef = 0DEA5F771CF64C8B00704398 /* sync_ruledownload_batch1.json */; };
+		0DEA5F7B1CF64C9200704398 /* sync_ruledownload_batch2.json in Resources */ = {isa = PBXBuildFile; fileRef = 0DEA5F781CF64C8B00704398 /* sync_ruledownload_batch2.json */; };
+		0DEA5F7D1CF64EB600704398 /* SNTCommandSyncRuleDownload.m in Sources */ = {isa = PBXBuildFile; fileRef = 0D0A1EC2191998C900B8450F /* SNTCommandSyncRuleDownload.m */; };
 		0DEFB7C01ACB28B000B92AAE /* SNTCommandSyncConstants.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DEFB7BF1ACB28B000B92AAE /* SNTCommandSyncConstants.m */; };
 		0DEFB7C41ACDD80100B92AAE /* SNTFileWatcher.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DEFB7C31ACDD80100B92AAE /* SNTFileWatcher.m */; };
 		0DEFB7C51ACDD80100B92AAE /* SNTFileWatcher.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DEFB7C31ACDD80100B92AAE /* SNTFileWatcher.m */; };
@@ -156,10 +170,11 @@
 		0DEFB7C81ACF0BFE00B92AAE /* SNTFileWatcherTest.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DEFB7C71ACF0BFE00B92AAE /* SNTFileWatcherTest.m */; };
 		0DF395641AB76A7900CBC520 /* NSData+Zlib.m in Sources */ = {isa = PBXBuildFile; fileRef = 0DF395631AB76A7900CBC520 /* NSData+Zlib.m */; };
 		0DF395661AB76ABC00CBC520 /* libz.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 0DF395651AB76ABC00CBC520 /* libz.dylib */; };
+		1C299D1C789489996FF9E081 /* libPods-Santa.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 87D1CEAEDF1FA6819A855559 /* libPods-Santa.a */; };
+		29C490B1720D4FD576F93519 /* libPods-LogicTests.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 17D03B346587131C45A8DA67 /* libPods-LogicTests.a */; };
+		2BA4AE89AA2447E29DA2E85C /* libPods-santactl.a in Frameworks */ = {isa = PBXBuildFile; fileRef = BE53E1EAE84D54E7FCB22FD5 /* libPods-santactl.a */; };
 		4092327A1A51B66400A04527 /* SNTCommandRule.m in Sources */ = {isa = PBXBuildFile; fileRef = 409232791A51B65D00A04527 /* SNTCommandRule.m */; };
-		8BFD9B39112F4D16B3D0EFFB /* libPods-LogicTests.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 752301D17AA44BDE8B6D0541 /* libPods-LogicTests.a */; };
-		CB7CD33A4D1B4745552333F4 /* libPods-Santa.a in Frameworks */ = {isa = PBXBuildFile; fileRef = E7544A9B819620883181F257 /* libPods-Santa.a */; };
-		E86AE075D7F24FB88FB627C5 /* libPods-santad.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 0A84545E322F475FA0B505D5 /* libPods-santad.a */; };
+		A60673DE57680AC450A3B0B2 /* libPods-santad.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 9BE438428F17C09C6A9D0802 /* libPods-santad.a */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
@@ -236,7 +251,6 @@
 /* End PBXCopyFilesBuildPhase section */
 
 /* Begin PBXFileReference section */
-		0A84545E322F475FA0B505D5 /* libPods-santad.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = "libPods-santad.a"; sourceTree = BUILT_PRODUCTS_DIR; };
 		0D0016A2192BCD3C005E7FCD /* KernelTests */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = KernelTests; sourceTree = BUILT_PRODUCTS_DIR; };
 		0D0016A5192BCD3C005E7FCD /* main.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; path = main.m; sourceTree = "<group>"; };
 		0D0A1EC1191998C900B8450F /* SNTCommandSyncRuleDownload.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTCommandSyncRuleDownload.h; sourceTree = "<group>"; };
@@ -245,10 +259,12 @@
 		0D0A1EC5191AB9B000B8450F /* SNTCommandSyncPostflight.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCommandSyncPostflight.m; sourceTree = "<group>"; };
 		0D10BE851A0AABD600C0C944 /* SNTDropRootPrivs.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTDropRootPrivs.m; sourceTree = "<group>"; };
 		0D10BE881A0AAC2100C0C944 /* SNTDropRootPrivs.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = SNTDropRootPrivs.h; sourceTree = "<group>"; };
-		0D10BE8A1A0AB23300C0C944 /* SNTDERDecoderTest.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTDERDecoderTest.m; sourceTree = "<group>"; };
 		0D1B476D19A53419008CADD3 /* SNTAboutWindowController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTAboutWindowController.h; sourceTree = "<group>"; };
 		0D1B476E19A53419008CADD3 /* SNTAboutWindowController.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTAboutWindowController.m; sourceTree = "<group>"; };
 		0D1B476F19A53419008CADD3 /* AboutWindow.xib */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = file.xib; path = AboutWindow.xib; sourceTree = "<group>"; };
+		0D202D181CDD2EE500A88F16 /* SNTCommandSyncTest.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCommandSyncTest.m; sourceTree = "<group>"; };
+		0D202D1D1CDD479400A88F16 /* libz.tbd */ = {isa = PBXFileReference; lastKnownFileType = "sourcecode.text-based-dylib-definition"; name = libz.tbd; path = usr/lib/libz.tbd; sourceTree = SDKROOT; };
+		0D202D1F1CE4E90E00A88F16 /* sync_preflight_basic.json */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.json; path = sync_preflight_basic.json; sourceTree = "<group>"; };
 		0D260DAC18B68E12002A0B55 /* LogicTests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = LogicTests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
 		0D260DB118B68E12002A0B55 /* Tests-Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = "Tests-Info.plist"; sourceTree = "<group>"; };
 		0D260DB718B68E12002A0B55 /* Tests-Prefix.pch */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = "Tests-Prefix.pch"; sourceTree = "<group>"; };
@@ -309,12 +325,12 @@
 		0D7A7AF2174FCF4C00B77646 /* SantaCachedDecision.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SantaCachedDecision.h; sourceTree = "<group>"; };
 		0D7D01851774F93A005DBAB4 /* SNTDriverManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTDriverManager.h; sourceTree = "<group>"; };
 		0D7D01861774F93A005DBAB4 /* SNTDriverManager.m */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 2; lastKnownFileType = sourcecode.c.objc; path = SNTDriverManager.m; sourceTree = "<group>"; };
-		0D7FFD491A017D4B00F34435 /* SNTDERDecoder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTDERDecoder.h; sourceTree = "<group>"; };
-		0D7FFD4A1A017D4B00F34435 /* SNTDERDecoder.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTDERDecoder.m; sourceTree = "<group>"; };
-		0D827E6619DF3C74006EC811 /* SNTCommandStatus.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; name = SNTCommandStatus.m; path = status/SNTCommandStatus.m; sourceTree = "<group>"; };
+		0D827E6619DF3C74006EC811 /* SNTCommandStatus.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCommandStatus.m; sourceTree = "<group>"; };
 		0D8C200B180F359A00CE2BF8 /* Security.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Security.framework; path = System/Library/Frameworks/Security.framework; sourceTree = SDKROOT; };
 		0D8E18CB19107B56000F89B8 /* SNTDaemonControlController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTDaemonControlController.h; sourceTree = "<group>"; };
 		0D8E18CC19107B56000F89B8 /* SNTDaemonControlController.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTDaemonControlController.m; sourceTree = "<group>"; };
+		0D9184B61CD2F32D0004E859 /* SNTCommandSyncStage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTCommandSyncStage.h; sourceTree = "<group>"; };
+		0D9184B71CD2F32D0004E859 /* SNTCommandSyncStage.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCommandSyncStage.m; sourceTree = "<group>"; };
 		0D91BCB4174E8A7E00131A7D /* santa-driver.kext */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = "santa-driver.kext"; sourceTree = BUILT_PRODUCTS_DIR; };
 		0D91BCB8174E8A7E00131A7D /* Kernel.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Kernel.framework; path = System/Library/Frameworks/Kernel.framework; sourceTree = SDKROOT; };
 		0D91BCBB174E8A7E00131A7D /* santa-driver-Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = "santa-driver-Info.plist"; sourceTree = "<group>"; };
@@ -328,8 +344,10 @@
 		0D9A7F411759330500035EB5 /* main.m */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.objc; lineEnding = 0; path = main.m; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = xcode.lang.objc; };
 		0DA73C9E1934F8100056D7C4 /* SNTLogging.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTLogging.m; sourceTree = "<group>"; };
 		0DB2B92318085753001C01D9 /* santad-Prefix.pch */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = "santad-Prefix.pch"; sourceTree = "<group>"; };
-		0DB390981AB1E11400614002 /* SNTCommandVersion.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; name = SNTCommandVersion.m; path = version/SNTCommandVersion.m; sourceTree = "<group>"; };
+		0DB390981AB1E11400614002 /* SNTCommandVersion.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCommandVersion.m; sourceTree = "<group>"; };
 		0DB537861AFD36EB00487F92 /* SNTRuleTableTest.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTRuleTableTest.m; sourceTree = "<group>"; };
+		0DB77FD61CCE824A004DF060 /* SNTBlockMessage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTBlockMessage.h; sourceTree = "<group>"; };
+		0DB77FD71CCE824A004DF060 /* SNTBlockMessage.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTBlockMessage.m; sourceTree = "<group>"; };
 		0DB8ACBF185662DC00FEF9C7 /* SNTApplication.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTApplication.h; sourceTree = "<group>"; };
 		0DB8ACC0185662DC00FEF9C7 /* SNTApplication.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; lineEnding = 0; path = SNTApplication.m; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = xcode.lang.objc; };
 		0DB8ACE41858D73000FEF9C7 /* santad-Info.plist */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.xml; path = "santad-Info.plist"; sourceTree = "<group>"; };
@@ -350,8 +368,6 @@
 		0DCD605419115D17006B445C /* SNTXPCControlInterface.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTXPCControlInterface.m; sourceTree = "<group>"; };
 		0DCD605A19117A90006B445C /* SNTCommandSyncPreflight.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTCommandSyncPreflight.h; sourceTree = "<group>"; };
 		0DCD605B19117A90006B445C /* SNTCommandSyncPreflight.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCommandSyncPreflight.m; sourceTree = "<group>"; };
-		0DCD6060191188B1006B445C /* SNTAuthenticatingURLSession.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTAuthenticatingURLSession.h; sourceTree = "<group>"; };
-		0DCD6061191188B1006B445C /* SNTAuthenticatingURLSession.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTAuthenticatingURLSession.m; sourceTree = "<group>"; };
 		0DD0D48E194F78F8005F27EB /* SNTFileInfoTest.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTFileInfoTest.m; sourceTree = "<group>"; };
 		0DD0D490194F9947005F27EB /* SNTExecutionControllerTest.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTExecutionControllerTest.m; sourceTree = "<group>"; };
 		0DE2CE541CA05561002B649A /* SNTAccessibleTextField.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTAccessibleTextField.h; sourceTree = "<group>"; };
@@ -365,6 +381,11 @@
 		0DE6788C1784A8C2007A9E52 /* SNTExecutionController.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; lineEnding = 0; path = SNTExecutionController.m; sourceTree = "<group>"; xcLanguageSpecificationIdentifier = xcode.lang.objc; };
 		0DE71A731B95F7F900518526 /* SNTCachedDecision.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTCachedDecision.h; sourceTree = "<group>"; };
 		0DE71A741B95F7F900518526 /* SNTCachedDecision.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCachedDecision.m; sourceTree = "<group>"; };
+		0DEA5F641CF6000600704398 /* sync_preflight_lockdown.json */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.json; path = sync_preflight_lockdown.json; sourceTree = "<group>"; };
+		0DEA5F731CF639BE00704398 /* sync_eventupload_input_quarantine.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = sync_eventupload_input_quarantine.plist; sourceTree = "<group>"; };
+		0DEA5F751CF647E200704398 /* sync_eventupload_input_basic.plist */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.xml; path = sync_eventupload_input_basic.plist; sourceTree = "<group>"; };
+		0DEA5F771CF64C8B00704398 /* sync_ruledownload_batch1.json */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.json; path = sync_ruledownload_batch1.json; sourceTree = "<group>"; };
+		0DEA5F781CF64C8B00704398 /* sync_ruledownload_batch2.json */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.json; path = sync_ruledownload_batch2.json; sourceTree = "<group>"; };
 		0DEFB7BF1ACB28B000B92AAE /* SNTCommandSyncConstants.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCommandSyncConstants.m; sourceTree = "<group>"; };
 		0DEFB7C11ACB28BC00B92AAE /* SNTCommandSyncConstants.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = SNTCommandSyncConstants.h; sourceTree = "<group>"; };
 		0DEFB7C21ACDD80100B92AAE /* SNTFileWatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SNTFileWatcher.h; sourceTree = "<group>"; };
@@ -373,18 +394,19 @@
 		0DF395621AB76A7900CBC520 /* NSData+Zlib.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = "NSData+Zlib.h"; sourceTree = "<group>"; };
 		0DF395631AB76A7900CBC520 /* NSData+Zlib.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = "NSData+Zlib.m"; sourceTree = "<group>"; };
 		0DF395651AB76ABC00CBC520 /* libz.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libz.dylib; path = usr/lib/libz.dylib; sourceTree = SDKROOT; };
-		13A4FE400F3857C0F5831498 /* Pods-LogicTests.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-LogicTests.debug.xcconfig"; path = "Pods/Target Support Files/Pods-LogicTests/Pods-LogicTests.debug.xcconfig"; sourceTree = "<group>"; };
-		409232791A51B65D00A04527 /* SNTCommandRule.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; name = SNTCommandRule.m; path = rule/SNTCommandRule.m; sourceTree = "<group>"; };
-		54DD0E77B8BE005AFB7E944A /* Pods-santactl.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-santactl.release.xcconfig"; path = "Pods/Target Support Files/Pods-santactl/Pods-santactl.release.xcconfig"; sourceTree = "<group>"; };
-		583E60E97931BA83D5273304 /* Pods-santactl.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-santactl.debug.xcconfig"; path = "Pods/Target Support Files/Pods-santactl/Pods-santactl.debug.xcconfig"; sourceTree = "<group>"; };
-		627BB4EC9917DC20E89D718C /* Pods-santad.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-santad.debug.xcconfig"; path = "Pods/Target Support Files/Pods-santad/Pods-santad.debug.xcconfig"; sourceTree = "<group>"; };
-		752301D17AA44BDE8B6D0541 /* libPods-LogicTests.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = "libPods-LogicTests.a"; sourceTree = BUILT_PRODUCTS_DIR; };
-		8003CA1D3E46447BCEA56440 /* Pods-santad.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-santad.release.xcconfig"; path = "Pods/Target Support Files/Pods-santad/Pods-santad.release.xcconfig"; sourceTree = "<group>"; };
-		8D738300867507BD7985972F /* Pods-Santa.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Santa.release.xcconfig"; path = "Pods/Target Support Files/Pods-Santa/Pods-Santa.release.xcconfig"; sourceTree = "<group>"; };
-		A2EA300312100AE62218F84E /* libPods-santactl.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = "libPods-santactl.a"; sourceTree = BUILT_PRODUCTS_DIR; };
-		BE74E23CF5A553E5F02462B9 /* Pods-LogicTests.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-LogicTests.release.xcconfig"; path = "Pods/Target Support Files/Pods-LogicTests/Pods-LogicTests.release.xcconfig"; sourceTree = "<group>"; };
-		DE1F4E0329B023976A1BAC19 /* Pods-Santa.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Santa.debug.xcconfig"; path = "Pods/Target Support Files/Pods-Santa/Pods-Santa.debug.xcconfig"; sourceTree = "<group>"; };
-		E7544A9B819620883181F257 /* libPods-Santa.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = "libPods-Santa.a"; sourceTree = BUILT_PRODUCTS_DIR; };
+		17D03B346587131C45A8DA67 /* libPods-LogicTests.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = "libPods-LogicTests.a"; sourceTree = BUILT_PRODUCTS_DIR; };
+		2B9F8A80C0F8D34D98135F36 /* Pods-santactl.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-santactl.release.xcconfig"; path = "Pods/Target Support Files/Pods-santactl/Pods-santactl.release.xcconfig"; sourceTree = "<group>"; };
+		409232791A51B65D00A04527 /* SNTCommandRule.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = SNTCommandRule.m; sourceTree = "<group>"; };
+		4D9D2DDDCD92DBB948D38B11 /* Pods-Santa.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Santa.release.xcconfig"; path = "Pods/Target Support Files/Pods-Santa/Pods-Santa.release.xcconfig"; sourceTree = "<group>"; };
+		4E43227BA5B261FF33141AFC /* Pods-LogicTests.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-LogicTests.debug.xcconfig"; path = "Pods/Target Support Files/Pods-LogicTests/Pods-LogicTests.debug.xcconfig"; sourceTree = "<group>"; };
+		691189054F4E484D030CF831 /* Pods-santactl.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-santactl.debug.xcconfig"; path = "Pods/Target Support Files/Pods-santactl/Pods-santactl.debug.xcconfig"; sourceTree = "<group>"; };
+		7C9CC3CDF2609E78E6A9C601 /* Pods-santad.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-santad.release.xcconfig"; path = "Pods/Target Support Files/Pods-santad/Pods-santad.release.xcconfig"; sourceTree = "<group>"; };
+		821428941753678DB772D761 /* Pods-LogicTests.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-LogicTests.release.xcconfig"; path = "Pods/Target Support Files/Pods-LogicTests/Pods-LogicTests.release.xcconfig"; sourceTree = "<group>"; };
+		87D1CEAEDF1FA6819A855559 /* libPods-Santa.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = "libPods-Santa.a"; sourceTree = BUILT_PRODUCTS_DIR; };
+		95B378553DCD86290341B8E4 /* Pods-santad.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-santad.debug.xcconfig"; path = "Pods/Target Support Files/Pods-santad/Pods-santad.debug.xcconfig"; sourceTree = "<group>"; };
+		9BE438428F17C09C6A9D0802 /* libPods-santad.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = "libPods-santad.a"; sourceTree = BUILT_PRODUCTS_DIR; };
+		BE53E1EAE84D54E7FCB22FD5 /* libPods-santactl.a */ = {isa = PBXFileReference; explicitFileType = archive.ar; includeInIndex = 0; path = "libPods-santactl.a"; sourceTree = BUILT_PRODUCTS_DIR; };
+		D227889DF327E7D3532FE00B /* Pods-Santa.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Santa.debug.xcconfig"; path = "Pods/Target Support Files/Pods-Santa/Pods-Santa.debug.xcconfig"; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -401,9 +423,10 @@
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
+				0D202D1E1CDD479400A88F16 /* libz.tbd in Frameworks */,
 				0D3AFBF618FB4C7E0087BCEE /* Cocoa.framework in Frameworks */,
 				0D3AFBF818FB4C870087BCEE /* IOKit.framework in Frameworks */,
-				8BFD9B39112F4D16B3D0EFFB /* libPods-LogicTests.a in Frameworks */,
+				29C490B1720D4FD576F93519 /* libPods-LogicTests.a in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -415,7 +438,7 @@
 				0DE4C8A118FEF28200466D04 /* Security.framework in Frameworks */,
 				0D35BDBD18FDA23600921A21 /* IOKit.framework in Frameworks */,
 				0D35BD9F18FD71CE00921A21 /* Foundation.framework in Frameworks */,
-				02D7203A6CEE2A946FB08ECE /* libPods-santactl.a in Frameworks */,
+				2BA4AE89AA2447E29DA2E85C /* libPods-santactl.a in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -427,7 +450,7 @@
 				0D6F12D819EC8822006B218E /* SecurityInterface.framework in Frameworks */,
 				0D8C200C180F359A00CE2BF8 /* Security.framework in Frameworks */,
 				0D385DB8180DE4A900418BC6 /* Cocoa.framework in Frameworks */,
-				CB7CD33A4D1B4745552333F4 /* libPods-Santa.a in Frameworks */,
+				1C299D1C789489996FF9E081 /* libPods-Santa.a in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -438,7 +461,14 @@
 				0DD0D487194F5187005F27EB /* IOKit.framework in Frameworks */,
 				0D4A5007176A4602004F63BF /* Security.framework in Frameworks */,
 				0D9A7F3F1759330500035EB5 /* Foundation.framework in Frameworks */,
-				E86AE075D7F24FB88FB627C5 /* libPods-santad.a in Frameworks */,
+				A60673DE57680AC450A3B0B2 /* libPods-santad.a in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		73FE93AEAAFA579D63B26D43 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -457,7 +487,7 @@
 			isa = PBXGroup;
 			children = (
 				0D260DB018B68E12002A0B55 /* Resources */,
-				0D10BE8A1A0AB23300C0C944 /* SNTDERDecoderTest.m */,
+				0D202D181CDD2EE500A88F16 /* SNTCommandSyncTest.m */,
 				0D41DAD31A7C28C800A890FE /* SNTEventTableTest.m */,
 				0DD0D490194F9947005F27EB /* SNTExecutionControllerTest.m */,
 				0DD0D48E194F78F8005F27EB /* SNTFileInfoTest.m */,
@@ -472,8 +502,14 @@
 			isa = PBXGroup;
 			children = (
 				0D536ED51B8E7A2E0039A26D /* bad_pagezero */,
-				0D536ED61B8E7A2E0039A26D /* missing_pagezero */,
 				0D2CD4601A81C7B100C9C910 /* dn.plist */,
+				0D536ED61B8E7A2E0039A26D /* missing_pagezero */,
+				0DEA5F751CF647E200704398 /* sync_eventupload_input_basic.plist */,
+				0DEA5F731CF639BE00704398 /* sync_eventupload_input_quarantine.plist */,
+				0D202D1F1CE4E90E00A88F16 /* sync_preflight_basic.json */,
+				0DEA5F641CF6000600704398 /* sync_preflight_lockdown.json */,
+				0DEA5F771CF64C8B00704398 /* sync_ruledownload_batch1.json */,
+				0DEA5F781CF64C8B00704398 /* sync_ruledownload_batch2.json */,
 				0D260DB118B68E12002A0B55 /* Tests-Info.plist */,
 				0D260DB718B68E12002A0B55 /* Tests-Prefix.pch */,
 			);
@@ -484,13 +520,12 @@
 			isa = PBXGroup;
 			children = (
 				0D35BDAA18FD7CFD00921A21 /* SNTCommandController.h */,
-				0D35BDA118FD71CE00921A21 /* main.m */,
 				0D35BDAB18FD7CFD00921A21 /* SNTCommandController.m */,
+				0D35BDA118FD71CE00921A21 /* main.m */,
 				0DAF01141C1B794B00F5B6C3 /* Commands */,
 				0D35BDA318FD71CE00921A21 /* Resources */,
 			);
-			name = santactl;
-			path = Source/santactl;
+			path = santactl;
 			sourceTree = "<group>";
 		};
 		0D35BDA318FD71CE00921A21 /* Resources */ = {
@@ -507,8 +542,6 @@
 			children = (
 				0DF395621AB76A7900CBC520 /* NSData+Zlib.h */,
 				0DF395631AB76A7900CBC520 /* NSData+Zlib.m */,
-				0DCD6060191188B1006B445C /* SNTAuthenticatingURLSession.h */,
-				0DCD6061191188B1006B445C /* SNTAuthenticatingURLSession.m */,
 				0D35BDB418FD84F600921A21 /* SNTCommandSync.m */,
 				0DEFB7C11ACB28BC00B92AAE /* SNTCommandSyncConstants.h */,
 				0DEFB7BF1ACB28B000B92AAE /* SNTCommandSyncConstants.m */,
@@ -522,10 +555,10 @@
 				0DCD605B19117A90006B445C /* SNTCommandSyncPreflight.m */,
 				0D0A1EC1191998C900B8450F /* SNTCommandSyncRuleDownload.h */,
 				0D0A1EC2191998C900B8450F /* SNTCommandSyncRuleDownload.m */,
+				0D9184B61CD2F32D0004E859 /* SNTCommandSyncStage.h */,
+				0D9184B71CD2F32D0004E859 /* SNTCommandSyncStage.m */,
 				0D4163FF191974F1006A356A /* SNTCommandSyncState.h */,
 				0D416400191974F1006A356A /* SNTCommandSyncState.m */,
-				0D7FFD491A017D4B00F34435 /* SNTDERDecoder.h */,
-				0D7FFD4A1A017D4B00F34435 /* SNTDERDecoder.m */,
 			);
 			path = sync;
 			sourceTree = "<group>";
@@ -548,8 +581,7 @@
 				0D385DEF180DE51600418BC6 /* SNTNotificationManager.m */,
 				0D3AF83018F87CE20087BCEE /* Resources */,
 			);
-			name = SantaGUI;
-			path = Source/SantaGUI;
+			path = SantaGUI;
 			sourceTree = "<group>";
 		};
 		0D3AF83018F87CE20087BCEE /* Resources */ = {
@@ -582,26 +614,14 @@
 			path = Tests;
 			sourceTree = "<group>";
 		};
-		0D827E6819DF4F3F006EC811 /* status */ = {
-			isa = PBXGroup;
-			children = (
-				0D827E6619DF3C74006EC811 /* SNTCommandStatus.m */,
-			);
-			name = status;
-			sourceTree = "<group>";
-		};
 		0D91BCA7174E8A6500131A7D = {
 			isa = PBXGroup;
 			children = (
-				0D91BCD5174E8AAB00131A7D /* common */,
-				0D91BCB9174E8A7E00131A7D /* santa-driver */,
-				0D9A7F401759330500035EB5 /* santad */,
-				0D35BDA018FD71CE00921A21 /* santactl */,
-				0D385DBD180DE4A900418BC6 /* SantaGUI */,
+				0DB77FDC1CD262F5004DF060 /* Source */,
 				0D789F9F1940F26D0036F7C4 /* Tests */,
 				0D91BCB6174E8A7E00131A7D /* Frameworks */,
 				0D91BCB5174E8A7E00131A7D /* Products */,
-				277C48D61A6FDE3B7B817FE7 /* Pods */,
+				57575205DAC12A357F9EF899 /* Pods */,
 			);
 			sourceTree = "<group>";
 		};
@@ -621,6 +641,7 @@
 		0D91BCB6174E8A7E00131A7D /* Frameworks */ = {
 			isa = PBXGroup;
 			children = (
+				0D202D1D1CDD479400A88F16 /* libz.tbd */,
 				0DF395651AB76ABC00CBC520 /* libz.dylib */,
 				0DCD5F771909C659006B445C /* SecurityInterface.framework */,
 				0D3AFBF718FB4C870087BCEE /* IOKit.framework */,
@@ -629,10 +650,10 @@
 				0D91BCB8174E8A7E00131A7D /* Kernel.framework */,
 				0D9A7F3E1759330500035EB5 /* Foundation.framework */,
 				0D385DB7180DE4A900418BC6 /* Cocoa.framework */,
-				752301D17AA44BDE8B6D0541 /* libPods-LogicTests.a */,
-				0A84545E322F475FA0B505D5 /* libPods-santad.a */,
-				E7544A9B819620883181F257 /* libPods-Santa.a */,
-				A2EA300312100AE62218F84E /* libPods-santactl.a */,
+				17D03B346587131C45A8DA67 /* libPods-LogicTests.a */,
+				87D1CEAEDF1FA6819A855559 /* libPods-Santa.a */,
+				BE53E1EAE84D54E7FCB22FD5 /* libPods-santactl.a */,
+				9BE438428F17C09C6A9D0802 /* libPods-santad.a */,
 			);
 			name = Frameworks;
 			sourceTree = "<group>";
@@ -652,13 +673,14 @@
 				0DB98BF81C1B9F3000B65DB1 /* SantaPIDAndPPID.cc */,
 				0DA36C1F199EA46600A129D6 /* Resources */,
 			);
-			name = "santa-driver";
-			path = "Source/santa-driver";
+			path = "santa-driver";
 			sourceTree = "<group>";
 		};
 		0D91BCD5174E8AAB00131A7D /* common */ = {
 			isa = PBXGroup;
 			children = (
+				0DB77FD61CCE824A004DF060 /* SNTBlockMessage.h */,
+				0DB77FD71CCE824A004DF060 /* SNTBlockMessage.m */,
 				0D91BCE4174E8B5E00131A7D /* SNTCommonEnums.h */,
 				0D42D2B619D2042900955F08 /* SNTConfigurator.h */,
 				0D42D2B719D2042900955F08 /* SNTConfigurator.m */,
@@ -685,8 +707,7 @@
 				0DC8C9E3180CC3BC00FCFB29 /* SNTXPCNotifierInterface.h */,
 				0DCD604E19115A06006B445C /* SNTXPCNotifierInterface.m */,
 			);
-			name = common;
-			path = Source/common;
+			path = common;
 			sourceTree = "<group>";
 		};
 		0D9A7F401759330500035EB5 /* santad */ = {
@@ -712,8 +733,7 @@
 				0DE5B54A1C926E3300C00603 /* SNTNotificationQueue.m */,
 				0D3AF83118F87CEF0087BCEE /* Resources */,
 			);
-			name = santad;
-			path = Source/santad;
+			path = santad;
 			sourceTree = "<group>";
 		};
 		0DA36C1F199EA46600A129D6 /* Resources */ = {
@@ -734,69 +754,49 @@
 				0D377C2417A06DDE008453DB /* SNTRuleTable.h */,
 				0DC5D86C191AED220078A5C0 /* SNTRuleTable.m */,
 			);
-			name = DataLayer;
+			path = DataLayer;
 			sourceTree = "<group>";
 		};
 		0DAF01141C1B794B00F5B6C3 /* Commands */ = {
-			isa = PBXGroup;
-			children = (
-				0DCD5FBC1909D4FD006B445C /* fileinfo */,
-				0DE4C8A318FF3AFA00466D04 /* flushcache */,
-				409232751A51914400A04527 /* rule */,
-				0D827E6819DF4F3F006EC811 /* status */,
-				0D35BDB618FD84FC00921A21 /* sync */,
-				0DB390971AB1E0F200614002 /* version */,
-			);
-			name = Commands;
-			sourceTree = "<group>";
-		};
-		0DB390971AB1E0F200614002 /* version */ = {
-			isa = PBXGroup;
-			children = (
-				0DB390981AB1E11400614002 /* SNTCommandVersion.m */,
-			);
-			name = version;
-			sourceTree = "<group>";
-		};
-		0DCD5FBC1909D4FD006B445C /* fileinfo */ = {
 			isa = PBXGroup;
 			children = (
 				0DCD5FBE1909D64A006B445C /* SNTCommandFileInfo.m */,
-			);
-			path = fileinfo;
-			sourceTree = "<group>";
-		};
-		0DE4C8A318FF3AFA00466D04 /* flushcache */ = {
-			isa = PBXGroup;
-			children = (
 				0DE4C8A518FF3B1700466D04 /* SNTCommandFlushCache.m */,
+				409232791A51B65D00A04527 /* SNTCommandRule.m */,
+				0D827E6619DF3C74006EC811 /* SNTCommandStatus.m */,
+				0DB390981AB1E11400614002 /* SNTCommandVersion.m */,
+				0D35BDB618FD84FC00921A21 /* sync */,
 			);
-			path = flushcache;
+			path = Commands;
 			sourceTree = "<group>";
 		};
-		277C48D61A6FDE3B7B817FE7 /* Pods */ = {
+		0DB77FDC1CD262F5004DF060 /* Source */ = {
 			isa = PBXGroup;
 			children = (
-				13A4FE400F3857C0F5831498 /* Pods-LogicTests.debug.xcconfig */,
-				BE74E23CF5A553E5F02462B9 /* Pods-LogicTests.release.xcconfig */,
-				627BB4EC9917DC20E89D718C /* Pods-santad.debug.xcconfig */,
-				8003CA1D3E46447BCEA56440 /* Pods-santad.release.xcconfig */,
-				DE1F4E0329B023976A1BAC19 /* Pods-Santa.debug.xcconfig */,
-				8D738300867507BD7985972F /* Pods-Santa.release.xcconfig */,
-				583E60E97931BA83D5273304 /* Pods-santactl.debug.xcconfig */,
-				54DD0E77B8BE005AFB7E944A /* Pods-santactl.release.xcconfig */,
+				0D91BCD5174E8AAB00131A7D /* common */,
+				0D91BCB9174E8A7E00131A7D /* santa-driver */,
+				0D9A7F401759330500035EB5 /* santad */,
+				0D35BDA018FD71CE00921A21 /* santactl */,
+				0D385DBD180DE4A900418BC6 /* SantaGUI */,
+			);
+			path = Source;
+			sourceTree = "<group>";
+		};
+		57575205DAC12A357F9EF899 /* Pods */ = {
+			isa = PBXGroup;
+			children = (
+				4E43227BA5B261FF33141AFC /* Pods-LogicTests.debug.xcconfig */,
+				821428941753678DB772D761 /* Pods-LogicTests.release.xcconfig */,
+				D227889DF327E7D3532FE00B /* Pods-Santa.debug.xcconfig */,
+				4D9D2DDDCD92DBB948D38B11 /* Pods-Santa.release.xcconfig */,
+				691189054F4E484D030CF831 /* Pods-santactl.debug.xcconfig */,
+				2B9F8A80C0F8D34D98135F36 /* Pods-santactl.release.xcconfig */,
+				95B378553DCD86290341B8E4 /* Pods-santad.debug.xcconfig */,
+				7C9CC3CDF2609E78E6A9C601 /* Pods-santad.release.xcconfig */,
 			);
 			name = Pods;
 			sourceTree = "<group>";
 		};
-		409232751A51914400A04527 /* rule */ = {
-			isa = PBXGroup;
-			children = (
-				409232791A51B65D00A04527 /* SNTCommandRule.m */,
-			);
-			name = rule;
-			sourceTree = "<group>";
-		};
 /* End PBXGroup section */
 
 /* Begin PBXHeadersBuildPhase section */
@@ -835,13 +835,13 @@
 			isa = PBXNativeTarget;
 			buildConfigurationList = 0D260DBC18B68E12002A0B55 /* Build configuration list for PBXNativeTarget "LogicTests" */;
 			buildPhases = (
-				AE05898CB3CE4507B2F43B91 /* Check Pods Manifest.lock */,
+				C88551472F6983D0B00880F8 /* 📦 Check Pods Manifest.lock */,
 				0D673DAD18FC9017009C5B06 /* Delete existing coverage files */,
 				0D260DA818B68E12002A0B55 /* Sources */,
 				0D260DA918B68E12002A0B55 /* Frameworks */,
 				0D260DAA18B68E12002A0B55 /* Resources */,
-				85CE5DF0D54C438A8933A631 /* Copy Pods Resources */,
-				4B68B2D454C1C55D29AA76D8 /* Embed Pods Frameworks */,
+				1D12555F0F4EF323B11E40F9 /* 📦 Embed Pods Frameworks */,
+				0C5C7A6AB763BCE7F760FAFF /* 📦 Copy Pods Resources */,
 			);
 			buildRules = (
 			);
@@ -856,11 +856,11 @@
 			isa = PBXNativeTarget;
 			buildConfigurationList = 0D35BDA918FD71CE00921A21 /* Build configuration list for PBXNativeTarget "santactl" */;
 			buildPhases = (
-				AAFCB010997D370F4297BF35 /* Check Pods Manifest.lock */,
+				EE6ABBFEC2708CE57EB1780A /* 📦 Check Pods Manifest.lock */,
 				0DD98E671A5DD02000A754C6 /* Update Version Info */,
 				0D35BD9A18FD71CE00921A21 /* Sources */,
 				0D35BD9B18FD71CE00921A21 /* Frameworks */,
-				32AA711FA23052E0F2EE59EB /* Copy Pods Resources */,
+				E50DD7319E04737B040B69EC /* 📦 Copy Pods Resources */,
 			);
 			buildRules = (
 			);
@@ -875,13 +875,13 @@
 			isa = PBXNativeTarget;
 			buildConfigurationList = 0D385DE3180DE4A900418BC6 /* Build configuration list for PBXNativeTarget "Santa" */;
 			buildPhases = (
-				4347374E751B0BF8CF6A7110 /* Check Pods Manifest.lock */,
+				B34356D1FD4C8C6EF75F2FFE /* 📦 Check Pods Manifest.lock */,
 				0DD98E681A5DD03E00A754C6 /* Update Version Info */,
 				0D385DB2180DE4A900418BC6 /* Sources */,
 				0D385DB3180DE4A900418BC6 /* Frameworks */,
 				0D385DB4180DE4A900418BC6 /* Resources */,
-				309C93A0ACB98D32A337D908 /* Embed Pods Frameworks */,
-				2AB78B9612925DE634AE8F7C /* Copy Pods Resources */,
+				31CD7EDCDEBD95322ED67F63 /* 📦 Embed Pods Frameworks */,
+				B3EB60284D47F89140F5A033 /* 📦 Copy Pods Resources */,
 			);
 			buildRules = (
 			);
@@ -901,6 +901,7 @@
 				0D91BCAE174E8A7E00131A7D /* Sources */,
 				0D91BCB0174E8A7E00131A7D /* Headers */,
 				0DC765E91B28D9CB00BAE651 /* CopyFiles */,
+				73FE93AEAAFA579D63B26D43 /* Frameworks */,
 			);
 			buildRules = (
 			);
@@ -917,11 +918,11 @@
 			isa = PBXNativeTarget;
 			buildConfigurationList = 0D9A7F471759330500035EB5 /* Build configuration list for PBXNativeTarget "santad" */;
 			buildPhases = (
-				34C9C9E8C5454BBE980DF8A9 /* Check Pods Manifest.lock */,
+				A3D478EF1D48EA118AF176E9 /* 📦 Check Pods Manifest.lock */,
 				0DD98E661A5DCED300A754C6 /* Update Version Info */,
 				0D9A7F391759330400035EB5 /* Sources */,
 				0D9A7F3A1759330400035EB5 /* Frameworks */,
-				3CDBFA3554E7465D93EAA5C8 /* Copy Pods Resources */,
+				435B0E246EE25ACC763D684C /* 📦 Copy Pods Resources */,
 			);
 			buildRules = (
 			);
@@ -938,7 +939,7 @@
 		0D91BCA8174E8A6500131A7D /* Project object */ = {
 			isa = PBXProject;
 			attributes = {
-				LastUpgradeCheck = 0700;
+				LastUpgradeCheck = 0720;
 				TargetAttributes = {
 					0D260DAB18B68E12002A0B55 = {
 						TestTargetID = 0D385DB5180DE4A900418BC6;
@@ -974,9 +975,15 @@
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
+				0DEA5F761CF6482E00704398 /* sync_eventupload_input_basic.plist in Resources */,
 				0D536ED71B8E7A2E0039A26D /* bad_pagezero in Resources */,
+				0DEA5F7A1CF64C9200704398 /* sync_ruledownload_batch1.json in Resources */,
+				0DEA5F741CF63B9600704398 /* sync_eventupload_input_quarantine.plist in Resources */,
 				0D2CD4611A81C7B100C9C910 /* dn.plist in Resources */,
+				0DEA5F7B1CF64C9200704398 /* sync_ruledownload_batch2.json in Resources */,
+				0DEA5F6C1CF6254900704398 /* sync_preflight_lockdown.json in Resources */,
 				0D536ED81B8E7A2E0039A26D /* missing_pagezero in Resources */,
+				0D202D201CE4E90E00A88F16 /* sync_preflight_basic.json in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -993,6 +1000,21 @@
 /* End PBXResourcesBuildPhase section */
 
 /* Begin PBXShellScriptBuildPhase section */
+		0C5C7A6AB763BCE7F760FAFF /* 📦 Copy Pods Resources */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+			);
+			name = "📦 Copy Pods Resources";
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "\"${SRCROOT}/Pods/Target Support Files/Pods-LogicTests/Pods-LogicTests-resources.sh\"\n";
+			showEnvVarsInLog = 0;
+		};
 		0D45F4271A5DCB7A00BF4375 /* Update Version Info */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
@@ -1086,104 +1108,14 @@
 			shellPath = /bin/sh;
 			shellScript = "GIT_TAG=$(git describe --abbrev=0 --tags)\nsed -i '' \"s/TO.BE.FILLED/${GIT_TAG}/\" ${DERIVED_FILE_DIR}/santa-driver_info.c";
 		};
-		2AB78B9612925DE634AE8F7C /* Copy Pods Resources */ = {
+		1D12555F0F4EF323B11E40F9 /* 📦 Embed Pods Frameworks */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
 			);
 			inputPaths = (
 			);
-			name = "Copy Pods Resources";
-			outputPaths = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "\"${SRCROOT}/Pods/Target Support Files/Pods-Santa/Pods-Santa-resources.sh\"\n";
-			showEnvVarsInLog = 0;
-		};
-		309C93A0ACB98D32A337D908 /* Embed Pods Frameworks */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-			);
-			name = "Embed Pods Frameworks";
-			outputPaths = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "\"${SRCROOT}/Pods/Target Support Files/Pods-Santa/Pods-Santa-frameworks.sh\"\n";
-			showEnvVarsInLog = 0;
-		};
-		32AA711FA23052E0F2EE59EB /* Copy Pods Resources */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-			);
-			name = "Copy Pods Resources";
-			outputPaths = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "\"${SRCROOT}/Pods/Target Support Files/Pods-santactl/Pods-santactl-resources.sh\"\n";
-			showEnvVarsInLog = 0;
-		};
-		34C9C9E8C5454BBE980DF8A9 /* Check Pods Manifest.lock */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-			);
-			name = "Check Pods Manifest.lock";
-			outputPaths = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "diff \"${PODS_ROOT}/../Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [[ $? != 0 ]] ; then\n    cat << EOM\nerror: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\nEOM\n    exit 1\nfi\n";
-			showEnvVarsInLog = 0;
-		};
-		3CDBFA3554E7465D93EAA5C8 /* Copy Pods Resources */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-			);
-			name = "Copy Pods Resources";
-			outputPaths = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "\"${SRCROOT}/Pods/Target Support Files/Pods-santad/Pods-santad-resources.sh\"\n";
-			showEnvVarsInLog = 0;
-		};
-		4347374E751B0BF8CF6A7110 /* Check Pods Manifest.lock */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-			);
-			name = "Check Pods Manifest.lock";
-			outputPaths = (
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "diff \"${PODS_ROOT}/../Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [[ $? != 0 ]] ; then\n    cat << EOM\nerror: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\nEOM\n    exit 1\nfi\n";
-			showEnvVarsInLog = 0;
-		};
-		4B68B2D454C1C55D29AA76D8 /* Embed Pods Frameworks */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-			);
-			name = "Embed Pods Frameworks";
+			name = "📦 Embed Pods Frameworks";
 			outputPaths = (
 			);
 			runOnlyForDeploymentPostprocessing = 0;
@@ -1191,29 +1123,44 @@
 			shellScript = "\"${SRCROOT}/Pods/Target Support Files/Pods-LogicTests/Pods-LogicTests-frameworks.sh\"\n";
 			showEnvVarsInLog = 0;
 		};
-		85CE5DF0D54C438A8933A631 /* Copy Pods Resources */ = {
+		31CD7EDCDEBD95322ED67F63 /* 📦 Embed Pods Frameworks */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
 			);
 			inputPaths = (
 			);
-			name = "Copy Pods Resources";
+			name = "📦 Embed Pods Frameworks";
 			outputPaths = (
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "\"${SRCROOT}/Pods/Target Support Files/Pods-LogicTests/Pods-LogicTests-resources.sh\"\n";
+			shellScript = "\"${SRCROOT}/Pods/Target Support Files/Pods-Santa/Pods-Santa-frameworks.sh\"\n";
 			showEnvVarsInLog = 0;
 		};
-		AAFCB010997D370F4297BF35 /* Check Pods Manifest.lock */ = {
+		435B0E246EE25ACC763D684C /* 📦 Copy Pods Resources */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
 			);
 			inputPaths = (
 			);
-			name = "Check Pods Manifest.lock";
+			name = "📦 Copy Pods Resources";
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "\"${SRCROOT}/Pods/Target Support Files/Pods-santad/Pods-santad-resources.sh\"\n";
+			showEnvVarsInLog = 0;
+		};
+		A3D478EF1D48EA118AF176E9 /* 📦 Check Pods Manifest.lock */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+			);
+			name = "📦 Check Pods Manifest.lock";
 			outputPaths = (
 			);
 			runOnlyForDeploymentPostprocessing = 0;
@@ -1221,14 +1168,74 @@
 			shellScript = "diff \"${PODS_ROOT}/../Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [[ $? != 0 ]] ; then\n    cat << EOM\nerror: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\nEOM\n    exit 1\nfi\n";
 			showEnvVarsInLog = 0;
 		};
-		AE05898CB3CE4507B2F43B91 /* Check Pods Manifest.lock */ = {
+		B34356D1FD4C8C6EF75F2FFE /* 📦 Check Pods Manifest.lock */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
 			);
 			inputPaths = (
 			);
-			name = "Check Pods Manifest.lock";
+			name = "📦 Check Pods Manifest.lock";
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "diff \"${PODS_ROOT}/../Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [[ $? != 0 ]] ; then\n    cat << EOM\nerror: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\nEOM\n    exit 1\nfi\n";
+			showEnvVarsInLog = 0;
+		};
+		B3EB60284D47F89140F5A033 /* 📦 Copy Pods Resources */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+			);
+			name = "📦 Copy Pods Resources";
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "\"${SRCROOT}/Pods/Target Support Files/Pods-Santa/Pods-Santa-resources.sh\"\n";
+			showEnvVarsInLog = 0;
+		};
+		C88551472F6983D0B00880F8 /* 📦 Check Pods Manifest.lock */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+			);
+			name = "📦 Check Pods Manifest.lock";
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "diff \"${PODS_ROOT}/../Podfile.lock\" \"${PODS_ROOT}/Manifest.lock\" > /dev/null\nif [[ $? != 0 ]] ; then\n    cat << EOM\nerror: The sandbox is not in sync with the Podfile.lock. Run 'pod install' or update your CocoaPods installation.\nEOM\n    exit 1\nfi\n";
+			showEnvVarsInLog = 0;
+		};
+		E50DD7319E04737B040B69EC /* 📦 Copy Pods Resources */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+			);
+			name = "📦 Copy Pods Resources";
+			outputPaths = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+			shellPath = /bin/sh;
+			shellScript = "\"${SRCROOT}/Pods/Target Support Files/Pods-santactl/Pods-santactl-resources.sh\"\n";
+			showEnvVarsInLog = 0;
+		};
+		EE6ABBFEC2708CE57EB1780A /* 📦 Check Pods Manifest.lock */ = {
+			isa = PBXShellScriptBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			inputPaths = (
+			);
+			name = "📦 Check Pods Manifest.lock";
 			outputPaths = (
 			);
 			runOnlyForDeploymentPostprocessing = 0;
@@ -1253,7 +1260,10 @@
 			files = (
 				0D88680C1AC48A1400B86659 /* SNTSystemInfo.m in Sources */,
 				0D536EDC1B94E9230039A26D /* SNTEventLog.m in Sources */,
+				0DEA5F7D1CF64EB600704398 /* SNTCommandSyncRuleDownload.m in Sources */,
+				0DB77FDB1CD14093004DF060 /* SNTBlockMessage.m in Sources */,
 				0D63DD5E1906FCB400D346C4 /* SNTDatabaseController.m in Sources */,
+				0D202D191CDD2EE500A88F16 /* SNTCommandSyncTest.m in Sources */,
 				0D3AFBF018FB4C6C0087BCEE /* SNTDriverManager.m in Sources */,
 				0DCD6044190ACCB8006B445C /* SNTFileInfo.m in Sources */,
 				0D6FDC9718C93A020044685C /* SNTXPCConnection.m in Sources */,
@@ -1264,13 +1274,16 @@
 				0DB537871AFD36EB00487F92 /* SNTRuleTableTest.m in Sources */,
 				0DCD604D19105433006B445C /* SNTStoredEvent.m in Sources */,
 				0DCD605819115E57006B445C /* SNTXPCControlInterface.m in Sources */,
+				0D202D1A1CDD464B00A88F16 /* SNTCommandSyncPreflight.m in Sources */,
 				0D10BE891A0AAF6700C0C944 /* SNTDropRootPrivs.m in Sources */,
 				0DEFB7C61ACDE5F600B92AAE /* SNTFileWatcher.m in Sources */,
-				0D10BE8B1A0AB23300C0C944 /* SNTDERDecoderTest.m in Sources */,
 				0DEFB7C81ACF0BFE00B92AAE /* SNTFileWatcherTest.m in Sources */,
 				0D28D53819D9F5910015C5EB /* SNTConfigurator.m in Sources */,
 				0DE5B54C1C92722300C00603 /* SNTNotificationQueue.m in Sources */,
+				0DEA5F651CF6057D00704398 /* SNTCommandSyncEventUpload.m in Sources */,
+				0DB77FFB1CD7AC5A004DF060 /* SNTCommandSyncConstants.m in Sources */,
 				0D3AFBE718FB32CB0087BCEE /* SNTXPCConnectionTest.m in Sources */,
+				0D9184B91CD2F32D0004E859 /* SNTCommandSyncStage.m in Sources */,
 				0DCD605719115E54006B445C /* SNTDaemonControlController.m in Sources */,
 				0D41DAD41A7C28C800A890FE /* SNTEventTableTest.m in Sources */,
 				0D3AFBEE18FB4C6C0087BCEE /* SNTApplication.m in Sources */,
@@ -1280,7 +1293,7 @@
 				0DE71A761B95F7F900518526 /* SNTCachedDecision.m in Sources */,
 				0DCD605919115E5A006B445C /* SNTXPCNotifierInterface.m in Sources */,
 				0DE50F691912B0CD007B2B0C /* SNTRule.m in Sources */,
-				0D10BE8C1A0AB3FD00C0C944 /* SNTDERDecoder.m in Sources */,
+				0D202D1B1CDD465400A88F16 /* SNTCommandSyncState.m in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -1292,9 +1305,9 @@
 				0D35BDB518FD84F600921A21 /* SNTCommandSync.m in Sources */,
 				0DCD5FBF1909D64A006B445C /* SNTCommandFileInfo.m in Sources */,
 				0DEFB7C01ACB28B000B92AAE /* SNTCommandSyncConstants.m in Sources */,
-				0DCD6062191188B1006B445C /* SNTAuthenticatingURLSession.m in Sources */,
 				0DCD605619115D17006B445C /* SNTXPCControlInterface.m in Sources */,
 				0DE50F6C19130358007B2B0C /* SNTStoredEvent.m in Sources */,
+				0D9184B81CD2F32D0004E859 /* SNTCommandSyncStage.m in Sources */,
 				0D35BDC418FDA5D100921A21 /* SNTXPCConnection.m in Sources */,
 				0DCD605C19117A90006B445C /* SNTCommandSyncPreflight.m in Sources */,
 				0D41640519197AD7006A356A /* SNTCommandSyncEventUpload.m in Sources */,
@@ -1305,6 +1318,7 @@
 				4092327A1A51B66400A04527 /* SNTCommandRule.m in Sources */,
 				0D416401191974F1006A356A /* SNTCommandSyncState.m in Sources */,
 				0DC5D871192160180078A5C0 /* SNTCommandSyncLogUpload.m in Sources */,
+				0DB77FDA1CD14092004DF060 /* SNTBlockMessage.m in Sources */,
 				0D35BDA218FD71CE00921A21 /* main.m in Sources */,
 				0DCD6043190ACCB8006B445C /* SNTFileInfo.m in Sources */,
 				0DE50F6E191304E0007B2B0C /* SNTRule.m in Sources */,
@@ -1313,7 +1327,6 @@
 				0D42D2B519D1D98A00955F08 /* SNTSystemInfo.m in Sources */,
 				0D827E6719DF3C74006EC811 /* SNTCommandStatus.m in Sources */,
 				0D0A1EC6191AB9B000B8450F /* SNTCommandSyncPostflight.m in Sources */,
-				0D7FFD4B1A017D4B00F34435 /* SNTDERDecoder.m in Sources */,
 				0D35BDAC18FD7CFD00921A21 /* SNTCommandController.m in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
@@ -1327,6 +1340,7 @@
 				0D88680A1AC48A1200B86659 /* SNTSystemInfo.m in Sources */,
 				0D89310F1C931986002E8D74 /* SNTRule.m in Sources */,
 				0DCD605119115A06006B445C /* SNTXPCNotifierInterface.m in Sources */,
+				0DB77FD91CCE824A004DF060 /* SNTBlockMessage.m in Sources */,
 				0D827E6519DF392E006EC811 /* SNTConfigurator.m in Sources */,
 				0D89310E1C931979002E8D74 /* SNTXPCControlInterface.m in Sources */,
 				0D385DF2180DE51600418BC6 /* SNTMessageWindowController.m in Sources */,
@@ -1374,6 +1388,7 @@
 				0D6FDC9618C93A020044685C /* SNTXPCConnection.m in Sources */,
 				0D377C2A17A071B7008453DB /* SNTEventTable.m in Sources */,
 				0DE50F681912716A007B2B0C /* SNTRule.m in Sources */,
+				0DB77FD81CCE824A004DF060 /* SNTBlockMessage.m in Sources */,
 				0D37C10F18F6029A0069BC61 /* SNTDatabaseTable.m in Sources */,
 				0D42D2B819D2042900955F08 /* SNTConfigurator.m in Sources */,
 				0DCD605519115D17006B445C /* SNTXPCControlInterface.m in Sources */,
@@ -1497,7 +1512,7 @@
 		};
 		0D260DBA18B68E12002A0B55 /* Debug */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 13A4FE400F3857C0F5831498 /* Pods-LogicTests.debug.xcconfig */;
+			baseConfigurationReference = 4E43227BA5B261FF33141AFC /* Pods-LogicTests.debug.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
 				CLANG_ENABLE_OBJC_ARC = YES;
@@ -1547,7 +1562,7 @@
 		};
 		0D260DBB18B68E12002A0B55 /* Release */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = BE74E23CF5A553E5F02462B9 /* Pods-LogicTests.release.xcconfig */;
+			baseConfigurationReference = 821428941753678DB772D761 /* Pods-LogicTests.release.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
 				CLANG_ENABLE_OBJC_ARC = YES;
@@ -1591,7 +1606,7 @@
 		};
 		0D35BDA718FD71CE00921A21 /* Debug */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 583E60E97931BA83D5273304 /* Pods-santactl.debug.xcconfig */;
+			baseConfigurationReference = 691189054F4E484D030CF831 /* Pods-santactl.debug.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
 				CLANG_ENABLE_MODULES = YES;
@@ -1632,7 +1647,7 @@
 		};
 		0D35BDA818FD71CE00921A21 /* Release */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 54DD0E77B8BE005AFB7E944A /* Pods-santactl.release.xcconfig */;
+			baseConfigurationReference = 2B9F8A80C0F8D34D98135F36 /* Pods-santactl.release.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
 				CLANG_ENABLE_MODULES = YES;
@@ -1667,7 +1682,7 @@
 		};
 		0D385DE4180DE4A900418BC6 /* Debug */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = DE1F4E0329B023976A1BAC19 /* Pods-Santa.debug.xcconfig */;
+			baseConfigurationReference = D227889DF327E7D3532FE00B /* Pods-Santa.debug.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
@@ -1709,7 +1724,7 @@
 		};
 		0D385DE5180DE4A900418BC6 /* Release */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 8D738300867507BD7985972F /* Pods-Santa.release.xcconfig */;
+			baseConfigurationReference = 4D9D2DDDCD92DBB948D38B11 /* Pods-Santa.release.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
@@ -1880,7 +1895,7 @@
 		};
 		0D9A7F481759330500035EB5 /* Debug */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 627BB4EC9917DC20E89D718C /* Pods-santad.debug.xcconfig */;
+			baseConfigurationReference = 95B378553DCD86290341B8E4 /* Pods-santad.debug.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
 				CLANG_ENABLE_OBJC_ARC = YES;
@@ -1909,13 +1924,14 @@
 				INFOPLIST_FILE = "${DERIVED_FILE_DIR}/santad-Info.plist";
 				INSTALL_PATH = "";
 				LIBRARY_SEARCH_PATHS = "$(inherited)";
+				PRODUCT_BUNDLE_IDENTIFIER = "com.google.${PRODUCT_NAME:rfc1034identifier}";
 				PRODUCT_NAME = "$(TARGET_NAME)";
 			};
 			name = Debug;
 		};
 		0D9A7F491759330500035EB5 /* Release */ = {
 			isa = XCBuildConfiguration;
-			baseConfigurationReference = 8003CA1D3E46447BCEA56440 /* Pods-santad.release.xcconfig */;
+			baseConfigurationReference = 7C9CC3CDF2609E78E6A9C601 /* Pods-santad.release.xcconfig */;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
 				CLANG_ENABLE_OBJC_ARC = YES;
@@ -1937,6 +1953,7 @@
 				INFOPLIST_FILE = "${DERIVED_FILE_DIR}/santad-Info.plist";
 				INSTALL_PATH = "";
 				LIBRARY_SEARCH_PATHS = "$(inherited)";
+				PRODUCT_BUNDLE_IDENTIFIER = "com.google.${PRODUCT_NAME:rfc1034identifier}";
 				PRODUCT_NAME = "$(TARGET_NAME)";
 			};
 			name = Release;

Santa.xcodeproj/xcshareddata/xcschemes/All.xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0700"
+   LastUpgradeVersion = "0720"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"
@@ -26,7 +26,8 @@
       buildConfiguration = "Debug"
       selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
       selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
-      shouldUseLaunchSchemeArgsEnv = "YES">
+      shouldUseLaunchSchemeArgsEnv = "YES"
+      codeCoverageEnabled = "YES">
       <Testables>
          <TestableReference
             skipped = "NO">

Santa.xcodeproj/xcshareddata/xcschemes/KernelTests.xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0700"
+   LastUpgradeVersion = "0720"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"

Santa.xcodeproj/xcshareddata/xcschemes/LogicTests.xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0700"
+   LastUpgradeVersion = "0720"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"

Santa.xcodeproj/xcshareddata/xcschemes/Santa.xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0700"
+   LastUpgradeVersion = "0720"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"

Santa.xcodeproj/xcshareddata/xcschemes/santa-driver.xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0700"
+   LastUpgradeVersion = "0720"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"

Santa.xcodeproj/xcshareddata/xcschemes/santactl.xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0700"
+   LastUpgradeVersion = "0720"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"

Santa.xcodeproj/xcshareddata/xcschemes/santad.xcscheme

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "0700"
+   LastUpgradeVersion = "0720"
    version = "1.3">
    <BuildAction
       parallelizeBuildables = "YES"

Source/SantaGUI/Resources/MessageWindow.xib

@@ -424,7 +424,7 @@ DQ
             <connections>
                 <outlet property="initialFirstResponder" destination="kiB-jZ-69S" id="I96-dS-lq5"/>
             </connections>
-            <point key="canvasLocation" x="112.5" y="302.5"/>
+            <point key="canvasLocation" x="302.5" y="304.5"/>
         </window>
     </objects>
     <resources>

Source/SantaGUI/SNTAccessibleTextField.h

@@ -14,7 +14,7 @@
 
 /**
    An NSTextField subclass that provides an accessiblity label equal to:
-   (self.toolTip + self.stringValue) where available. It also sets the 
+   (self.toolTip + self.stringValue) where available. It also sets the
    accessibilityRoleDescription to "label".
 */
 @interface SNTAccessibleTextField : NSTextField

Source/SantaGUI/SNTAppDelegate.m

@@ -37,7 +37,7 @@
   [self setupMenu];
 
   self.configFileWatcher = [[SNTFileWatcher alloc] initWithFilePath:kDefaultConfigFilePath
-                                                            handler:^{
+                                                            handler:^(unsigned long data) {
     [[SNTConfigurator configurator] reloadConfigData];
   }];
 

Source/SantaGUI/SNTMessageWindowController.m

@@ -17,6 +17,7 @@
 #import <SecurityInterface/SFCertificatePanel.h>
 
 #import "MOLCertificate.h"
+#import "SNTBlockMessage.h"
 #import "SNTConfigurator.h"
 #import "SNTFileInfo.h"
 #import "SNTMessageWindow.h"
@@ -111,18 +112,9 @@
 }
 
 - (IBAction)openEventDetails:(id)sender {
-  SNTConfigurator *config = [SNTConfigurator configurator];
-
-  NSString *formatStr = config.eventDetailURL;
-  formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%file_sha%"
-                                                   withString:self.event.fileSHA256];
-  formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%username%"
-                                                   withString:self.event.executingUser];
-  formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%machine_id%"
-                                                   withString:config.machineID];
-
+  NSURL *url = [SNTBlockMessage eventDetailURLForEvent:self.event];
   [self closeWindow:sender];
-  [[NSWorkspace sharedWorkspace] openURL:[NSURL URLWithString:formatStr]];
+  [[NSWorkspace sharedWorkspace] openURL:url];
 }
 
 #pragma mark Generated properties
@@ -150,39 +142,8 @@
 }
 
 - (NSAttributedString *)attributedCustomMessage {
-  NSString *htmlHeader = @"<html><head><style>"
-                         @"body {"
-                         @"  font-family: 'Lucida Grande', 'Helvetica', sans-serif;"
-                         @"  font-size: 13px;"
-                         @"  color: #666;"
-                         @"  text-align: center;"
-                         @"}"
-                         @"</style></head><body>";
-  NSString *htmlFooter = @"</body></html>";
-
-  NSString *message;
-  if (self.customMessage.length) {
-    message = self.customMessage;
-  } else if (self.event.decision == SNTEventStateBlockUnknown) {
-    message = [[SNTConfigurator configurator] unknownBlockMessage];
-    if (!message) {
-      message = @"The following application has been blocked from executing<br />"
-                @"because its trustworthiness cannot be determined.";
-    }
-  } else {
-    message = [[SNTConfigurator configurator] bannedBlockMessage];
-    if (!message) {
-      message = @"The following application has been blocked from executing<br />"
-                @"because it has been deemed malicious.";
-    }
-  }
-
-  NSString *fullHTML = [NSString stringWithFormat:@"%@%@%@", htmlHeader, message, htmlFooter];
-
-  NSData *htmlData = [fullHTML dataUsingEncoding:NSUTF8StringEncoding];
-  NSAttributedString *returnStr = [[NSAttributedString alloc] initWithHTML:htmlData
-                                                        documentAttributes:NULL];
-  return returnStr;
+  return [SNTBlockMessage attributedBlockMessageForEvent:self.event
+                                           customMessage:self.customMessage];
 }
 
 @end

Source/SantaGUI/SNTNotificationManager.m

@@ -14,6 +14,8 @@
 
 #import "SNTNotificationManager.h"
 
+#import "SNTBlockMessage.h"
+#import "SNTConfigurator.h"
 #import "SNTLogging.h"
 #import "SNTStoredEvent.h"
 
@@ -54,6 +56,7 @@ static NSString * const silencedNotificationsKey = @"SilencedNotifications";
 - (void)updateSilenceDate:(NSDate *)date forHash:(NSString *)hash {
   NSUserDefaults *ud = [NSUserDefaults standardUserDefaults];
   NSMutableDictionary *d = [[ud objectForKey:silencedNotificationsKey] mutableCopy];
+  if (!d) d = [NSMutableDictionary dictionary];
   if (date) {
     d[hash] = date;
   } else {
@@ -64,6 +67,30 @@ static NSString * const silencedNotificationsKey = @"SilencedNotifications";
 
 #pragma mark SNTNotifierXPC protocol method
 
+- (void)postClientModeNotification:(SNTClientMode)clientmode {
+  NSUserNotification *un = [[NSUserNotification alloc] init];
+  un.title = @"Santa";
+  un.hasActionButton = NO;
+  NSString *customMsg;
+  switch (clientmode) {
+    case SNTClientModeMonitor:
+      un.informativeText = @"Switching into Monitor mode";
+      customMsg = [[SNTConfigurator configurator] modeNotificationMonitor];
+      customMsg = [SNTBlockMessage stringFromHTML:customMsg];
+      if (customMsg.length) un.informativeText = customMsg;
+      break;
+    case SNTClientModeLockdown:
+      un.informativeText = @"Switching into Lockdown mode";
+      customMsg = [[SNTConfigurator configurator] modeNotificationLockdown];
+      customMsg = [SNTBlockMessage stringFromHTML:customMsg];      
+      if (customMsg.length) un.informativeText = customMsg;
+      break;
+    default:
+      return;
+  }
+  [[NSUserNotificationCenter defaultUserNotificationCenter] deliverNotification:un];
+}
+
 - (void)postBlockNotification:(SNTStoredEvent *)event withCustomMessage:(NSString *)message {
   // See if this binary is already in the list of pending notifications.
   NSPredicate *predicate =

Source/common/SNTBlockMessage.h

@@ -0,0 +1,41 @@
+/// Copyright 2016 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+@class SNTStoredEvent;
+
+@interface SNTBlockMessage : NSObject
+
+///
+///  Return a message suitable for presenting to the user.
+///  Uses either the configured message depending on the event type or a custom message
+///  if the rule that blocked this file included one.
+///
+///  In SantaGUI this will return an NSAttributedString with links and formatting included
+///  while for santad all HTML will be properly stripped.
+///
++ (NSAttributedString *)attributedBlockMessageForEvent:(SNTStoredEvent *)event
+                                         customMessage:(NSString *)customMessage;
+
+///
+///  Return a URL generated from the EventDetailURL configuration key
+///  after replacing templates in the URL with values from the event.
+///
++ (NSURL *)eventDetailURLForEvent:(SNTStoredEvent *)event;
+
+///
+///  Strip HTML from a string, replacing <br /> with newline.
+///
++ (NSString *)stringFromHTML:(NSString *)html;
+
+@end

Source/common/SNTBlockMessage.m

@@ -0,0 +1,128 @@
+/// Copyright 2016 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "SNTBlockMessage.h"
+
+#import "SNTConfigurator.h"
+#import "SNTLogging.h"
+#import "SNTStoredEvent.h"
+
+@implementation SNTBlockMessage
+
++ (NSAttributedString *)attributedBlockMessageForEvent:(SNTStoredEvent *)event
+                                         customMessage:(NSString *)customMessage {
+  NSString *htmlHeader = @"<html><head><style>"
+      @"body {"
+      @"  font-family: 'Lucida Grande', 'Helvetica', sans-serif;"
+      @"  font-size: 13px;"
+      @"  color: #666;"
+      @"  text-align: center;"
+      @"}"
+      @"</style></head><body>";
+  NSString *htmlFooter = @"</body></html>";
+
+  NSString *message;
+  if (customMessage.length) {
+    message = customMessage;
+  } else if (event.decision == SNTEventStateBlockUnknown) {
+    message = [[SNTConfigurator configurator] unknownBlockMessage];
+    if (!message) {
+      message = @"The following application has been blocked from executing<br />"
+                @"because its trustworthiness cannot be determined.";
+    }
+  } else {
+    message = [[SNTConfigurator configurator] bannedBlockMessage];
+    if (!message) {
+      message = @"The following application has been blocked from executing<br />"
+                @"because it has been deemed malicious.";
+    }
+  }
+
+  NSString *fullHTML = [NSString stringWithFormat:@"%@%@%@", htmlHeader, message, htmlFooter];
+
+#ifdef NSAppKitVersionNumber10_0
+  NSData *htmlData = [fullHTML dataUsingEncoding:NSUTF8StringEncoding];
+  return [[NSAttributedString alloc] initWithHTML:htmlData documentAttributes:NULL];
+#else
+  NSString *strippedHTML = [self stringFromHTML:fullHTML];
+  if (!strippedHTML) {
+    return [[NSAttributedString alloc] initWithString:@"This binary has been blocked."];
+  }
+  return [[NSAttributedString alloc] initWithString:strippedHTML];
+#endif
+}
+
++ (NSString *)stringFromHTML:(NSString *)html {
+  NSError *error;
+  NSXMLDocument *xml = [[NSXMLDocument alloc] initWithXMLString:html options:0 error:&error];
+
+  if (!xml && error.code == NSXMLParserEmptyDocumentError) {
+    html = [NSString stringWithFormat:@"<html><body>%@</body></html>", html];
+    xml = [[NSXMLDocument alloc] initWithXMLString:html options:0 error:&error];
+    if (!xml) return html;
+  }
+
+  // Strip any HTML tags out of the message. Also remove any content inside <style> tags and
+  // replace <br> elements with a newline.
+  NSString *stripXslt = @"<?xml version='1.0' encoding='utf-8'?>"
+      @"<xsl:stylesheet version='1.0' xmlns:xsl='http://www.w3.org/1999/XSL/Transform'"
+      @"                              xmlns:xhtml='http://www.w3.org/1999/xhtml'>"
+      @"<xsl:output method='text'/>"
+      @"<xsl:template match='br'><xsl:text>\n</xsl:text></xsl:template>"
+      @"<xsl:template match='style'/>"
+      @"</xsl:stylesheet>";
+  NSData *data = [xml objectByApplyingXSLTString:stripXslt arguments:NULL error:&error];
+  if (error || ![data isKindOfClass:[NSData class]]) {
+    return html;
+  }
+  return [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
+}
+
++ (NSURL *)eventDetailURLForEvent:(SNTStoredEvent *)event {
+  SNTConfigurator *config = [SNTConfigurator configurator];
+
+  NSString *formatStr;
+  if (config.eventDetailBundleURL && event.fileBundleID) {
+    formatStr = config.eventDetailBundleURL;
+  } else {
+    formatStr = config.eventDetailURL;
+  }
+
+  if (!formatStr.length) return nil;
+
+  if (event.fileSHA256) {
+    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%file_sha%"
+                                                     withString:event.fileSHA256];
+  }
+  if (event.executingUser) {
+    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%username%"
+                                                     withString:event.executingUser];
+  }
+  if (config.machineID) {
+    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%machine_id%"
+                                                     withString:config.machineID];
+  }
+  if (event.fileBundleID) {
+    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%bundle_id%"
+                                                     withString:event.fileBundleID];
+  }
+  if (event.fileBundleVersionString) {
+    formatStr = [formatStr stringByReplacingOccurrencesOfString:@"%bundle_ver%"
+                                                     withString:event.fileBundleVersionString];
+  }
+
+  return [NSURL URLWithString:formatStr];
+}
+
+@end

Source/common/SNTCommonEnums.h

@@ -53,7 +53,7 @@ typedef NS_ENUM(NSInteger, SNTEventState) {
   SNTEventStateBlockCertificate = 7,
   SNTEventStateBlockScope = 8,
 
-  SNTEventStateRelatedBinary = 9,
+  SNTEventStateBundleBinary = 9,
 };
 
 typedef NS_ENUM(NSInteger, SNTRuleTableError) {

Source/common/SNTConfigurator.h

@@ -75,18 +75,24 @@ extern NSString *const kDefaultConfigFilePath;
 ///
 ///  When the user gets a block notification, a button can be displayed which will
 ///  take them to a web page with more information about that event.
+///  There are two properties, one for individual binaries and one for binaries that are part
+///  of a bundle. If the latter is not set the former will be used.
+///
 ///  This property contains a kind of format string to be turned into the URL to send them to.
 ///  The following sequences will be replaced in the final URL:
 ///
 ///  %file_sha%    -- SHA-256 of the file that was blocked.
 ///  %machine_id%  -- ID of the machine.
 ///  %username%    -- executing user.
+///  %bundle_id%   -- bundle id of the binary, if applicable.
+///  %bundle_ver%  -- bundle version of the binary, if applicable.
 ///
 ///  @note: This is not an NSURL because the format-string parsing is done elsewhere.
 ///
 ///  If this item isn't set, the Open Event button will not be displayed.
 ///
 @property(readonly, nonatomic) NSString *eventDetailURL;
+@property(readonly, nonatomic) NSString *eventDetailBundleURL;
 
 ///
 ///  Related to the above property, this string represents the text to show on the button.
@@ -106,6 +112,18 @@ extern NSString *const kDefaultConfigFilePath;
 ///
 @property(readonly, nonatomic) NSString *bannedBlockMessage;
 
+///
+///  The notification text to display when the client goes into MONITOR mode.
+///  Defaults to "Switching into Monitor mode"
+///
+@property(readonly, nonatomic) NSString *modeNotificationMonitor;
+
+///
+///  The notification text to display when the client goes into LOCKDOWN mode.
+///  Defaults to "Switching into Lockdown mode"
+///
+@property(readonly, nonatomic) NSString *modeNotificationLockdown;
+
 #pragma mark - Sync Settings
 
 ///

Source/common/SNTConfigurator.m

@@ -44,9 +44,12 @@ static NSString *const kEnablePageZeroProtectionKey = @"EnablePageZeroProtection
 
 static NSString *const kMoreInfoURLKey = @"MoreInfoURL";
 static NSString *const kEventDetailURLKey = @"EventDetailURL";
+static NSString *const kEventDetailBundleURLKey = @"EventDetailBundleURL";
 static NSString *const kEventDetailTextKey = @"EventDetailText";
 static NSString *const kUnknownBlockMessage = @"UnknownBlockMessage";
 static NSString *const kBannedBlockMessage = @"BannedBlockMessage";
+static NSString *const kModeNotificationMonitor = @"ModeNotificationMonitor";
+static NSString *const kModeNotificationLockdown = @"ModeNotificationLockdown";
 
 static NSString *const kSyncBaseURLKey = @"SyncBaseURL";
 static NSString *const kSyncLastSuccess = @"SyncLastSuccess";
@@ -192,6 +195,10 @@ static NSString *const kMachineIDPlistKeyKey = @"MachineIDKey";
   return self.configData[kEventDetailURLKey];
 }
 
+- (NSString *)eventDetailBundleURL {
+  return self.configData[kEventDetailBundleURLKey];
+}
+
 - (NSString *)eventDetailText {
   return self.configData[kEventDetailTextKey];
 }
@@ -204,6 +211,14 @@ static NSString *const kMachineIDPlistKeyKey = @"MachineIDKey";
   return self.configData[kBannedBlockMessage];
 }
 
+- (NSString *)modeNotificationMonitor {
+  return self.configData[kModeNotificationMonitor];
+}
+
+- (NSString *)modeNotificationLockdown {
+  return self.configData[kModeNotificationLockdown];
+}
+
 - (NSURL *)syncBaseURL {
   NSString *urlStr = self.configData[kSyncBaseURLKey];
   if (urlStr) {
@@ -303,7 +318,8 @@ static NSString *const kMachineIDPlistKeyKey = @"MachineIDKey";
                                             options:NSDataReadingMappedIfSafe
                                               error:&error];
   if (error) {
-    LOGE(@"Could not read configuration file: %@", [error localizedDescription]);
+    LOGE(@"Could not read configuration file: %@, replacing.", [error localizedDescription]);
+    [self saveConfigToDisk];
     return;
   }
 
@@ -313,7 +329,8 @@ static NSString *const kMachineIDPlistKeyKey = @"MachineIDKey";
                                                  format:NULL
                                                   error:&error];
   if (error) {
-    LOGE(@"Could not parse configuration file: %@", [error localizedDescription]);
+    LOGE(@"Could not parse configuration file: %@, replacing.", [error localizedDescription]);
+    [self saveConfigToDisk];
     return;
   }
 

Source/common/SNTFileInfo.m

@@ -310,7 +310,8 @@ extern NSString *const NSURLQuarantinePropertiesKey WEAK_IMPORT_ATTRIBUTE;
 }
 
 - (NSString *)bundleName {
-  return [[self.infoPlist objectForKey:@"CFBundleName"] description];
+  return [[self.infoPlist objectForKey:@"CFBundleDisplayName"] description] ?:
+         [[self.infoPlist objectForKey:@"CFBundleName"] description];
 }
 
 - (NSString *)bundleVersion {

Source/common/SNTFileWatcher.h

@@ -14,7 +14,7 @@
 
 ///
 ///  Simple file watching class using dispatch sources. Will automatically
-///  reload the watch if the file is deleted. Will continue watching for
+///  reload the watch if the file is deleted and continue watching for
 ///  events until deallocated.
 ///
 @interface SNTFileWatcher : NSObject
@@ -24,11 +24,11 @@
 ///  Initializes the watcher and begins watching for modifications.
 ///
 ///  @param filePath the file to watch.
-///  @param handler the handler to call when changes happen.
+///  @param handler the handler to call when changes happen. The argument to the block is the
+///      type of change that happened as a bitmask to be compared with DISPATCH_VNODE_* constants.
+///      The handler is always be called on the main thread.
 ///
-///  @note Shortly after the file has been opened and monitoring has begun, the provided handler
-///  will be called.
-///
-- (instancetype)initWithFilePath:(NSString *)filePath handler:(void (^)(void))handler;
+- (nonnull instancetype)initWithFilePath:(nonnull NSString *)filePath
+                                 handler:(nonnull void (^)(unsigned long))handler;
 
 @end

Source/common/SNTFileWatcher.m

@@ -14,13 +14,13 @@
 
 #import "SNTFileWatcher.h"
 
+#import "SNTStrengthify.h"
+
 @interface SNTFileWatcher ()
 @property NSString *filePath;
-@property dispatch_source_t monitoringSource;
+@property(strong) void (^handler)(unsigned long);
 
-@property(strong) void (^eventHandler)(void);
-@property(strong) void (^internalEventHandler)(void);
-@property(strong) void (^internalCancelHandler)(void);
+@property dispatch_source_t source;
 @end
 
 @implementation SNTFileWatcher
@@ -30,15 +30,13 @@
   return nil;
 }
 
-- (instancetype)initWithFilePath:(NSString *)filePath handler:(void (^)(void))handler {
+- (instancetype)initWithFilePath:(nonnull NSString *)filePath
+                         handler:(nonnull void (^)(unsigned long))handler {
   self = [super init];
   if (self) {
     _filePath = filePath;
-    _eventHandler = handler;
-
-    if (!_filePath || !_eventHandler) return nil;
-
-    [self beginWatchingFile];
+    _handler = handler;
+    [self startWatchingFile];
   }
   return self;
 }
@@ -47,57 +45,60 @@
   [self stopWatchingFile];
 }
 
-- (void)beginWatchingFile {
-  __weak __typeof(self) weakSelf = self;
-  int mask = (DISPATCH_VNODE_DELETE | DISPATCH_VNODE_WRITE |
-              DISPATCH_VNODE_EXTEND | DISPATCH_VNODE_RENAME);
+- (void)startWatchingFile {
   dispatch_queue_t queue = dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_BACKGROUND, 0);
+  int mask = (DISPATCH_VNODE_DELETE | DISPATCH_VNODE_RENAME |
+              DISPATCH_VNODE_WRITE | DISPATCH_VNODE_EXTEND | DISPATCH_VNODE_ATTRIB);
 
-  self.internalEventHandler = ^{
-    unsigned long l = dispatch_source_get_data(weakSelf.monitoringSource);
-    if (l & DISPATCH_VNODE_DELETE || l & DISPATCH_VNODE_RENAME) {
-      if (weakSelf.monitoringSource) dispatch_source_cancel(weakSelf.monitoringSource);
-    } else {
-      weakSelf.eventHandler();
+  dispatch_async(queue, ^{
+    int fd = -1;
+    while ((fd = open([self.filePath fileSystemRepresentation], O_EVTONLY)) < 0) {
+      usleep(200000);  // wait 200ms
     }
-  };
+    self.source = dispatch_source_create(DISPATCH_SOURCE_TYPE_VNODE, fd, mask, queue);
 
-  self.internalCancelHandler = ^{
-    int fd;
+    WEAKIFY(self);
 
-    if (weakSelf.monitoringSource) {
-      fd = (int)dispatch_source_get_handle(weakSelf.monitoringSource);
-      close(fd);
-    }
+    dispatch_source_set_event_handler(self.source, ^{
+      STRONGIFY(self);
+      unsigned long data = dispatch_source_get_data(self.source);
+      dispatch_async(dispatch_get_main_queue(), ^{
+        self.handler(data);
+      });
+      if (data & DISPATCH_VNODE_DELETE || data & DISPATCH_VNODE_RENAME) {
+        [self stopWatchingFile];
+        [self startWatchingFile];
+      }
+    });
 
-    const char *filePathCString = [weakSelf.filePath fileSystemRepresentation];
-    while ((fd = open(filePathCString, O_EVTONLY)) < 0) {
-      usleep(1000);
-    }
+    dispatch_source_set_registration_handler(self.source, ^{
+      STRONGIFY(self);
+      dispatch_async(dispatch_get_main_queue(), ^{
+        self.handler(0);
+      });
+    });
 
-    weakSelf.monitoringSource =
-        dispatch_source_create(DISPATCH_SOURCE_TYPE_VNODE, fd, mask, queue);
-    dispatch_source_set_event_handler(weakSelf.monitoringSource, weakSelf.internalEventHandler);
-    dispatch_source_set_cancel_handler(weakSelf.monitoringSource, weakSelf.internalCancelHandler);
-    dispatch_resume(weakSelf.monitoringSource);
-
-    weakSelf.eventHandler();
-  };
-
-  dispatch_async(queue, self.internalCancelHandler);
+    dispatch_source_set_cancel_handler(self.source, ^{
+      STRONGIFY(self);
+      int fd = (int)dispatch_source_get_handle(self.source);
+      if (fd > 0) close(fd);
+    });
+    
+    dispatch_resume(self.source);
+  });
 }
 
 - (void)stopWatchingFile {
-  if (!self.monitoringSource) return;
+  if (!self.source) return;
 
-  int fd = (int)dispatch_source_get_handle(self.monitoringSource);
-  dispatch_source_set_event_handler_f(self.monitoringSource, NULL);
-  dispatch_source_set_cancel_handler(self.monitoringSource, ^{
+  int fd = (int)dispatch_source_get_handle(self.source);
+  dispatch_source_set_event_handler_f(self.source, NULL);
+  dispatch_source_set_cancel_handler(self.source, ^{
     close(fd);
   });
 
-  dispatch_source_cancel(self.monitoringSource);
-  self.monitoringSource = nil;
+  dispatch_source_cancel(self.source);
+  self.source = nil;
 }
 
 @end

Source/common/SNTStoredEvent.h

@@ -35,10 +35,16 @@
 @property NSString *filePath;
 
 ///
-///  If the executed file was part of the bundle, this is the CFBundleName.
+///  If the executed file was part of the bundle, this is the CFBundleDisplayName, if it exists
+///  or the CFBundleName if not.
 ///
 @property NSString *fileBundleName;
 
+///
+///  If the executed file was part of the bundle, this is the path to the bundle.
+///
+@property NSString *fileBundlePath;
+
 ///
 ///  If the executed file was part of the bundle, this is the CFBundleID.
 ///

Source/common/SNTStoredEvent.m

@@ -34,6 +34,7 @@
   ENCODE(self.filePath, @"filePath");
 
   ENCODE(self.fileBundleName, @"fileBundleName");
+  ENCODE(self.fileBundlePath, @"fileBundlePath");
   ENCODE(self.fileBundleID, @"fileBundleID");
   ENCODE(self.fileBundleVersion, @"fileBundleVersion");
   ENCODE(self.fileBundleVersionString, @"fileBundleVersionString");
@@ -64,6 +65,7 @@
     _filePath = DECODE(NSString, @"filePath");
 
     _fileBundleName = DECODE(NSString, @"fileBundleName");
+    _fileBundlePath = DECODE(NSString, @"fileBundlePath");
     _fileBundleID = DECODE(NSString, @"fileBundleID");
     _fileBundleVersion = DECODE(NSString, @"fileBundleVersion");
     _fileBundleVersionString = DECODE(NSString, @"fileBundleVersionString");

Source/common/SNTXPCConnection.m

@@ -45,10 +45,10 @@
 @end
 
 @interface SNTXPCConnection ()
+@property NSXPCInterface *validationInterface;
+
 /// The XPC listener (server only).
 @property NSXPCListener *listenerObject;
-/// Array of accepted connections (server only).
-@property NSMutableArray *acceptedConnections;
 
 /// The current connection object (client only).
 @property NSXPCConnection *currentConnection;
@@ -62,7 +62,8 @@
   self = [super init];
   if (self) {
     _listenerObject = listener;
-    _acceptedConnections = [NSMutableArray array];
+    _validationInterface =
+        [NSXPCInterface interfaceWithProtocol:@protocol(SNTXPCConnectionProtocol)];
   }
   return self;
 }
@@ -76,6 +77,8 @@
   if (self) {
     _currentConnection = [[NSXPCConnection alloc] initWithListenerEndpoint:listener];
     if (!_currentConnection) return nil;
+    _validationInterface =
+        [NSXPCInterface interfaceWithProtocol:@protocol(SNTXPCConnectionProtocol)];
   }
   return self;
 }
@@ -86,6 +89,8 @@
     NSXPCConnectionOptions options = (privileged ? NSXPCConnectionPrivileged : 0);
     _currentConnection = [[NSXPCConnection alloc] initWithMachServiceName:name options:options];
     if (!_currentConnection) return nil;
+    _validationInterface =
+        [NSXPCInterface interfaceWithProtocol:@protocol(SNTXPCConnectionProtocol)];
   }
   return self;
 }
@@ -107,8 +112,7 @@
     // Set-up the connection with the remote interface set to the validation interface,
     // send a message to the listener to finish establishing the connection
     dispatch_semaphore_t sema = dispatch_semaphore_create(0);
-    self.currentConnection.remoteObjectInterface =
-        [NSXPCInterface interfaceWithProtocol:@protocol(SNTXPCConnectionProtocol)];
+    self.currentConnection.remoteObjectInterface = self.validationInterface;
     self.currentConnection.interruptionHandler = self.invalidationHandler;
     self.currentConnection.invalidationHandler = self.invalidationHandler;
     [self.currentConnection resume];
@@ -139,7 +143,6 @@
   // The client passed the code signature check, now we need to resume the listener and
   // return YES so that the client can send the connectWithReply message. Once the client does
   // we reset the connection's exportedInterface and exportedObject.
-
   SNTXPCConnectionInterface *ci = [[SNTXPCConnectionInterface alloc] init];
   WEAKIFY(self);
   WEAKIFY(connection);
@@ -147,25 +150,17 @@
     STRONGIFY(self)
     STRONGIFY(connection);
     [connection suspend];
-    [self.acceptedConnections addObject:connection];
-
-    WEAKIFY(connection);
     connection.invalidationHandler = connection.interruptionHandler = ^{
-      STRONGIFY(connection);
-      [self.acceptedConnections removeObject:connection];
       if (self.invalidationHandler) self.invalidationHandler();
     };
-
     connection.exportedInterface = self.exportedInterface;
     connection.exportedObject = self.exportedObject;
-
     [connection resume];
 
     // The connection is now established.
     if (self.acceptedHandler) self.acceptedHandler();
   };
-  connection.exportedInterface =
-      [NSXPCInterface interfaceWithProtocol:@protocol(SNTXPCConnectionProtocol)];
+  connection.exportedInterface = self.validationInterface;
   connection.exportedObject = ci;
   [connection resume];
 
@@ -173,7 +168,8 @@
 }
 
 - (id)remoteObjectProxy {
-  if (self.currentConnection.remoteObjectInterface) {
+  if (self.currentConnection.remoteObjectInterface &&
+      self.currentConnection.remoteObjectInterface != self.validationInterface) {
     return [self.currentConnection remoteObjectProxyWithErrorHandler:^(NSError *error) {
       [self.currentConnection invalidate];
     }];
@@ -188,10 +184,6 @@
     [self.currentConnection invalidate];
     self.currentConnection = nil;
   } else if (self.listenerObject) {
-    for (NSXPCConnection *conn in self.acceptedConnections) {
-      [conn invalidate];
-    }
-    [self.acceptedConnections removeAllObjects];
     [self.listenerObject invalidate];
   }
 }

Source/common/SNTXPCControlInterface.h

@@ -41,6 +41,8 @@
 - (void)databaseEventForSHA256:(NSString *)sha256 reply:(void (^)(SNTStoredEvent *))reply;
 - (void)databaseEventsPending:(void (^)(NSArray *events))reply;
 - (void)databaseRemoveEventsWithIDs:(NSArray *)ids;
+- (void)databaseBinaryRuleForSHA256:(NSString *)sha256 reply:(void (^)(SNTRule *))reply;
+- (void)databaseCertificateRuleForSHA256:(NSString *)sha256 reply:(void (^)(SNTRule *))reply;
 
 ///
 ///  Config ops
@@ -48,6 +50,8 @@
 - (void)watchdogInfo:(void (^)(uint64_t, uint64_t, double, double))reply;
 - (void)clientMode:(void (^)(SNTClientMode))reply;
 - (void)setClientMode:(SNTClientMode)mode reply:(void (^)())reply;
+- (void)xsrfToken:(void (^)(NSString *))reply;
+- (void)setXsrfToken:(NSString *)token reply:(void (^)())reply;
 - (void)setNextSyncInterval:(uint64_t)seconds reply:(void (^)())reply;
 - (void)setSyncLastSuccess:(NSDate *)date reply:(void (^)())reply;
 - (void)setSyncCleanRequired:(BOOL)cleanReqd reply:(void (^)())reply;

Source/common/SNTXPCNotifierInterface.h

@@ -12,11 +12,14 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
+#import "SNTCommonEnums.h"
+
 @class SNTStoredEvent;
 
 /// Protocol implemented by SantaGUI and utilized by santad
 @protocol SNTNotifierXPC
 - (void)postBlockNotification:(SNTStoredEvent *)event withCustomMessage:(NSString *)message;
+- (void)postClientModeNotification:(SNTClientMode)clientmode;
 @end
 
 @interface SNTXPCNotifierInterface : NSObject

Source/santa-driver/SantaDecisionManager.cc

@@ -365,7 +365,7 @@ santa_action_t SantaDecisionManager::FetchDecision(
     path[0] = '\0';
   }
 
-  auto message = NewMessage();
+  auto message = NewMessage(cred);
   strlcpy(message->path, path, sizeof(message->path));
   message->action = ACTION_REQUEST_BINARY;
   message->vnode_id = vnode_id;
@@ -445,6 +445,9 @@ int SantaDecisionManager::VnodeCallback(const kauth_cred_t cred,
         pidWrapper->pid = proc_pid(proc);
         pidWrapper->ppid = proc_ppid(proc);
         lck_rw_lock_exclusive(vnode_pid_map_lock_);
+        if (vnode_pid_map_->getCount() > 5000) {
+          vnode_pid_map_->flushCollection();
+        }
         vnode_pid_map_->setObject(vnode_str, pidWrapper);
         lck_rw_unlock_exclusive(vnode_pid_map_lock_);
         pidWrapper->release();
@@ -475,7 +478,7 @@ void SantaDecisionManager::FileOpCallback(
       snprintf(vnode_id_str, MAX_VNODE_ID_STR, "%llu", vnode_id);
       CacheCheck(vnode_id_str);
     } else if (action == KAUTH_FILEOP_EXEC) {
-      auto message = NewMessage();
+      auto message = NewMessage(nullptr);
       message->vnode_id = vnode_id;
       message->action = ACTION_NOTIFY_EXEC;
       strlcpy(message->path, path, sizeof(message->path));
@@ -502,7 +505,7 @@ void SantaDecisionManager::FileOpCallback(
   // not useful or made by santad.
   if (proc_selfpid() != client_pid_ &&
       !strprefix(path, "/.") && !strprefix(path, "/dev")) {
-    auto message = NewMessage();
+    auto message = NewMessage(nullptr);
     strlcpy(message->path, path, sizeof(message->path));
     if (new_path) strlcpy(message->newpath, new_path, sizeof(message->newpath));
     proc_name(message->pid, message->pname, sizeof(message->pname));

Source/santa-driver/SantaDecisionManager.h

@@ -222,13 +222,26 @@ class SantaDecisionManager : public OSObject {
 
   ///
   ///  Creates a new santa_message_t with some fields pre-filled.
+  ///  @param credential The kauth_cred_t for this action, if available.
+  ///         If nullptr, will get the credential for the current process.
   ///
-  static inline santa_message_t *NewMessage() {
+  static inline santa_message_t *NewMessage(kauth_cred_t credential) {
+    bool should_release = false;
+    if (credential == nullptr) {
+      credential = kauth_cred_get_with_ref();
+      should_release = true;
+    }
+
     auto message = new santa_message_t;
-    message->uid = kauth_getuid();
-    message->gid = kauth_getgid();
+    message->uid = kauth_cred_getuid(credential);
+    message->gid = kauth_cred_getgid(credential);
     message->pid = proc_selfpid();
     message->ppid = proc_selfppid();
+
+    if (should_release) {
+      kauth_cred_unref(&credential);
+    }
+    
     return message;
   }
 

Source/santactl/Commands/SNTCommandFileInfo.m

@@ -19,6 +19,9 @@
 #import "MOLCertificate.h"
 #import "MOLCodesignChecker.h"
 #import "SNTFileInfo.h"
+#import "SNTRule.h"
+#import "SNTXPCConnection.h"
+#import "SNTXPCControlInterface.h"
 
 @interface SNTCommandFileInfo : NSObject<SNTCommand>
 @end
@@ -100,11 +103,10 @@ REGISTER_COMMAND_NAME(@"fileinfo")
     [self printKey:@"Page Zero" value:@"__PAGEZERO segment missing/bad!"];
   }
 
+  // Code signature state
   NSError *error;
   MOLCodesignChecker *csc = [[MOLCodesignChecker alloc] initWithBinaryPath:filePath error:&error];
-  if (!error) {
-    [self printKey:@"Code-signed" value:@"Yes"];
-  } else {
+  if (error) {
     switch (error.code) {
       case errSecCSUnsigned:
         [self printKey:@"Code-signed" value:@"No"];
@@ -113,7 +115,7 @@ REGISTER_COMMAND_NAME(@"fileinfo")
       case errSecCSStaticCodeChanged:
       case errSecCSSignatureNotVerifiable:
       case errSecCSSignatureUnsupported:
-        [self printKey:@"Code-signed" value:@"Yes, but code/signatured changed/unverifiable"];
+        [self printKey:@"Code-signed" value:@"Yes, but code/signature changed/unverifiable"];
         break;
       case errSecCSResourceDirectoryFailed:
       case errSecCSResourceNotSupported:
@@ -133,12 +135,62 @@ REGISTER_COMMAND_NAME(@"fileinfo")
         break;
       default: {
         NSString *val = [NSString stringWithFormat:@"Yes, but failed to validate (%ld)",
-                                                   error.code];
+                         error.code];
         [self printKey:@"Code-signed" value:val];
         break;
       }
     }
+  } else if (csc.signatureFlags & kSecCodeSignatureAdhoc) {
+    [self printKey:@"Code-signed" value:@"Yes, but ad-hoc"];
+  } else {
+    [self printKey:@"Code-signed" value:@"Yes"];
   }
+
+  // Binary rule state
+  __block SNTRule *r;
+  dispatch_group_t group = dispatch_group_create();
+  dispatch_group_enter(group);
+  [[daemonConn remoteObjectProxy] databaseBinaryRuleForSHA256:sha256 reply:^(SNTRule *rule) {
+    if (rule) r = rule;
+    dispatch_group_leave(group);
+  }];
+  NSString *leafCertSHA = [[csc.certificates firstObject] SHA256];
+  dispatch_group_enter(group);
+  [[daemonConn remoteObjectProxy] databaseCertificateRuleForSHA256:leafCertSHA
+                                                             reply:^(SNTRule *rule) {
+    if (!r && rule) r = rule;
+    dispatch_group_leave(group);
+  }];
+  if (dispatch_group_wait(group, dispatch_time(DISPATCH_TIME_NOW, 1 * NSEC_PER_SEC))) {
+    [self printKey:@"Rule" value:@"Cannot communicate with daemon"];
+  } else {
+    NSString *output;
+    switch (r.state) {
+      case SNTRuleStateWhitelist:
+        output = @"Whitelisted";
+        if (isatty(STDOUT_FILENO)) {
+          output = @"\033[32mWhitelisted\033[0m";
+        }
+        [self printKey:@"Rule" value:output];
+        break;
+      case SNTRuleStateBlacklist:
+      case SNTRuleStateSilentBlacklist:
+        output = @"Blacklisted";
+        if (isatty(STDOUT_FILENO)) {
+          output = @"\033[31mBlacklisted\033[0m";
+        }
+        [self printKey:@"Rule" value:output];
+        break;
+      default:
+        output = @"None";
+        if (isatty(STDOUT_FILENO)) {
+          output = @"\033[33mNone\033[0m";
+        }
+        [self printKey:@"Rule" value:output];
+    }
+  }
+
+  // Signing chain
   if (csc.certificates.count) {
     printf("Signing chain:\n");
 
@@ -168,11 +220,10 @@ REGISTER_COMMAND_NAME(@"fileinfo")
 
 + (NSString *)humanReadableFileType:(SNTFileInfo *)fi {
   if ([fi isScript]) return @"Script";
-  if ([fi isXARArchive]) return @"XAR Archive";
+  if ([fi isExecutable]) return @"Executable";
   if ([fi isDylib]) return @"Dynamic Library";
   if ([fi isKext]) return @"Kernel Extension";
-  if ([fi isFat]) return @"Fat Binary";
-  if ([fi isMachO]) return @"Thin Binary";
+  if ([fi isXARArchive]) return @"XAR Archive";
   if ([fi isDMG]) return @"Disk Image";
   return @"Unknown";
 }

Source/santactl/Commands/SNTCommandFlushCache.m

@@ -23,7 +23,9 @@
 
 @implementation SNTCommandFlushCache
 
+#ifdef DEBUG
 REGISTER_COMMAND_NAME(@"flushcache")
+#endif
 
 + (BOOL)requiresRoot {
   return YES;

Source/santactl/Commands/sync/SNTCommandSync.m

@@ -14,7 +14,8 @@
 
 #import "SNTCommandController.h"
 
-#import "SNTAuthenticatingURLSession.h"
+#import <MOLAuthenticatingURLSession.h>
+
 #import "SNTCommandSyncEventUpload.h"
 #import "SNTCommandSyncLogUpload.h"
 #import "SNTCommandSyncPostflight.h"
@@ -28,8 +29,6 @@
 #import "SNTXPCControlInterface.h"
 
 @interface SNTCommandSync : NSObject<SNTCommand>
-@property NSURLSession *session;
-@property SNTXPCConnection *daemonConn;
 @property SNTCommandSyncState *syncState;
 @end
 
@@ -50,50 +49,73 @@ REGISTER_COMMAND_NAME(@"sync")
 }
 
 + (NSString *)longHelpText {
-  return nil;
+  return (@"If Santa is configured to synchronize with a a server, "
+          @"this is the command used for syncing.\n\n"
+          @"Options:\n"
+          @"  --clean: Perform a clean sync, erasing all existing rules and requesting a"
+          @"           clean sync from the server.");
 }
 
 + (void)runWithArguments:(NSArray *)arguments daemonConnection:(SNTXPCConnection *)daemonConn {
-  SNTConfigurator *config = [SNTConfigurator configurator];
-
   // Ensure we have no privileges
   if (!DropRootPrivileges()) {
     LOGE(@"Failed to drop root privileges. Exiting.");
     exit(1);
   }
 
+  SNTConfigurator *config = [SNTConfigurator configurator];
+
+  SNTCommandSync *s = [[self alloc] init];
+
+  // Gather some data needed during some sync stages
+  s.syncState = [[SNTCommandSyncState alloc] init];
+
+  s.syncState.syncBaseURL = config.syncBaseURL;
+  if (s.syncState.syncBaseURL.absoluteString.length == 0) {
+    LOGE(@"Missing SyncBaseURL. Can't sync without it.");
+    exit(1);
+  } else if (![s.syncState.syncBaseURL.scheme isEqual:@"https"]) {
+    LOGW(@"SyncBaseURL is not over HTTPS!");
+  }
+
+  s.syncState.machineID = config.machineID;
+  if (s.syncState.machineID.length == 0) {
+    LOGE(@"Missing Machine ID. Can't sync without it.");
+    exit(1);
+  }
+
+  s.syncState.machineOwner = config.machineOwner;
+  if (s.syncState.machineOwner.length == 0) {
+    s.syncState.machineOwner = @"";
+    LOGW(@"Missing Machine Owner.");
+  }
+
+  [[daemonConn remoteObjectProxy] xsrfToken:^(NSString *token) {
+    s.syncState.xsrfToken = token;
+  }];
+
   // Dropping root privileges to the 'nobody' user causes the default NSURLCache to throw
   // sandbox errors, which are benign but annoying. This line disables the cache entirely.
   [NSURLCache setSharedURLCache:[[NSURLCache alloc] initWithMemoryCapacity:0
                                                               diskCapacity:0
                                                                   diskPath:nil]];
 
-  SNTCommandSync *s = [[self alloc] init];
-
-  SNTAuthenticatingURLSession *authURLSession = [[SNTAuthenticatingURLSession alloc] init];
 
+  MOLAuthenticatingURLSession *authURLSession = [[MOLAuthenticatingURLSession alloc] init];
   authURLSession.userAgent = @"santactl-sync/";
   NSString *santactlVersion = [[NSBundle mainBundle] objectForInfoDictionaryKey:@"CFBundleVersion"];
   if (santactlVersion) {
     authURLSession.userAgent = [authURLSession.userAgent stringByAppendingString:santactlVersion];
   }
   authURLSession.refusesRedirects = YES;
+  authURLSession.serverHostname = s.syncState.syncBaseURL.host;
+  authURLSession.loggingBlock = ^(NSString *line) {
+    LOGD(@"%@", line);
+  };
 
   // Configure server auth
   if ([config syncServerAuthRootsFile]) {
-    NSError *error = nil;
-
-    NSData *rootsData = [NSData dataWithContentsOfFile:[config syncServerAuthRootsFile]
-                                               options:0
-                                                 error:&error];
-    authURLSession.serverRootsPemData = rootsData;
-
-    if (!rootsData) {
-      LOGE(@"Couldn't open server root certificate file %@ with error: %@.",
-           [config syncServerAuthRootsFile],
-           [error localizedDescription]);
-      exit(1);
-    }
+    authURLSession.serverRootsPemFile = [config syncServerAuthRootsFile];
   } else if ([config syncServerAuthRootsData]) {
     authURLSession.serverRootsPemData = [config syncServerAuthRootsData];
   }
@@ -108,135 +130,108 @@ REGISTER_COMMAND_NAME(@"sync")
     authURLSession.clientCertIssuerCn = [config syncClientAuthCertificateIssuer];
   }
 
-  s.session = [authURLSession session];
-  s.daemonConn = daemonConn;
-
-  // Gather some data needed during some sync stages
-  s.syncState = [[SNTCommandSyncState alloc] init];
-
-  s.syncState.syncBaseURL = config.syncBaseURL;
-  if (!s.syncState.syncBaseURL) {
-    LOGE(@"Missing SyncBaseURL. Can't sync without it.");
-    exit(1);
-  } else if (![s.syncState.syncBaseURL.scheme isEqual:@"https"]) {
-    LOGW(@"SyncBaseURL is not over HTTPS!");
-  }
-  authURLSession.serverHostname = s.syncState.syncBaseURL.host;
-
-  s.syncState.machineID = config.machineID;
-  if ([s.syncState.machineID length] == 0) {
-    LOGE(@"Missing Machine ID. Can't sync without it.");
-    exit(1);
-  }
-
-  s.syncState.machineOwner = config.machineOwner;
-  if ([s.syncState.machineOwner length] == 0) {
-    s.syncState.machineOwner = @"";
-    LOGW(@"Missing Machine Owner.");  
-  }
+  s.syncState.session = [authURLSession session];
+  s.syncState.daemonConn = daemonConn;
 
   if ([arguments containsObject:@"singleevent"]) {
-    NSUInteger idx = [arguments indexOfObject:@"singleevent"];
-    idx++;
+    NSUInteger idx = [arguments indexOfObject:@"singleevent"] + 1;
+    if (idx >= arguments.count) {
+      LOGI(@"singleevent takes an argument");
+      exit(1);
+    }
+
     NSString *obj = arguments[idx];
     if (obj.length != 64) {
       LOGI(@"singleevent passed without SHA-256 as next argument");
       exit(1);
     }
-    [s eventUploadSingleEvent:obj];
+    return [s eventUploadSingleEvent:obj];
   } else {
-    [s preflight];
+    return [s preflight];
   }
 }
 
 - (void)preflight {
-  [SNTCommandSyncPreflight performSyncInSession:self.session
-                                      syncState:self.syncState
-                                     daemonConn:self.daemonConn
-                              completionHandler:^(BOOL success) {
-      if (success) {
-        if (self.syncState.uploadLogURL) {
-          [self logUpload];
-        } else {
-          [self eventUpload];
-        }
-      } else {
-        LOGE(@"Preflight failed, aborting run");
-        exit(1);
-      }
-  }];
+  SNTCommandSyncPreflight *p = [[SNTCommandSyncPreflight alloc] initWithState:self.syncState];
+  if ([p sync]) {
+    LOGD(@"Preflight complete");
+    if (self.syncState.uploadLogURL) {
+      return [self logUpload];
+    } else {
+      return [self eventUpload];
+    }
+  } else {
+    LOGE(@"Preflight failed, aborting run");
+    exit(1);
+  }
 }
 
 - (void)logUpload {
-  [SNTCommandSyncLogUpload performSyncInSession:self.session
-                                      syncState:self.syncState
-                                     daemonConn:self.daemonConn
-                              completionHandler:^(BOOL success) {
-      if (success) {
-      } else {
-        LOGE(@"Log upload failed, continuing anyway");
-      }
-      [self eventUpload];
-
-  }];
+  SNTCommandSyncLogUpload *p = [[SNTCommandSyncLogUpload alloc] initWithState:self.syncState];
+  if ([p sync]) {
+    LOGD(@"Log upload complete");
+  } else {
+    LOGE(@"Log upload failed, continuing anyway");
+  }
+  return [self eventUpload];
 }
 
 - (void)eventUpload {
-  [SNTCommandSyncEventUpload performSyncInSession:self.session
-                                        syncState:self.syncState
-                                       daemonConn:self.daemonConn
-                                completionHandler:^(BOOL success) {
-      if (success) {
-        [self ruleDownload];
-      } else {
-        LOGE(@"Event upload failed, aborting run");
-        exit(1);
-      }
-  }];
+  SNTCommandSyncEventUpload *p = [[SNTCommandSyncEventUpload alloc] initWithState:self.syncState];
+  if ([p sync]) {
+    LOGD(@"Event upload complete");
+    return [self ruleDownload];
+  } else {
+    LOGE(@"Event upload failed, aborting run");
+    exit(1);
+  }
 }
 
 - (void)eventUploadSingleEvent:(NSString *)sha256 {
-  [SNTCommandSyncEventUpload uploadSingleEventWithSHA256:sha256
-                                                 session:self.session
-                                               syncState:self.syncState
-                                              daemonConn:self.daemonConn
-                                       completionHandler:^(BOOL success) {
-      if (success) {
-        exit(0);
-      } else {
-        LOGW(@"Event upload failed");
-        exit(1);
-      }
-  }];
+  SNTCommandSyncEventUpload *p = [[SNTCommandSyncEventUpload alloc] initWithState:self.syncState];
+  if ([p syncSingleEventWithSHA256:sha256]) {
+    LOGD(@"Event upload complete");
+    exit(0);
+  } else {
+    LOGE(@"Event upload failed");
+    exit(1);
+  }
 }
 
 - (void)ruleDownload {
-  [SNTCommandSyncRuleDownload performSyncInSession:self.session
-                                         syncState:self.syncState
-                                        daemonConn:self.daemonConn
-                                 completionHandler:^(BOOL success) {
-      if (success) {
-        [self postflight];
-      } else {
-        LOGE(@"Rule download failed, aborting run");
-        exit(1);
-      }
-  }];
+  SNTCommandSyncRuleDownload *p = [[SNTCommandSyncRuleDownload alloc] initWithState:self.syncState];
+  if ([p sync]) {
+    LOGD(@"Rule download complete");
+    if (self.syncState.bundleBinaryRequests.count) {
+      return [self eventUploadBundleBinaries];
+    }
+    return [self postflight];
+  } else {
+    LOGE(@"Rule download failed, aborting run");
+    exit(1);
+  }
+}
+
+- (void)eventUploadBundleBinaries {
+  SNTCommandSyncEventUpload *p = [[SNTCommandSyncEventUpload alloc] initWithState:self.syncState];
+  if ([p syncBundleEvents]) {
+    LOGD(@"Event Upload bundle binaries complete");
+  } else {
+    LOGW(@"Event Upload bundle binary search failed");
+  }
+  return [self postflight];
 }
 
 - (void)postflight {
-  [SNTCommandSyncPostflight performSyncInSession:self.session
-                                       syncState:self.syncState
-                                      daemonConn:self.daemonConn
-                               completionHandler:^(BOOL success) {
-      if (success) {
-        LOGI(@"Sync completed successfully");
-        exit(0);
-      } else {
-        LOGE(@"Postflight failed");
-        exit(1);
-      }
-  }];
+  SNTCommandSyncPostflight *p = [[SNTCommandSyncPostflight alloc] initWithState:self.syncState];
+  if ([p sync]) {
+    LOGD(@"Postflight complete");
+    LOGI(@"Sync completed successfully");
+    exit(0);
+  } else {
+    LOGE(@"Postflight failed");
+    exit(1);
+  }
 }
 
 @end

Source/santactl/Commands/sync/SNTCommandSyncConstants.h

@@ -12,10 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-extern NSString *const kURLPreflight;
-extern NSString *const kURLEventUpload;
-extern NSString *const kURLRuleDownload;
-extern NSString *const kURLPostflight;
+extern NSString *const kXSRFToken;
 
 extern NSString *const kSerialNumber;
 extern NSString *const kHostname;
@@ -32,6 +29,8 @@ extern NSString *const kClientModeLockdown;
 extern NSString *const kCleanSync;
 extern NSString *const kWhitelistRegex;
 extern NSString *const kBlacklistRegex;
+extern NSString *const kBinaryRuleCount;
+extern NSString *const kCertificateRuleCount;
 
 extern NSString *const kEvents;
 extern NSString *const kFileSHA256;
@@ -49,10 +48,11 @@ extern NSString *const kDecisionBlockBinary;
 extern NSString *const kDecisionBlockCertificate;
 extern NSString *const kDecisionBlockScope;
 extern NSString *const kDecisionUnknown;
-extern NSString *const kDecisionRelatedBinary;
+extern NSString *const kDecisionBundleBinary;
 extern NSString *const kLoggedInUsers;
 extern NSString *const kCurrentSessions;
 extern NSString *const kFileBundleID;
+extern NSString *const kFileBundlePath;
 extern NSString *const kFileBundleName;
 extern NSString *const kFileBundleVersion;
 extern NSString *const kFileBundleShortVersionString;
@@ -70,6 +70,7 @@ extern NSString *const kQuarantineDataURL;
 extern NSString *const kQuarantineRefererURL;
 extern NSString *const kQuarantineTimestamp;
 extern NSString *const kQuarantineAgentBundleID;
+extern NSString *const kEventUploadBundleBinaries;
 
 extern NSString *const kLogUploadField;
 

Source/santactl/Commands/sync/SNTCommandSyncConstants.m

@@ -14,10 +14,7 @@
 
 #import "SNTCommandSyncConstants.h"
 
-NSString *const kURLPreflight = @"preflight/";
-NSString *const kURLEventUpload = @"eventupload/";
-NSString *const kURLRuleDownload = @"ruledownload/";
-NSString *const kURLPostflight = @"postflight/";
+NSString *const kXSRFToken = @"X-XSRF-TOKEN";
 
 NSString *const kSerialNumber = @"serial_num";
 NSString *const kHostname = @"hostname";
@@ -34,6 +31,8 @@ NSString *const kClientModeLockdown = @"LOCKDOWN";
 NSString *const kCleanSync = @"clean_sync";
 NSString *const kWhitelistRegex = @"whitelist_regex";
 NSString *const kBlacklistRegex = @"blacklist_regex";
+NSString *const kBinaryRuleCount = @"binary_rule_count";
+NSString *const kCertificateRuleCount = @"certificate_rule_count";
 
 NSString *const kEvents = @"events";
 NSString *const kFileSHA256 = @"file_sha256";
@@ -51,10 +50,11 @@ NSString *const kDecisionBlockBinary = @"BLOCK_BINARY";
 NSString *const kDecisionBlockCertificate = @"BLOCK_CERTIFICATE";
 NSString *const kDecisionBlockScope = @"BLOCK_SCOPE";
 NSString *const kDecisionUnknown = @"UNKNOWN";
-NSString *const kDecisionRelatedBinary = @"RELATED_BINARY";
+NSString *const kDecisionBundleBinary = @"BUNDLE_BINARY";
 NSString *const kLoggedInUsers = @"logged_in_users";
 NSString *const kCurrentSessions = @"current_sessions";
 NSString *const kFileBundleID = @"file_bundle_id";
+NSString *const kFileBundlePath = @"file_bundle_path";
 NSString *const kFileBundleName = @"file_bundle_name";
 NSString *const kFileBundleVersion = @"file_bundle_version";
 NSString *const kFileBundleShortVersionString = @"file_bundle_version_string";
@@ -72,6 +72,7 @@ NSString *const kQuarantineDataURL = @"quarantine_data_url";
 NSString *const kQuarantineRefererURL = @"quarantine_referer_url";
 NSString *const kQuarantineTimestamp = @"quarantine_timestamp";
 NSString *const kQuarantineAgentBundleID = @"quarantine_agent_bundle_id";
+NSString *const kEventUploadBundleBinaries = @"event_upload_bundle_binaries";
 
 NSString *const kLogUploadField = @"files";
 

Source/santactl/Commands/sync/SNTCommandSyncEventUpload.h

@@ -12,14 +12,12 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-@class SNTCommandSyncState;
-@class SNTXPCConnection;
+#import "SNTCommandSyncStage.h"
 
-@interface SNTCommandSyncLogUpload : NSObject
+@interface SNTCommandSyncEventUpload : SNTCommandSyncStage
 
-+ (void)performSyncInSession:(NSURLSession *)session
-                   syncState:(SNTCommandSyncState *)syncState
-                  daemonConn:(SNTXPCConnection *)daemonConn
-           completionHandler:(void (^)(BOOL success))handler;
+- (BOOL)syncSingleEventWithSHA256:(NSString *)sha256;
+
+- (BOOL)syncBundleEvents;
 
 @end

Source/santactl/Commands/sync/SNTCommandSyncEventUpload.m

@@ -28,124 +28,73 @@
 
 @implementation SNTCommandSyncEventUpload
 
-+ (void)performSyncInSession:(NSURLSession *)session
-                   syncState:(SNTCommandSyncState *)syncState
-                  daemonConn:(SNTXPCConnection *)daemonConn
-           completionHandler:(void (^)(BOOL success))handler {
-  NSURL *url = [NSURL URLWithString:[kURLEventUpload stringByAppendingString:syncState.machineID]
-                      relativeToURL:syncState.syncBaseURL];
-
-  [[daemonConn remoteObjectProxy] databaseEventsPending:^(NSArray *events) {
-    if ([events count] == 0) {
-      handler(YES);
-    } else {
-      [self uploadEventsFromArray:events
-                            toURL:url
-                        inSession:session
-                        batchSize:syncState.eventBatchSize
-                       daemonConn:daemonConn
-                completionHandler:handler];
-    }
-  }];
+- (NSURL *)stageURL {
+  NSString *stageName = [@"eventupload" stringByAppendingFormat:@"/%@", self.syncState.machineID];
+  return [NSURL URLWithString:stageName relativeToURL:self.syncState.syncBaseURL];
 }
 
-+ (void)uploadSingleEventWithSHA256:(NSString *)SHA256
-                            session:(NSURLSession *)session
-                          syncState:(SNTCommandSyncState *)syncState
-                         daemonConn:(SNTXPCConnection *)daemonConn
-                  completionHandler:(void (^)(BOOL success))handler {
-  NSURL *url = [NSURL URLWithString:[kURLEventUpload stringByAppendingString:syncState.machineID]
-                      relativeToURL:syncState.syncBaseURL];
-  [[daemonConn remoteObjectProxy] databaseEventForSHA256:SHA256 reply:^(SNTStoredEvent *event) {
-    if (!event) {
-      handler(YES);
-      return;
+- (BOOL)sync {
+  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
+  [[self.daemonConn remoteObjectProxy] databaseEventsPending:^(NSArray *events) {
+    if (events.count) {
+      [self uploadEvents:events];
     }
-
-    [self uploadEventsFromArray:@[ event ]
-                          toURL:url
-                      inSession:session
-                      batchSize:1
-                     daemonConn:daemonConn
-              completionHandler:handler];
+    dispatch_semaphore_signal(sema);
   }];
+  return (dispatch_semaphore_wait(sema, DISPATCH_TIME_FOREVER) == 0);
 }
 
-+ (void)uploadEventsFromArray:(NSArray *)events
-                        toURL:(NSURL *)url
-                    inSession:(NSURLSession *)session
-                    batchSize:(NSUInteger)batchSize
-                   daemonConn:(SNTXPCConnection *)daemonConn
-            completionHandler:(void (^)(BOOL success))handler {
+- (BOOL)syncSingleEventWithSHA256:(NSString *)sha256 {
+  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
+  [[self.daemonConn remoteObjectProxy] databaseEventForSHA256:sha256 reply:^(SNTStoredEvent *e) {
+    if (e) {
+      [self uploadEvents:@[ e ]];
+    }
+    dispatch_semaphore_signal(sema);
+  }];
+  return (dispatch_semaphore_wait(sema, DISPATCH_TIME_FOREVER) == 0);
+}
+
+- (BOOL)syncBundleEvents {
+  NSMutableArray *newEvents = [NSMutableArray array];
+  for (NSString *bundlePath in self.syncState.bundleBinaryRequests) {
+    [newEvents addObjectsFromArray:[self findRelatedBinaries:bundlePath]];
+  }
+  return [self uploadEvents:newEvents];
+}
+
+- (BOOL)uploadEvents:(NSArray *)events {
   NSMutableArray *uploadEvents = [[NSMutableArray alloc] init];
 
-  NSMutableArray *eventIds = [NSMutableArray arrayWithCapacity:events.count];
+  NSMutableDictionary *eventIds = [NSMutableDictionary dictionaryWithCapacity:events.count];
   for (SNTStoredEvent *event in events) {
     [uploadEvents addObject:[self dictionaryForEvent:event]];
-    [eventIds addObject:event.idx];
-
-    if (event.fileBundleID) {
-      NSArray *relatedBinaries = [self findRelatedBinaries:event];
-      [uploadEvents addObjectsFromArray:relatedBinaries];
-    }
-
-    if (eventIds.count >= batchSize) break;
+    eventIds[event.idx] = @YES;
+    if (uploadEvents.count >= self.syncState.eventBatchSize) break;
   }
 
-  NSDictionary *uploadReq = @{kEvents : uploadEvents};
+  NSDictionary *r = [self performRequest:[self requestWithDictionary:@{ kEvents: uploadEvents }]];
+  if (!r) return NO;
 
-  NSData *requestBody;
-  @try {
-    requestBody = [NSJSONSerialization dataWithJSONObject:uploadReq options:0 error:nil];
-  } @catch (NSException *exception) {
-    LOGE(@"Failed to parse event(s) into JSON");
-    LOGD(@"Parsing error: %@", [exception reason]);
+  // Keep track of bundle search requests
+  self.syncState.bundleBinaryRequests = r[kEventUploadBundleBinaries];
+
+  LOGI(@"Uploaded %lu events", uploadEvents.count);
+
+  // Remove event IDs. For Bundle Events the ID is 0 so nothing happens.
+  [[self.daemonConn remoteObjectProxy] databaseRemoveEventsWithIDs:[eventIds allKeys]];
+
+  // See if there are any events remaining to upload
+  if (uploadEvents.count < events.count) {
+    NSRange nextEventsRange = NSMakeRange(uploadEvents.count, events.count - uploadEvents.count);
+    NSArray *nextEvents = [events subarrayWithRange:nextEventsRange];
+    return [self uploadEvents:nextEvents];
   }
 
-  NSMutableURLRequest *req = [[NSMutableURLRequest alloc] initWithURL:url];
-  [req setHTTPMethod:@"POST"];
-  [req setValue:@"application/json" forHTTPHeaderField:@"Content-Type"];
-
-  NSData *compressed = [requestBody zlibCompressed];
-  if (compressed) {
-    requestBody = compressed;
-    [req setValue:@"zlib" forHTTPHeaderField:@"Content-Encoding"];
-  }
-
-  [req setHTTPBody:requestBody];
-
-  [[session dataTaskWithRequest:req completionHandler:^(NSData *data,
-                                                        NSURLResponse *response,
-                                                        NSError *error) {
-    long statusCode = [(NSHTTPURLResponse *)response statusCode];
-    if (statusCode != 200) {
-      LOGE(@"HTTP Response: %ld %@",
-           statusCode,
-           [[NSHTTPURLResponse localizedStringForStatusCode:statusCode] capitalizedString]);
-      LOGD(@"%@", error);
-      handler(NO);
-    } else {
-      LOGI(@"Uploaded %lu events", eventIds.count);
-
-      [[daemonConn remoteObjectProxy] databaseRemoveEventsWithIDs:eventIds];
-
-      NSArray *nextEvents = [events subarrayWithRange:NSMakeRange(eventIds.count,
-                                                                  events.count - eventIds.count)];
-      if (nextEvents.count == 0) {
-        handler(YES);
-      } else {
-        [self uploadEventsFromArray:nextEvents
-                              toURL:url
-                          inSession:session
-                          batchSize:batchSize
-                         daemonConn:daemonConn
-                  completionHandler:handler];
-      }
-    }
-  }] resume];
+  return YES;
 }
 
-+ (NSDictionary *)dictionaryForEvent:(SNTStoredEvent *)event {
+- (NSDictionary *)dictionaryForEvent:(SNTStoredEvent *)event {
 #define ADDKEY(dict, key, value) if (value) dict[key] = value
   NSMutableDictionary *newEvent = [NSMutableDictionary dictionary];
 
@@ -170,11 +119,12 @@
       ADDKEY(newEvent, kDecision, kDecisionBlockCertificate);
       break;
     case SNTEventStateBlockScope: ADDKEY(newEvent, kDecision, kDecisionBlockScope); break;
-    case SNTEventStateRelatedBinary: ADDKEY(newEvent, kDecision, kDecisionRelatedBinary); break;
+    case SNTEventStateBundleBinary: ADDKEY(newEvent, kDecision, kDecisionBundleBinary); break;
     default: ADDKEY(newEvent, kDecision, kDecisionUnknown);
   }
 
   ADDKEY(newEvent, kFileBundleID, event.fileBundleID);
+  ADDKEY(newEvent, kFileBundlePath, event.fileBundlePath);
   ADDKEY(newEvent, kFileBundleName, event.fileBundleName);
   ADDKEY(newEvent, kFileBundleVersion, event.fileBundleVersion);
   ADDKEY(newEvent, kFileBundleShortVersionString, event.fileBundleVersionString);
@@ -208,26 +158,26 @@
 #undef ADDKEY
 }
 
-+ (NSArray *)findRelatedBinaries:(SNTStoredEvent *)event {
+// Find binaries within a bundle given the bundle's path
+// Searches for 10 minutes, creating new events.
+- (NSArray *)findRelatedBinaries:(NSString *)path {
+  SNTFileInfo *requestedPath = [[SNTFileInfo alloc] initWithPath:path];
+
   // Prevent processing the same bundle twice.
   static NSMutableDictionary *previouslyProcessedBundles;
   static dispatch_once_t onceToken;
   dispatch_once(&onceToken, ^{
     previouslyProcessedBundles = [NSMutableDictionary dictionary];
   });
-  if (previouslyProcessedBundles[event.fileBundleID]) return nil;
-  previouslyProcessedBundles[event.fileBundleID] = @YES;
+  if (previouslyProcessedBundles[requestedPath.bundleIdentifier]) return nil;
+  previouslyProcessedBundles[requestedPath.bundleIdentifier] = @YES;
 
   NSMutableArray *relatedEvents = [NSMutableArray array];
 
   dispatch_semaphore_t sema = dispatch_semaphore_create(0);
   __block BOOL shouldCancel = NO;
   dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_BACKGROUND, 0), ^{
-    SNTFileInfo *originalFile = [[SNTFileInfo alloc] initWithPath:event.filePath];
-    NSString *bundlePath = originalFile.bundlePath;
-    originalFile = nil;  // release originalFile early.
-
-    NSDirectoryEnumerator *dirEnum = [[NSFileManager defaultManager] enumeratorAtPath:bundlePath];
+    NSDirectoryEnumerator *dirEnum = [[NSFileManager defaultManager] enumeratorAtPath:path];
     NSString *file;
 
     while (file = [dirEnum nextObject]) {
@@ -235,21 +185,19 @@
         if (shouldCancel) break;
         if ([dirEnum fileAttributes][NSFileType] != NSFileTypeRegular) continue;
 
-        file = [bundlePath stringByAppendingPathComponent:file];
-
-        // Don't record the binary that triggered this event as a related binary.
-        if ([file isEqual:event.filePath]) continue;
+        file = [path stringByAppendingPathComponent:file];
 
         SNTFileInfo *fi = [[SNTFileInfo alloc] initWithPath:file];
         if (fi.isExecutable) {
           SNTStoredEvent *se = [[SNTStoredEvent alloc] init];
           se.filePath = fi.path;
           se.fileSHA256 = fi.SHA256;
-          se.decision = SNTEventStateRelatedBinary;
-          se.fileBundleID = event.fileBundleID;
-          se.fileBundleName = event.fileBundleName;
-          se.fileBundleVersion = event.fileBundleVersion;
-          se.fileBundleVersionString = event.fileBundleVersionString;
+          se.decision = SNTEventStateBundleBinary;
+          se.fileBundleID = fi.bundleIdentifier;
+          se.fileBundleName = fi.bundleName;
+          se.fileBundlePath = fi.bundlePath;
+          se.fileBundleVersion = fi.bundleVersion;
+          se.fileBundleVersionString = fi.bundleShortVersionString;
 
           MOLCodesignChecker *cs = [[MOLCodesignChecker alloc] initWithBinaryPath:se.filePath];
           se.signingChain = cs.certificates;
@@ -262,11 +210,10 @@
     dispatch_semaphore_signal(sema);
   });
 
-  // Give the search up to 5s per event to run.
-  // This might need tweaking if it seems to slow down syncing or misses too much to be useful.
-  if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, NSEC_PER_SEC * 5))) {
+  // Give the search up to 10m per bundle to run.
+  if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, NSEC_PER_SEC * 600))) {
     shouldCancel = YES;
-    LOGD(@"Timed out while searching for related events. Bundle ID: %@", event.fileBundleID);
+    LOGD(@"Timed out while searching for related events at path %@", path);
   }
 
   return relatedEvents;

Source/santactl/Commands/sync/SNTCommandSyncLogUpload.h

@@ -0,0 +1,18 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "SNTCommandSyncStage.h"
+
+@interface SNTCommandSyncLogUpload : SNTCommandSyncStage
+@end

Source/santactl/Commands/sync/SNTCommandSyncLogUpload.m

@@ -15,49 +15,40 @@
 #import "SNTCommandSyncLogUpload.h"
 
 #import "NSData+Zlib.h"
-
-#include "SNTLogging.h"
-
 #import "SNTCommandSyncConstants.h"
 #import "SNTCommandSyncState.h"
 #import "SNTCommonEnums.h"
+#import "SNTLogging.h"
 
 @implementation SNTCommandSyncLogUpload
 
-+ (void)performSyncInSession:(NSURLSession *)session
-                   syncState:(SNTCommandSyncState *)syncState
-                  daemonConn:(SNTXPCConnection *)daemonConn
-           completionHandler:(void (^)(BOOL success))handler {
-  NSURL *url = syncState.uploadLogURL;
-  NSMutableURLRequest *req = [[NSMutableURLRequest alloc] initWithURL:url];
-  [req setHTTPMethod:@"POST"];
-  NSString *boundary = @"----santa-sync-upload-boundary";
+- (NSString *)stageName {
+  return @"logupload";
+}
 
+- (NSURL *)stageURL {
+  return self.syncState.uploadLogURL;
+}
+
+- (BOOL)sync {
+  NSMutableURLRequest *req = [self requestWithDictionary:nil];
+
+  NSString *boundary = @"----santa-sync-upload-boundary";
   NSString *contentType =
       [NSString stringWithFormat:@"multipart/form-data; charset=UTF-8; boundary=%@", boundary];
   [req setValue:contentType forHTTPHeaderField:@"Content-Type"];
 
   NSArray *logsToUpload = [self logsToUpload];
+  [req setHTTPBody:[self requestBodyWithLogs:logsToUpload andBoundary:boundary]];
 
-  // Upload the logs
-  [[session uploadTaskWithRequest:req
-                         fromData:[self requestBodyWithLogs:logsToUpload andBoundary:boundary]
-                completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) {
-      long statusCode = [(NSHTTPURLResponse *)response statusCode];
-      if (statusCode != 200) {
-        LOGE(@"HTTP Response: %ld %@",
-             statusCode,
-             [[NSHTTPURLResponse localizedStringForStatusCode:statusCode] capitalizedString]);
-        LOGD(@"%@", error);
-        handler(NO);
-      } else {
-        LOGI(@"Uploaded %lu logs", [logsToUpload count]);
-        handler(YES);
-      }
-  }] resume];
+  NSDictionary *d = [self performRequest:req];
+  if (!d) return NO;
+
+  LOGI(@"Uploaded %lu logs", logsToUpload.count);
+  return YES;
 }
 
-+ (NSData *)requestBodyWithLogs:(NSArray *)logsToUpload andBoundary:(NSString *)boundary {
+- (NSData *)requestBodyWithLogs:(NSArray *)logsToUpload andBoundary:(NSString *)boundary {
   // Prepare the body of the request, encoded as a multipart/form-data.
   // Along the way, gzip the individual log files and append .gz to their filenames.
   NSMutableData *reqBody = [[NSMutableData alloc] init];
@@ -80,7 +71,7 @@
   return reqBody;
 }
 
-+ (NSArray *)logsToUpload {
+- (NSArray *)logsToUpload {
   // General logs
   NSMutableArray *logsToUpload = [@[ @"/var/log/santa.log",
                                      @"/var/log/system.log" ] mutableCopy];

Source/santactl/Commands/sync/SNTCommandSyncPostflight.h

@@ -12,14 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-@class SNTCommandSyncState;
-@class SNTXPCConnection;
-
-@interface SNTCommandSyncPostflight : NSObject
-
-+ (void)performSyncInSession:(NSURLSession *)session
-                   syncState:(SNTCommandSyncState *)syncState
-                  daemonConn:(SNTXPCConnection *)daemonConn
-           completionHandler:(void (^)(BOOL success))handler;
+#import "SNTCommandSyncStage.h"
 
+@interface SNTCommandSyncPostflight : SNTCommandSyncStage
 @end

Source/santactl/Commands/sync/SNTCommandSyncPostflight.m

@@ -0,0 +1,82 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "SNTCommandSyncPostflight.h"
+
+#include "SNTLogging.h"
+
+#import "SNTCommandSyncConstants.h"
+#import "SNTCommandSyncState.h"
+#import "SNTXPCConnection.h"
+#import "SNTXPCControlInterface.h"
+
+@implementation SNTCommandSyncPostflight
+
+- (NSURL *)stageURL {
+  NSString *stageName = [@"postflight" stringByAppendingFormat:@"/%@", self.syncState.machineID];
+  return [NSURL URLWithString:stageName relativeToURL:self.syncState.syncBaseURL];
+}
+
+- (BOOL)sync {
+  NSDictionary *r = [self performRequest:[self requestWithDictionary:nil]];
+
+  dispatch_group_t group = dispatch_group_create();
+  void (^replyBlock)() = ^{
+    dispatch_group_leave(group);
+  };
+
+  // Set client mode if it changed
+  if (self.syncState.clientMode) {
+    dispatch_group_enter(group);
+    [[self.daemonConn remoteObjectProxy] setClientMode:self.syncState.clientMode
+                                                 reply:replyBlock];
+  }
+
+  // Update backoff interval
+  NSString *backoffInterval = r[kBackoffInterval];
+  if (backoffInterval) {
+    dispatch_group_enter(group);
+    [[self.daemonConn remoteObjectProxy] setNextSyncInterval:[backoffInterval intValue]
+                                                       reply:replyBlock];
+  }
+
+  // Remove clean sync flag if we did a clean sync
+  if (self.syncState.cleanSync) {
+    dispatch_group_enter(group);
+    [[self.daemonConn remoteObjectProxy] setSyncCleanRequired:NO reply:replyBlock];
+  }
+
+  // Update whitelist/blacklist regexes
+  if (self.syncState.whitelistRegex) {
+    dispatch_group_enter(group);
+    [[self.daemonConn remoteObjectProxy] setWhitelistPathRegex:self.syncState.whitelistRegex
+                                                         reply:replyBlock];
+  }
+  if (self.syncState.blacklistRegex) {
+    dispatch_group_enter(group);
+    [[self.daemonConn remoteObjectProxy] setBlacklistPathRegex:self.syncState.blacklistRegex
+                                                         reply:replyBlock];
+  }
+
+  // Update last sync success
+  dispatch_group_enter(group);
+  [[self.daemonConn remoteObjectProxy] setSyncLastSuccess:[NSDate date] reply:replyBlock];
+
+  // Wait for dispatch group
+  dispatch_group_wait(group, dispatch_time(DISPATCH_TIME_NOW, 5 * NSEC_PER_SEC));
+
+  return YES;
+}
+
+@end

Source/santactl/Commands/sync/SNTCommandSyncPreflight.h

@@ -12,14 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-@class SNTCommandSyncState;
-@class SNTXPCConnection;
-
-@interface SNTCommandSyncPreflight : NSObject
-
-+ (void)performSyncInSession:(NSURLSession *)session
-                   syncState:(SNTCommandSyncState *)syncState
-                  daemonConn:(SNTXPCConnection *)daemonConn
-           completionHandler:(void (^)(BOOL success))handler;
+#import "SNTCommandSyncStage.h"
 
+@interface SNTCommandSyncPreflight : SNTCommandSyncStage
 @end

Source/santactl/Commands/sync/SNTCommandSyncPreflight.m

@@ -0,0 +1,90 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "SNTCommandSyncPreflight.h"
+
+#include "SNTKernelCommon.h"
+#include "SNTLogging.h"
+
+#import "SNTCommandSyncConstants.h"
+#import "SNTCommandSyncState.h"
+#import "SNTConfigurator.h"
+#import "SNTSystemInfo.h"
+#import "SNTXPCConnection.h"
+#import "SNTXPCControlInterface.h"
+
+@implementation SNTCommandSyncPreflight
+
+- (NSURL *)stageURL {
+  NSString *stageName = [@"preflight" stringByAppendingFormat:@"/%@", self.syncState.machineID];
+  return [NSURL URLWithString:stageName relativeToURL:self.syncState.syncBaseURL];
+}
+
+- (BOOL)sync {
+  NSMutableDictionary *requestDict = [NSMutableDictionary dictionary];
+  requestDict[kSerialNumber] = [SNTSystemInfo serialNumber];
+  requestDict[kHostname] = [SNTSystemInfo longHostname];
+  requestDict[kOSVer] = [SNTSystemInfo osVersion];
+  requestDict[kOSBuild] = [SNTSystemInfo osBuild];
+  requestDict[kSantaVer] = [[NSBundle mainBundle] objectForInfoDictionaryKey:@"CFBundleVersion"];  
+  requestDict[kPrimaryUser] = self.syncState.machineOwner;
+
+  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
+  [[self.daemonConn remoteObjectProxy] databaseRuleCounts:^(int64_t binary, int64_t certificate) {
+    requestDict[kBinaryRuleCount] = @(binary);
+    requestDict[kCertificateRuleCount] = @(certificate);
+    dispatch_semaphore_signal(sema);
+  }];
+  dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 2 * NSEC_PER_SEC));
+
+  // If user requested it or we've never had a successful sync, try from a clean slate.
+  if ([[[NSProcessInfo processInfo] arguments] containsObject:@"--clean"] ||
+      [[SNTConfigurator configurator] syncCleanRequired]) {
+    requestDict[kRequestCleanSync] = @YES;
+  }
+
+  NSURLRequest *req = [self requestWithDictionary:requestDict];
+  NSDictionary *resp = [self performRequest:req];
+
+  if (!resp) return NO;
+
+  self.syncState.eventBatchSize = [resp[kBatchSize] intValue];
+  if (self.syncState.eventBatchSize == 0) {
+    self.syncState.eventBatchSize = 50;
+  }
+
+  self.syncState.uploadLogURL = [NSURL URLWithString:resp[kUploadLogsURL]];
+
+  if ([resp[kClientMode] isEqual:kClientModeMonitor]) {
+    self.syncState.clientMode = SNTClientModeMonitor;
+  } else if ([resp[kClientMode] isEqual:kClientModeLockdown]) {
+    self.syncState.clientMode = SNTClientModeLockdown;
+  }
+
+  if ([resp[kWhitelistRegex] isKindOfClass:[NSString class]]) {
+    self.syncState.whitelistRegex = resp[kWhitelistRegex];
+  }
+
+  if ([resp[kBlacklistRegex] isKindOfClass:[NSString class]]) {
+    self.syncState.blacklistRegex = resp[kBlacklistRegex];
+  }
+
+  if ([resp[kCleanSync] boolValue]) {
+    self.syncState.cleanSync = YES;
+  }
+
+  return YES;
+}
+
+@end

Source/santactl/Commands/sync/SNTCommandSyncRuleDownload.h

@@ -12,14 +12,7 @@
 ///    See the License for the specific language governing permissions and
 ///    limitations under the License.
 
-@class SNTCommandSyncState;
-@class SNTXPCConnection;
-
-@interface SNTCommandSyncRuleDownload : NSObject
-
-+ (void)performSyncInSession:(NSURLSession *)session
-                   syncState:(SNTCommandSyncState *)syncState
-                  daemonConn:(SNTXPCConnection *)daemonConn
-           completionHandler:(void (^)(BOOL success))handler;
+#import "SNTCommandSyncStage.h"
 
+@interface SNTCommandSyncRuleDownload : SNTCommandSyncStage
 @end

Source/santactl/Commands/sync/SNTCommandSyncRuleDownload.m

@@ -0,0 +1,111 @@
+/// Copyright 2015 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "SNTCommandSyncRuleDownload.h"
+
+#import "SNTCommandSyncConstants.h"
+#import "SNTCommandSyncState.h"
+#import "SNTRule.h"
+#import "SNTXPCConnection.h"
+#import "SNTXPCControlInterface.h"
+
+#include "SNTLogging.h"
+
+@implementation SNTCommandSyncRuleDownload
+
+- (NSURL *)stageURL {
+  NSString *stageName = [@"ruledownload" stringByAppendingFormat:@"/%@", self.syncState.machineID];
+  return [NSURL URLWithString:stageName relativeToURL:self.syncState.syncBaseURL];
+}
+
+- (BOOL)sync {
+  self.syncState.downloadedRules = [NSMutableArray array];
+  return [self ruleDownloadWithCursor:nil];
+}
+
+- (BOOL)ruleDownloadWithCursor:(NSString *)cursor {
+  NSDictionary *requestDict = (cursor ? @{kCursor : cursor} : @{});
+
+  NSDictionary *resp = [self performRequest:[self requestWithDictionary:requestDict]];
+  if (!resp) return NO;
+
+  for (NSDictionary *rule in resp[kRules]) {
+    SNTRule *r = [self ruleFromDictionary:rule];
+    if (r) [self.syncState.downloadedRules addObject:r];
+  }
+
+  if (resp[kCursor]) {
+    return [self ruleDownloadWithCursor:resp[kCursor]];
+  }
+
+  if (!self.syncState.downloadedRules.count) return YES;
+
+  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
+  __block NSError *error;
+  [[self.daemonConn remoteObjectProxy] databaseRuleAddRules:self.syncState.downloadedRules
+                                                 cleanSlate:self.syncState.cleanSync
+                                                      reply:^(NSError *e) {
+    error = e;
+    dispatch_semaphore_signal(sema);
+  }];
+  dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, 300 * NSEC_PER_SEC));
+
+  if (error) {
+    LOGE(@"Failed to add rule(s) to database: %@", error.localizedDescription);
+    LOGD(@"Failure reason: %@", error.localizedFailureReason);
+    return NO;
+  }
+
+  LOGI(@"Added %lu rules", self.syncState.downloadedRules.count);
+  return YES;
+}
+
+- (SNTRule *)ruleFromDictionary:(NSDictionary *)dict {
+  if (![dict isKindOfClass:[NSDictionary class]]) return nil;
+
+  SNTRule *newRule = [[SNTRule alloc] init];
+  newRule.shasum = dict[kRuleSHA256];
+  if (newRule.shasum.length != 64) return nil;
+
+  NSString *policyString = dict[kRulePolicy];
+  if ([policyString isEqual:kRulePolicyWhitelist]) {
+    newRule.state = SNTRuleStateWhitelist;
+  } else if ([policyString isEqual:kRulePolicyBlacklist]) {
+    newRule.state = SNTRuleStateBlacklist;
+  } else if ([policyString isEqual:kRulePolicySilentBlacklist]) {
+    newRule.state = SNTRuleStateSilentBlacklist;
+  } else if ([policyString isEqual:kRulePolicyRemove]) {
+    newRule.state = SNTRuleStateRemove;
+  } else {
+    return nil;
+  }
+
+  NSString *ruleTypeString = dict[kRuleType];
+  if ([ruleTypeString isEqual:kRuleTypeBinary]) {
+    newRule.type = SNTRuleTypeBinary;
+  } else if ([ruleTypeString isEqual:kRuleTypeCertificate]) {
+    newRule.type = SNTRuleTypeCertificate;
+  } else {
+    return nil;
+  }
+
+  NSString *customMsg = dict[kRuleCustomMsg];
+  if (customMsg.length) {
+    newRule.customMsg = customMsg;
+  }
+
+  return newRule;
+}
+
+@end

Source/santactl/Commands/sync/SNTCommandSyncStage.h

@@ -0,0 +1,72 @@
+/// Copyright 2016 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+@class SNTCommandSyncState;
+@class SNTXPCConnection;
+
+@interface SNTCommandSyncStage : NSObject
+
+@property(readonly, nonnull) NSURLSession *urlSession;
+@property(readonly, nonnull) SNTCommandSyncState *syncState;
+@property(readonly, nonnull) SNTXPCConnection *daemonConn;
+
+/**
+  Initialize this stage. Designated initializer.
+
+  @param syncState A holder for state used across requests
+*/
+- (nullable instancetype)initWithState:(nonnull SNTCommandSyncState *)state NS_DESIGNATED_INITIALIZER;
+
+- (nullable instancetype)init NS_UNAVAILABLE;
+
+/**
+  Performs this sync stage.
+
+  @return YES if sync was successful.
+*/
+- (BOOL)sync;
+
+/**
+  The URL for this stage. 
+ 
+  @return The NSURL for this stage.
+*/
+- (nonnull NSURL *)stageURL;
+
+#pragma mark Internal Helpers
+
+/**
+  Creates an NSMutableURLRequest pointing at the URL for this stage and containing the JSON-encoded
+  data passed in as a dictionary.
+ 
+  @param dictionary The values to POST to the server.
+*/
+- (nullable NSMutableURLRequest *)requestWithDictionary:(nullable NSDictionary *)dictionary;
+
+/**
+  Perform the passed in request and attempt to parse the response as JSON into a dictionary.
+
+  @param request The request to perform
+  @param timeout The number of seconds to allow the request to run before timing out. 
+
+  @return A populated dictionary if the response data was JSON, an empty dictionary if not and nil
+          if the request failed for any reason.
+*/
+- (nullable NSDictionary *)performRequest:(nonnull NSURLRequest *)request
+                                  timeout:(NSTimeInterval)timeout;
+
+/** Convenience version of performRequest:timeout: using a 30s timeout. */
+- (nullable NSDictionary *)performRequest:(nonnull NSURLRequest *)request;
+
+@end

Source/santactl/Commands/sync/SNTCommandSyncStage.m

@@ -0,0 +1,195 @@
+/// Copyright 2016 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import "SNTCommandSyncStage.h"
+
+#import "NSData+Zlib.h"
+#import "SNTCommandSyncConstants.h"
+#import "SNTCommandSyncState.h"
+#import "SNTLogging.h"
+#import "SNTXPCControlInterface.h"
+#import "SNTXPCConnection.h"
+
+@interface SNTCommandSyncStage ()
+
+@property(readwrite) NSURLSession *urlSession;
+@property(readwrite) SNTCommandSyncState *syncState;
+@property(readwrite) SNTXPCConnection *daemonConn;
+
+@end
+
+@implementation SNTCommandSyncStage
+
+- (nullable instancetype)initWithState:(nonnull SNTCommandSyncState *)syncState {
+  self = [super init];
+  if (self) {
+    _syncState = syncState;
+    _urlSession = syncState.session;
+    _daemonConn = syncState.daemonConn;
+  }
+  return self;
+}
+
+- (BOOL)sync {
+  [self doesNotRecognizeSelector:_cmd]; __builtin_unreachable();
+}
+
+- (NSString *)stageURL {
+  [self doesNotRecognizeSelector:_cmd]; __builtin_unreachable();
+}
+
+- (NSMutableURLRequest *)requestWithDictionary:(NSDictionary *)dictionary {
+  NSData *requestBody = [NSData data];
+  if (dictionary) {
+    NSError *error;
+    requestBody = [NSJSONSerialization dataWithJSONObject:dictionary options:0 error:&error];
+    if (error) {
+      LOGD(@"Failed to encode JSON request: %@", error);
+      return nil;
+    }
+  }
+
+  NSMutableURLRequest *req = [[NSMutableURLRequest alloc] initWithURL:[self stageURL]];
+  [req setHTTPMethod:@"POST"];
+  [req setValue:@"application/json" forHTTPHeaderField:@"Content-Type"];
+  [req setValue:self.syncState.xsrfToken forHTTPHeaderField:kXSRFToken];
+
+  NSData *compressed = [requestBody zlibCompressed];
+  if (compressed) {
+    requestBody = compressed;
+    [req setValue:@"zlib" forHTTPHeaderField:@"Content-Encoding"];
+  }
+
+  [req setHTTPBody:requestBody];
+
+  return req;
+}
+
+- (NSDictionary *)performRequest:(NSURLRequest *)request timeout:(NSTimeInterval)timeout {
+  NSHTTPURLResponse *response;
+  NSError *error;
+  NSData *data = [self performRequest:request timeout:timeout response:&response error:&error];
+
+  // If the original request failed, attempt to get a new XSRF token and try again.
+  // Unfortunately some servers cause NSURLSession to return 'client cert required' or
+  // 'could not parse response' when a 403 occurs and SSL cert auth is enabled.
+  if ((response.statusCode == 403 ||
+       error.code == NSURLErrorClientCertificateRequired ||
+       error.code == NSURLErrorCannotParseResponse) &&
+      [self fetchXSRFToken]) {
+    NSMutableURLRequest *mutableRequest = [request mutableCopy];
+    [mutableRequest setValue:self.syncState.xsrfToken forHTTPHeaderField:kXSRFToken];
+    return [self performRequest:mutableRequest timeout:timeout];
+  }
+
+  if (response.statusCode != 200) {
+    long code;
+    NSString *errStr;
+    if (response.statusCode > 0) {
+      code = response.statusCode;
+      errStr = [NSHTTPURLResponse localizedStringForStatusCode:response.statusCode];
+    } else {
+      code = (long)error.code;
+      errStr = error.localizedDescription;
+    }
+    LOGE(@"HTTP Response: %ld %@", code, errStr);
+    return nil;
+  }
+
+  if (data.length == 0) return @{};
+
+  NSDictionary *dict = [NSJSONSerialization JSONObjectWithData:[self stripXssi:data]
+                                                       options:0
+                                                         error:&error];
+  if (error) LOGD(@"Failed to decode JSON response: %@", error);
+
+  return dict ?: @{};
+}
+
+- (NSDictionary *)performRequest:(NSURLRequest *)request {
+  return [self performRequest:request timeout:30];
+}
+
+#pragma mark Internal Helpers
+
+/**
+  Perform a data request and capture the returned data, response and error objects.
+
+  @param request, The request to perform
+  @param timeout, The number of seconds to wait before cancelling the request
+  @param response, Return the response details
+  @param error, Return the error details
+  @returns data, The HTTP body of the response
+*/
+- (NSData *)performRequest:(NSURLRequest *)request
+                   timeout:(NSTimeInterval)timeout
+                  response:(out NSHTTPURLResponse **)response
+                     error:(out NSError **)error {
+  __block NSData *_data;
+  __block NSHTTPURLResponse *_response;
+  __block NSError *_error;
+
+  dispatch_semaphore_t sema = dispatch_semaphore_create(0);
+  NSURLSessionDataTask *task = [self.urlSession dataTaskWithRequest:request
+                                                  completionHandler:^(NSData *data,
+                                                                      NSURLResponse *response,
+                                                                      NSError *error) {
+    if ([response isKindOfClass:[NSHTTPURLResponse class]]) {
+      _response = (NSHTTPURLResponse *)response;
+    }
+    _data = data;
+    _error = error;
+    dispatch_semaphore_signal(sema);
+  }];
+  [task resume];
+
+  if (dispatch_semaphore_wait(sema, dispatch_time(DISPATCH_TIME_NOW, NSEC_PER_SEC * timeout))) {
+    [task cancel];
+  }
+
+  if (response) *response = _response;
+  if (error) *error = _error;
+  return _data;
+}
+
+- (NSData *)stripXssi:(NSData *)data {
+  static const char xssi[3] = { ']', ')', '}' };
+  if (data.length < 3 || strncmp(data.bytes, xssi, 3)) return data;
+  return [data subdataWithRange:NSMakeRange(3, data.length - 3)];
+}
+
+- (BOOL)fetchXSRFToken {
+  __block BOOL success = NO;
+  static dispatch_once_t onceToken;
+  dispatch_once(&onceToken, ^{  // only fetch token once per session
+    NSString *stageName = [@"xsrf" stringByAppendingFormat:@"/%@", self.syncState.machineID];
+    NSURL *u = [NSURL URLWithString:stageName relativeToURL:self.syncState.syncBaseURL];
+    NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:u];
+    [request setHTTPMethod:@"POST"];
+    NSHTTPURLResponse *response;
+    [self performRequest:request timeout:10 response:&response error:NULL];
+    if (response.statusCode == 200) {
+      NSDictionary *headers = [response allHeaderFields];
+      [[self.daemonConn remoteObjectProxy] setXsrfToken:headers[kXSRFToken] reply:^{}];
+      self.syncState.xsrfToken = headers[kXSRFToken];
+      LOGD(@"Retrieved new XSRF token");
+      success = YES;
+    } else {
+      LOGD(@"Failed to retrieve XSRF token");
+    }
+  });
+  return success;
+}
+
+@end

Source/santactl/Commands/sync/SNTCommandSyncState.h

@@ -14,31 +14,46 @@
 
 #import "SNTCommonEnums.h"
 
+@class SNTXPCConnection;
+
 /// An instance of this class is passed to each stage of the sync process for storing data
 /// that might be needed in later stages.
 @interface SNTCommandSyncState : NSObject
 
-/// The base API URL
+/// Configured session to use for requests.
+@property NSURLSession *session;
+
+/// Connection to the daemon control interface.
+@property SNTXPCConnection *daemonConn;
+
+/// The base API URL.
 @property NSURL *syncBaseURL;
 
-/// Machine identifier and owner
+/// An XSRF token to send in the headers with each request.
+@property NSString *xsrfToken;
+
+/// Machine identifier and owner.
 @property(copy) NSString *machineID;
 @property(copy) NSString *machineOwner;
 
-/// Clean sync flag, sent from server. If True, all existing rules
-/// should be deleted before inserting any new rules.
+/// Settings sent from server during preflight that are set during postflight.
+@property SNTClientMode clientMode;
+@property NSString *whitelistRegex;
+@property NSString *blacklistRegex;
+
+/// Clean sync flag, if True, all existing rules should be deleted before inserting any new rules.
 @property BOOL cleanSync;
 
-/// New client mode sent from server
-@property SNTClientMode newClientMode;
+/// Batch size for uploading events.
+@property NSUInteger eventBatchSize;
 
-/// Batch size for uploading events, sent from server
-@property int32_t eventBatchSize;
-
-/// Log upload URL sent from server
+/// Log upload URL sent from server. If set, LogUpload phase needs to happen.
 @property NSURL *uploadLogURL;
 
-/// Rules downloaded from server
+/// Array of bundle paths to find binaries for.
+@property NSArray *bundleBinaryRequests;
+
+/// Rules downloaded from server.
 @property NSMutableArray *downloadedRules;
 
 @end

Source/santactl/SNTCommandController.m

@@ -55,9 +55,12 @@ static NSMutableDictionary *registeredCommands;
 + (NSString *)helpForCommandWithName:(NSString *)commandName {
   Class<SNTCommand> command = registeredCommands[commandName];
   if (command) {
+    NSString *shortHelp = [command shortHelpText];
     NSString *longHelp = [command longHelpText];
     if (longHelp) {
       return [NSString stringWithFormat:@"Help for '%@':\n%@", commandName, longHelp];
+    } else if (shortHelp) {
+      return [NSString stringWithFormat:@"Help for '%@':\n%@", commandName, shortHelp];
     } else {
       return @"This command does not have any help information.";
     }
@@ -65,15 +68,22 @@ static NSMutableDictionary *registeredCommands;
   return nil;
 }
 
-+ (SNTXPCConnection *)connectToDaemon {
++ (SNTXPCConnection *)connectToDaemonRequired:(BOOL)required {
   SNTXPCConnection *daemonConn = [SNTXPCControlInterface configuredConnection];
 
-  daemonConn.invalidationHandler = ^{
-    printf("An error occurred communicating with the daemon, is it running?\n");
-    exit(1);
-  };
+  if (required) {
+    daemonConn.invalidationHandler = ^{
+      printf("An error occurred communicating with the daemon, is it running?\n");
+      exit(1);
+    };
+    [daemonConn resume];
+  } else {
+    dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{
+      [daemonConn resume];
+    });
+  }
+
 
-  [daemonConn resume];
   return daemonConn;
 }
 
@@ -89,11 +99,7 @@ static NSMutableDictionary *registeredCommands;
     exit(2);
   }
 
-  SNTXPCConnection *daemonConn;
-  if ([command requiresDaemonConn]) {
-    daemonConn = [self connectToDaemon];
-  }
-
+  SNTXPCConnection *daemonConn = [self connectToDaemonRequired:[command requiresDaemonConn]];
   [command runWithArguments:arguments daemonConnection:daemonConn];
 
   // The command is responsible for quitting.

Source/santactl/sync/SNTAuthenticatingURLSession.h

@@ -1,84 +0,0 @@
-/// Copyright 2015 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-///
-///  An authenticating NSURLSession, which can do both pinned verification of the SSL server
-///  and handle client certificate authentication from the keychain.
-///
-@interface SNTAuthenticatingURLSession : NSObject<NSURLSessionDelegate>
-
-///
-///  The underlying session. Pass this session to NSURLRequest methods.
-///
-@property(readonly, nonatomic) NSURLSession *session;
-
-///
-///  If set, this is the user-agent to send with requests, otherwise remains the default
-///  CFNetwork-based name.
-///
-@property(copy, nonatomic) NSString *userAgent;
-
-///
-///  If set to YES, this session refuses redirect requests. Defaults to NO.
-///
-@property(nonatomic) BOOL refusesRedirects;
-
-///
-///  If set, the server that we connect to _must_ match this string. Redirects to other
-///  hosts will not be allowed.
-///
-@property(copy, nonatomic) NSString *serverHostname;
-
-///
-///  This should be PEM data containing one or more certificates to use to verify the server's
-///  certificate chain. This will override the trusted roots in the System Roots.
-///
-@property(copy, nonatomic) NSData *serverRootsPemData;
-
-///
-///  If set and client certificate authentication is needed, the pkcs#12 file will be loaded
-///
-@property(copy, nonatomic) NSString *clientCertFile;
-
-///
-///  If set and client certificate authentication is needed, the password being used for
-///  loading the clientCertFile
-///
-@property(copy, nonatomic) NSString *clientCertPassword;
-
-///
-///  If set and client certificate authentication is needed, will search the keychain for a
-///  certificate matching this common name and use that for authentication
-///  @note Not case sensitive
-///  @note If multiple matching certificates are found, the first one is used.
-///  @note If this property is not set and neither is |clientCertIssuerCn|, the allowed issuers
-///  provided by the server will be used to find a matching certificate.
-///
-@property(copy, nonatomic) NSString *clientCertCommonName;
-
-///
-///  If set and client certificate authentication is needed, will search the keychain for a
-///  certificate issued by an issuer with this name and use that for authentication.
-///
-///  @note Not case sensitive
-///  @note If multiple matching certificates are found, the first one is used.
-///  @note If this property is not set and neither is |clientCertCommonName|, the allowed issuers
-///      provided by the server will be used to find a matching certificate.
-///
-@property(copy, nonatomic) NSString *clientCertIssuerCn;
-
-/// Designated initializer
-- (instancetype)initWithSessionConfiguration:(NSURLSessionConfiguration *)configuration;
-
-@end

Source/santactl/sync/SNTAuthenticatingURLSession.m

@@ -1,376 +0,0 @@
-/// Copyright 2015 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#import "SNTAuthenticatingURLSession.h"
-
-#import "MOLCertificate.h"
-#import "SNTDERDecoder.h"
-#import "SNTLogging.h"
-
-@interface SNTAuthenticatingURLSession ()
-@property(readwrite) NSURLSession *session;
-@property NSURLSessionConfiguration *sessionConfig;
-@end
-
-@implementation SNTAuthenticatingURLSession
-
-- (instancetype)initWithSessionConfiguration:(NSURLSessionConfiguration *)configuration {
-  self = [super init];
-  if (self) {
-    _sessionConfig = configuration;
-  }
-  return self;
-}
-
-- (instancetype)init {
-  NSURLSessionConfiguration *config = [NSURLSessionConfiguration ephemeralSessionConfiguration];
-  [config setTLSMinimumSupportedProtocol:kTLSProtocol12];
-  [config setHTTPShouldUsePipelining:YES];
-  return [self initWithSessionConfiguration:config];
-}
-
-#pragma mark Session Fetching
-
-- (NSURLSession *)session {
-  if (!_session) {
-    _session = [NSURLSession sessionWithConfiguration:self.sessionConfig
-                                             delegate:self
-                                        delegateQueue:nil];
-  }
-
-  return _session;
-}
-
-#pragma mark User Agent property
-
-- (NSString *)userAgent {
-  return self.sessionConfig.HTTPAdditionalHeaders[@"User-Agent"];
-}
-
-- (void)setUserAgent:(NSString *)userAgent {
-  NSMutableDictionary *addlHeaders = [self.sessionConfig.HTTPAdditionalHeaders mutableCopy];
-  if (!addlHeaders) addlHeaders = [NSMutableDictionary dictionary];
-  addlHeaders[@"User-Agent"] = userAgent;
-  self.sessionConfig.HTTPAdditionalHeaders = [addlHeaders copy];
-  _session = nil;
-}
-
-#pragma mark NSURLSessionDelegate methods
-
-- (void)URLSession:(NSURLSession *)session
-    didReceiveChallenge:(NSURLAuthenticationChallenge *)challenge
-      completionHandler:(void (^)(NSURLSessionAuthChallengeDisposition disposition,
-                                  NSURLCredential *credential))completionHandler {
-  NSURLProtectionSpace *protectionSpace = challenge.protectionSpace;
-
-  if (challenge.previousFailureCount > 0) {
-    completionHandler(NSURLSessionAuthChallengeCancelAuthenticationChallenge, nil);
-    return;
-  }
-
-  if (self.serverHostname && ![self.serverHostname isEqual:protectionSpace.host]) {
-    completionHandler(NSURLSessionAuthChallengeCancelAuthenticationChallenge, nil);
-    return;
-  }
-
-  if (![protectionSpace.protocol isEqual:NSURLProtectionSpaceHTTPS]) {
-    LOGE(@"%@ is not a secure protocol", protectionSpace.protocol);
-    completionHandler(NSURLSessionAuthChallengeCancelAuthenticationChallenge, nil);
-    return;
-  }
-
-  if (!protectionSpace.receivesCredentialSecurely) {
-    LOGE(@"Secure authentication or protocol cannot be established.");
-    completionHandler(NSURLSessionAuthChallengeCancelAuthenticationChallenge, nil);
-    return;
-  }
-
-  NSString *authMethod = [protectionSpace authenticationMethod];
-
-  if (authMethod == NSURLAuthenticationMethodClientCertificate) {
-    NSURLCredential *cred = [self clientCredentialForProtectionSpace:protectionSpace];
-    if (cred) {
-      completionHandler(NSURLSessionAuthChallengeUseCredential, cred);
-      return;
-    } else {
-      LOGW(@"Server asked for client authentication but no usable client certificate found.");
-      completionHandler(NSURLSessionAuthChallengePerformDefaultHandling, nil);
-      return;
-    }
-  } else if (authMethod == NSURLAuthenticationMethodServerTrust) {
-    NSURLCredential *cred = [self serverCredentialForProtectionSpace:protectionSpace];
-    if (cred) {
-      completionHandler(NSURLSessionAuthChallengeUseCredential, cred);
-      return;
-    } else {
-      LOGE(@"Unable to verify server identity.");
-      completionHandler(NSURLSessionAuthChallengeCancelAuthenticationChallenge, nil);
-      return;
-    }
-  }
-
-  completionHandler(NSURLSessionAuthChallengePerformDefaultHandling, nil);
-}
-
-- (void)URLSession:(NSURLSession *)session
-                          task:(NSURLSessionTask *)task
-    willPerformHTTPRedirection:(NSHTTPURLResponse *)response
-                    newRequest:(NSURLRequest *)request
-             completionHandler:(void (^)(NSURLRequest *))completionHandler {
-  if (self.refusesRedirects) {
-    LOGD(@"Rejected redirection to: %@", request.URL);
-    [task cancel];  // without this, the connection hangs until timeout!?!
-    completionHandler(NULL);
-  } else {
-    completionHandler(request);
-  }
-}
-
-#pragma mark Private Helpers for URLSession:didReceiveChallenge:completionHandler:
-
-///
-///  Handles the process of locating a valid client certificate for authentication.
-///  Operates in one of four modes, depending on the configuration in config.plist
-///
-///  Mode 1: if syncClientAuthCertificateFile is set, use the identity in the pkcs file
-///  Mode 2: if syncClientAuthCertificateCn is set, look for an identity in the keychain with a
-///          matching common name and return it.
-///  Mode 3: if syncClientAuthCertificateIssuer is set, look for an identity in the keychain with a
-///          matching issuer common name and return it.
-///  Mode 4: use the list of issuer details sent down by the server to find an identity in the
-///          keychain.
-///
-///  If a valid identity cannot be found, returns nil.
-///
-- (NSURLCredential *)clientCredentialForProtectionSpace:(NSURLProtectionSpace *)protectionSpace {
-  __block OSStatus err = errSecSuccess;
-  __block SecIdentityRef foundIdentity = NULL;
-
-  if (self.clientCertFile) {
-    foundIdentity = [self identityFromFile:self.clientCertFile password:self.clientCertPassword];
-  } else {
-    CFArrayRef cfResults = NULL;
-    SecItemCopyMatching((__bridge CFDictionaryRef) @{
-      (id)kSecClass : (id)kSecClassCertificate,
-      (id)kSecReturnRef : @YES,
-      (id)kSecMatchLimit : (id)kSecMatchLimitAll
-    }, (CFTypeRef *)&cfResults);
-    NSArray *results = CFBridgingRelease(cfResults);
-
-    NSMutableArray *allCerts = [[MOLCertificate certificatesFromArray:results] mutableCopy];
-
-    if (self.clientCertCommonName) {
-      foundIdentity = [self identityByFilteringArray:allCerts
-                                          commonName:self.clientCertCommonName
-                                    issuerCommonName:nil
-                                   issuerCountryName:nil
-                                       issuerOrgName:nil
-                                       issuerOrgUnit:nil];
-    } else if (self.clientCertIssuerCn) {
-      foundIdentity = [self identityByFilteringArray:allCerts
-                                          commonName:nil
-                                    issuerCommonName:self.clientCertIssuerCn
-                                   issuerCountryName:nil
-                                       issuerOrgName:nil
-                                       issuerOrgUnit:nil];
-    } else {
-      for (NSData *allowedIssuer in protectionSpace.distinguishedNames) {
-        SNTDERDecoder *decoder = [[SNTDERDecoder alloc] initWithData:allowedIssuer];
-
-        if (!decoder) {
-          LOGW(@"Unable to decode allowed distinguished name.");
-          continue;
-        }
-
-        foundIdentity = [self identityByFilteringArray:allCerts
-                                            commonName:nil
-                                      issuerCommonName:decoder.commonName
-                                     issuerCountryName:decoder.countryName
-                                         issuerOrgName:decoder.organizationName
-                                         issuerOrgUnit:decoder.organizationalUnit];
-        if (foundIdentity) break;
-      }
-    }
-  }
-
-  if (foundIdentity) {
-    SecCertificateRef certificate = NULL;
-    err = SecIdentityCopyCertificate(foundIdentity, &certificate);
-    MOLCertificate *clientCert = [[MOLCertificate alloc] initWithSecCertificateRef:certificate];
-    if (certificate) CFRelease(certificate);
-    LOGD(@"Client Trust: Valid client identity %@.", clientCert);
-    NSURLCredential *cred =
-        [NSURLCredential credentialWithIdentity:foundIdentity
-                                   certificates:nil
-                                    persistence:NSURLCredentialPersistenceForSession];
-    return cred;
-  } else {
-    LOGD(@"Client Trust: No valid identity found.");
-    return nil;
-  }
-}
-
-///
-///  Handles the process of evaluating the server's certificate chain.
-///  Operates in one of three modes, depending on the configuration in config.plist
-///
-///  Mode 1: if syncServerAuthRootsData is set, evaluates the server's certificate chain contains
-///          one of the certificates in the PEM data in the config plist.
-///  Mode 2: if syncServerAuthRootsFile is set, evaluates the server's certificate chain contains
-///          one of the certificates in the PEM data in the file specified.
-///  Mode 3: evaluates the server's certificate chain is trusted by the keychain.
-///
-///  If the server's certificate chain does not evaluate for any reason, returns nil.
-///
-- (NSURLCredential *)serverCredentialForProtectionSpace:(NSURLProtectionSpace *)protectionSpace {
-  SecTrustRef serverTrust = protectionSpace.serverTrust;
-  if (serverTrust == NULL) {
-    LOGD(@"Server Trust: No server trust information available");
-    return nil;
-  }
-
-  OSStatus err = errSecSuccess;
-
-  if (self.serverRootsPemData) {
-    NSString *pemStrings = [[NSString alloc] initWithData:self.serverRootsPemData
-                                                 encoding:NSASCIIStringEncoding];
-    NSArray *certs = [MOLCertificate certificatesFromPEM:pemStrings];
-
-    // Make a new array of the SecCertificateRef's from the MOLCertificate's.
-    NSMutableArray *certRefs = [[NSMutableArray alloc] initWithCapacity:certs.count];
-    for (MOLCertificate *cert in certs) {
-      [certRefs addObject:(id)cert.certRef];
-    }
-
-    // Set this array of certs as the anchors to trust.
-    err = SecTrustSetAnchorCertificates(serverTrust, (__bridge CFArrayRef)certRefs);
-    if (err != errSecSuccess) {
-      LOGD(@"Server Trust: Could not set anchor certificates: %d", err);
-      return nil;
-    }
-  }
-
-  // Evaluate the server's cert chain.
-  SecTrustResultType result = kSecTrustResultInvalid;
-  err = SecTrustEvaluate(serverTrust, &result);
-  if (err != errSecSuccess) {
-    LOGD(@"Server Trust: Unable to evaluate certificate chain for server: %d", err);
-    return nil;
-  }
-
-  // Print details about the server's leaf certificate.
-  SecCertificateRef firstCert = SecTrustGetCertificateAtIndex(serverTrust, 0);
-  if (firstCert) {
-    MOLCertificate *cert = [[MOLCertificate alloc] initWithSecCertificateRef:firstCert];
-    LOGD(@"Server Trust: Server leaf cert: %@", cert);
-  }
-
-  // Having a trust level "unspecified" by the user is the usual result, described at
-  // https://developer.apple.com/library/mac/qa/qa1360
-  if (result != kSecTrustResultProceed && result != kSecTrustResultUnspecified) {
-    LOGD(@"Server Trust: Server isn't trusted. SecTrustResultType: %d", result);
-    return nil;
-  }
-
-  return [NSURLCredential credentialForTrust:serverTrust];
-}
-
-/**
-  Given an array of MOLCertificate objects and some properties, filter the array
-  repeatedly until an identity is found that fulfills the signing chain.
- */
-- (SecIdentityRef)identityByFilteringArray:(NSArray *)array
-                                commonName:(NSString *)commonName
-                          issuerCommonName:(NSString *)issuerCommonName
-                         issuerCountryName:(NSString *)issuerCountryName
-                             issuerOrgName:(NSString *)issuerOrgName
-                             issuerOrgUnit:(NSString *)issuerOrgUnit {
-  NSMutableArray *predicates = [NSMutableArray arrayWithCapacity:4];
-
-  if (commonName) {
-    [predicates addObject:[NSPredicate predicateWithFormat:@"SELF.commonName == %@",
-                                                           commonName]];
-  }
-  if (issuerCommonName) {
-    [predicates addObject:[NSPredicate predicateWithFormat:@"SELF.issuerCommonName == %@",
-                                                           issuerCommonName]];
-  }
-  if (issuerCountryName) {
-    [predicates addObject:[NSPredicate predicateWithFormat:@"SELF.issuerCountryName == %@",
-                                                           issuerCountryName]];
-  }
-  if (issuerOrgName) {
-    [predicates addObject:[NSPredicate predicateWithFormat:@"SELF.issuerOrgName == %@",
-                                                           issuerOrgName]];
-  }
-  if (issuerOrgUnit) {
-    [predicates addObject:[NSPredicate predicateWithFormat:@"SELF.issuerOrgUnit == %@",
-                                                           issuerOrgUnit]];
-  }
-
-  NSCompoundPredicate *andPreds = [NSCompoundPredicate andPredicateWithSubpredicates:predicates];
-
-  NSArray *filteredCerts = [array filteredArrayUsingPredicate:andPreds];
-  if (!filteredCerts.count) return NULL;
-
-  for (MOLCertificate *cert in filteredCerts) {
-    SecIdentityRef identityRef = NULL;
-    OSStatus status = SecIdentityCreateWithCertificate(NULL, cert.certRef, &identityRef);
-    if (status == errSecSuccess) {
-      return identityRef;
-    } else {
-      // Avoid infinite recursion from self-signed certs
-      if ((cert.commonName && [cert.commonName isEqual:cert.issuerCommonName]) &&
-          (cert.countryName && [cert.countryName isEqual:cert.issuerCountryName]) &&
-          (cert.orgName && [cert.orgName isEqual:cert.issuerOrgName]) &&
-          (cert.orgUnit && [cert.orgUnit isEqual:cert.issuerOrgUnit])) {
-        continue;
-      }
-
-      return [self identityByFilteringArray:array
-                                 commonName:nil
-                           issuerCommonName:cert.commonName
-                          issuerCountryName:cert.countryName
-                              issuerOrgName:cert.orgName
-                              issuerOrgUnit:cert.orgUnit];
-    }
-  }
-  return NULL;
-}
-
-- (SecIdentityRef)identityFromFile:(NSString *)file password:(NSString *)password {
-  NSError *error;
-  NSData *data = [NSData dataWithContentsOfFile:file options:0 error:&error];
-  if (error) {
-    LOGD(@"Client Trust: Couldn't open client certificate %@: %@",
-         self.clientCertFile,
-         [error localizedDescription]);
-    return nil;
-  }
-
-  NSDictionary *options = (password ? @{(__bridge id)kSecImportExportPassphrase : password} : @{});
-  CFArrayRef cfIdentities;
-  OSStatus err = SecPKCS12Import(
-      (__bridge CFDataRef)data, (__bridge CFDictionaryRef)options, &cfIdentities);
-  NSArray *identities = CFBridgingRelease(cfIdentities);
-
-  if (err != errSecSuccess) {
-    LOGD(@"Client Trust: Couldn't load client certificate %@: %d", self.clientCertFile, err);
-    return nil;
-  }
-
-  return (__bridge SecIdentityRef)identities[0][(__bridge id)kSecImportItemIdentity];
-}
-
-@end

Source/santactl/sync/SNTCommandSyncEventUpload.h

@@ -1,31 +0,0 @@
-/// Copyright 2015 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-@class SNTCommandSyncState;
-@class SNTXPCConnection;
-
-@interface SNTCommandSyncEventUpload : NSObject
-
-+ (void)performSyncInSession:(NSURLSession *)session
-                   syncState:(SNTCommandSyncState *)syncState
-                  daemonConn:(SNTXPCConnection *)daemonConn
-           completionHandler:(void (^)(BOOL success))handler;
-
-+ (void)uploadSingleEventWithSHA256:(NSString *)SHA256
-                            session:(NSURLSession *)session
-                          syncState:(SNTCommandSyncState *)syncState
-                         daemonConn:(SNTXPCConnection *)daemonConn
-                  completionHandler:(void (^)(BOOL success))handler;
-
-@end

Source/santactl/sync/SNTCommandSyncPostflight.m

@@ -1,70 +0,0 @@
-/// Copyright 2015 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#import "SNTCommandSyncPostflight.h"
-
-#include "SNTLogging.h"
-
-#import "SNTCommandSyncConstants.h"
-#import "SNTCommandSyncState.h"
-#import "SNTXPCConnection.h"
-#import "SNTXPCControlInterface.h"
-
-@implementation SNTCommandSyncPostflight
-
-+ (void)performSyncInSession:(NSURLSession *)session
-                   syncState:(SNTCommandSyncState *)syncState
-                  daemonConn:(SNTXPCConnection *)daemonConn
-           completionHandler:(void (^)(BOOL success))handler {
-  NSURL *url = [NSURL URLWithString:[kURLPostflight stringByAppendingString:syncState.machineID]
-                      relativeToURL:syncState.syncBaseURL];
-  NSMutableURLRequest *req = [[NSMutableURLRequest alloc] initWithURL:url];
-  [req setHTTPMethod:@"POST"];
-
-  [[session dataTaskWithRequest:req completionHandler:^(NSData *data,
-                                                        NSURLResponse *response,
-                                                        NSError *error) {
-    long statusCode = [(NSHTTPURLResponse *)response statusCode];
-    if (statusCode != 200) {
-      LOGE(@"HTTP Response: %ld %@",
-           statusCode,
-           [[NSHTTPURLResponse localizedStringForStatusCode:statusCode] capitalizedString]);
-      LOGD(@"%@", error);
-      handler(NO);
-    } else {
-      NSDictionary *r = [NSJSONSerialization JSONObjectWithData:data options:0 error:nil];
-
-      if (syncState.newClientMode) {
-        [[daemonConn remoteObjectProxy] setClientMode:syncState.newClientMode reply:^{}];
-      }
-
-      NSString *backoffInterval = r[kBackoffInterval];
-      if (backoffInterval) {
-        [[daemonConn remoteObjectProxy] setNextSyncInterval:[backoffInterval intValue] reply:^{}];
-      }
-
-      if (syncState.cleanSync) {
-        [[daemonConn remoteObjectProxy] setSyncCleanRequired:NO reply:^{}];
-      }
-
-      // Update last sync success
-      [[daemonConn remoteObjectProxy] setSyncLastSuccess:[NSDate date] reply:^{}];
-
-      handler(YES);
-    }
-  }] resume];
-}
-
-
-@end

Source/santactl/sync/SNTCommandSyncPreflight.m

@@ -1,106 +0,0 @@
-/// Copyright 2015 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#import "SNTCommandSyncPreflight.h"
-
-#include "SNTKernelCommon.h"
-#include "SNTLogging.h"
-
-#import "NSData+Zlib.h"
-#import "SNTCommandSyncConstants.h"
-#import "SNTCommandSyncState.h"
-#import "SNTConfigurator.h"
-#import "SNTSystemInfo.h"
-#import "SNTXPCConnection.h"
-#import "SNTXPCControlInterface.h"
-
-@implementation SNTCommandSyncPreflight
-
-+ (void)performSyncInSession:(NSURLSession *)session
-                   syncState:(SNTCommandSyncState *)syncState
-                  daemonConn:(SNTXPCConnection *)daemonConn
-           completionHandler:(void (^)(BOOL success))handler {
-  NSURL *url = [NSURL URLWithString:[kURLPreflight stringByAppendingString:syncState.machineID]
-                      relativeToURL:syncState.syncBaseURL];
-
-  NSMutableDictionary *requestDict = [NSMutableDictionary dictionary];
-  requestDict[kSerialNumber] = [SNTSystemInfo serialNumber];
-  requestDict[kHostname] = [SNTSystemInfo shortHostname];
-  requestDict[kSantaVer] = [[NSBundle mainBundle] objectForInfoDictionaryKey:@"CFBundleVersion"];
-  requestDict[kOSVer] = [SNTSystemInfo osVersion];
-  requestDict[kOSBuild] = [SNTSystemInfo osBuild];
-  requestDict[kPrimaryUser] = syncState.machineOwner;
-
-  // If user requested it or we've never had a successful sync, try from a clean slate.
-  if ([[[NSProcessInfo processInfo] arguments] containsObject:@"--clean"] ||
-      [[SNTConfigurator configurator] syncCleanRequired]) {
-    requestDict[kRequestCleanSync] = @YES;
-  }
-
-  NSData *requestBody = [NSJSONSerialization dataWithJSONObject:requestDict
-                                                        options:0
-                                                          error:nil];
-
-  NSMutableURLRequest *req = [[NSMutableURLRequest alloc] initWithURL:url];
-  [req setHTTPMethod:@"POST"];
-  [req setValue:@"application/json" forHTTPHeaderField:@"Content-Type"];
-
-  NSData *compressed = [requestBody zlibCompressed];
-  if (compressed) {
-    requestBody = compressed;
-    [req setValue:@"zlib" forHTTPHeaderField:@"Content-Encoding"];
-  }
-
-  [req setHTTPBody:requestBody];
-
-  [[session dataTaskWithRequest:req completionHandler:^(NSData *data,
-                                                        NSURLResponse *response,
-                                                        NSError *error) {
-    long statusCode = [(NSHTTPURLResponse *)response statusCode];
-    if (statusCode != 200) {
-      LOGE(@"HTTP Response: %ld %@",
-           statusCode,
-           [[NSHTTPURLResponse localizedStringForStatusCode:statusCode] capitalizedString]);
-      LOGD(@"%@", error);
-      handler(NO);
-    } else {
-      NSDictionary *r = [NSJSONSerialization JSONObjectWithData:data options:0 error:nil];
-
-      syncState.eventBatchSize = [r[kBatchSize] intValue];
-      syncState.uploadLogURL = [NSURL URLWithString:r[kUploadLogsURL]];
-
-      if ([r[kClientMode] isEqual:kClientModeMonitor]) {
-        syncState.newClientMode = SNTClientModeMonitor;
-      } else if ([r[kClientMode] isEqual:kClientModeLockdown]) {
-        syncState.newClientMode = SNTClientModeLockdown;
-      }
-
-      if ([r[kWhitelistRegex] isKindOfClass:[NSString class]]) {
-        [[daemonConn remoteObjectProxy] setWhitelistPathRegex:r[kWhitelistRegex] reply:^{}];
-      }
-
-      if ([r[kBlacklistRegex] isKindOfClass:[NSString class]]) {
-        [[daemonConn remoteObjectProxy] setBlacklistPathRegex:r[kBlacklistRegex] reply:^{}];
-      }
-
-      if ([r[kCleanSync] boolValue]) {
-        syncState.cleanSync = YES;
-      }
-
-      handler(YES);
-    }
-  }] resume];
-}
-
-@end

Source/santactl/sync/SNTCommandSyncRuleDownload.m

@@ -1,149 +0,0 @@
-/// Copyright 2015 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#import "SNTCommandSyncRuleDownload.h"
-
-#import "SNTCommandSyncConstants.h"
-#import "SNTCommandSyncState.h"
-#import "SNTRule.h"
-#import "SNTXPCConnection.h"
-#import "SNTXPCControlInterface.h"
-
-#include "SNTLogging.h"
-
-@implementation SNTCommandSyncRuleDownload
-
-+ (void)performSyncInSession:(NSURLSession *)session
-                   syncState:(SNTCommandSyncState *)syncState
-                  daemonConn:(SNTXPCConnection *)daemonConn
-           completionHandler:(void (^)(BOOL success))handler {
-  NSURL *url = [NSURL URLWithString:[kURLRuleDownload stringByAppendingString:syncState.machineID]
-                      relativeToURL:syncState.syncBaseURL];
-  [self ruleDownloadWithCursor:nil
-                           url:url
-                       session:session
-                     syncState:syncState
-                    daemonConn:daemonConn
-             completionHandler:handler];
-}
-
-+ (void)ruleDownloadWithCursor:(NSString *)cursor
-                           url:(NSURL *)url
-                       session:(NSURLSession *)session
-                     syncState:(SNTCommandSyncState *)syncState
-                    daemonConn:(SNTXPCConnection *)daemonConn
-             completionHandler:(void (^)(BOOL success))handler {
-  NSDictionary *requestDict = (cursor ? @{kCursor : cursor} : @{});
-
-  if (!syncState.downloadedRules) {
-    syncState.downloadedRules = [NSMutableArray array];
-  }
-
-  NSMutableURLRequest *req = [[NSMutableURLRequest alloc] initWithURL:url];
-  [req setHTTPBody:[NSJSONSerialization dataWithJSONObject:requestDict
-                                                   options:0
-                                                     error:nil]];
-  [req setHTTPMethod:@"POST"];
-  [req setValue:@"application/json" forHTTPHeaderField:@"Content-Type"];
-  [[session dataTaskWithRequest:req completionHandler:^(NSData *data,
-                                                        NSURLResponse *response,
-                                                        NSError *error) {
-    long statusCode = [(NSHTTPURLResponse *)response statusCode];
-    if (statusCode != 200) {
-      LOGE(@"HTTP Response: %ld %@",
-           statusCode,
-           [[NSHTTPURLResponse localizedStringForStatusCode:statusCode] capitalizedString]);
-      LOGD(@"%@", error);
-      handler(NO);
-    } else {
-      NSDictionary *resp = [NSJSONSerialization JSONObjectWithData:data options:0 error:nil];
-      if (!resp) {
-        LOGE(@"Failed to decode server's response");
-        handler(NO);
-        return;
-      }
-
-      NSArray *receivedRules = resp[kRules];
-      for (NSDictionary *rule in receivedRules) {
-        SNTRule *r = [self ruleFromDictionary:rule];
-        if (r) [syncState.downloadedRules addObject:r];
-      }
-
-      if (resp[kCursor]) {
-        [self ruleDownloadWithCursor:resp[kCursor]
-                                 url:url
-                             session:session
-                           syncState:syncState
-                          daemonConn:daemonConn
-                   completionHandler:handler];
-      } else {
-        if (syncState.downloadedRules.count) {
-          [[daemonConn remoteObjectProxy] databaseRuleAddRules:syncState.downloadedRules
-                                                    cleanSlate:syncState.cleanSync
-                                                         reply:^(NSError *error) {
-            if (!error) {
-              LOGI(@"Added %lu rule(s)", syncState.downloadedRules.count);
-              handler(YES);
-            } else {
-              LOGE(@"Failed to add rule(s) to database: %@", error.localizedDescription);
-              LOGD(@"Failure reason: %@", error.localizedFailureReason);
-              handler(NO);
-            }
-          }];
-        } else {
-          handler(YES);
-        }
-      }
-    }
-  }] resume];
-}
-
-+ (SNTRule *)ruleFromDictionary:(NSDictionary *)dict {
-  if (![dict isKindOfClass:[NSDictionary class]]) return nil;
-
-  SNTRule *newRule = [[SNTRule alloc] init];
-  newRule.shasum = dict[kRuleSHA256];
-  if (newRule.shasum.length != 64) return nil;
-
-  NSString *policyString = dict[kRulePolicy];
-  if ([policyString isEqual:kRulePolicyWhitelist]) {
-    newRule.state = SNTRuleStateWhitelist;
-  } else if ([policyString isEqual:kRulePolicyBlacklist]) {
-    newRule.state = SNTRuleStateBlacklist;
-  } else if ([policyString isEqual:kRulePolicySilentBlacklist]) {
-    newRule.state = SNTRuleStateSilentBlacklist;
-  } else if ([policyString isEqual:kRulePolicyRemove]) {
-    newRule.state = SNTRuleStateRemove;
-  } else {
-    return nil;
-  }
-
-  NSString *ruleTypeString = dict[kRuleType];
-  if ([ruleTypeString isEqual:kRuleTypeBinary]) {
-    newRule.type = SNTRuleTypeBinary;
-  } else if ([ruleTypeString isEqual:kRuleTypeCertificate]) {
-    newRule.type = SNTRuleTypeCertificate;
-  } else {
-    return nil;
-  }
-
-  NSString *customMsg = dict[kRuleCustomMsg];
-  if (customMsg.length) {
-    newRule.customMsg = customMsg;
-  }
-
-  return newRule;
-}
-
-@end

Source/santactl/sync/SNTDERDecoder.h

@@ -1,35 +0,0 @@
-/// Copyright 2015 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-///
-/// This is a simple ASN.1 decoder that utilizes Apple's SecAsn1Decode
-/// to parse the @c distinguishedNames property of NSURLProtectionSpace.
-///
-@interface SNTDERDecoder : NSObject
-
-@property(readonly) NSString *commonName;
-@property(readonly) NSString *organizationName;
-@property(readonly) NSString *organizationalUnit;
-@property(readonly) NSString *countryName;
-
-///
-///  Designated initializer.
-///
-///  @param data one of the objects in the
-///      NSURLProtectionSpace.distinguishedNames array
-///  @return nil if decoding fails to find any expected objects
-///
-- (instancetype)initWithData:(NSData *)data;
-
-@end

Source/santactl/sync/SNTDERDecoder.m

@@ -1,217 +0,0 @@
-/// Copyright 2015 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#import "SNTDERDecoder.h"
-
-#import <Security/SecAsn1Coder.h>
-#import <Security/SecAsn1Templates.h>
-
-@interface SNTDERDecoder ()
-@property NSDictionary *decodedObjects;
-@end
-
-@implementation SNTDERDecoder
-
-#pragma mark Init
-
-- (instancetype)initWithData:(NSData *)data {
-  self = [super init];
-  if (self) {
-    if (!data) return nil;
-
-    _decodedObjects = [self decodeData:data];
-    if (!_decodedObjects || [_decodedObjects count] == 0) return nil;
-  }
-  return self;
-}
-
-- (instancetype)init {
-  [self doesNotRecognizeSelector:_cmd];
-  return nil;
-}
-
-- (NSString *)description {
-  return [NSString stringWithFormat:@"/C=%@/O=%@/OU=%@/CN=%@",
-                                    self.countryName,
-                                    self.organizationName,
-                                    self.organizationalUnit,
-                                    self.commonName];
-}
-
-#pragma mark Accessors
-
-- (NSString *)commonName {
-  return self.decodedObjects[(__bridge id)kSecOIDCommonName];
-}
-
-- (NSString *)organizationName {
-  return self.decodedObjects[(__bridge id)kSecOIDOrganizationName];
-}
-
-- (NSString *)organizationalUnit {
-  return self.decodedObjects[(__bridge id)kSecOIDOrganizationalUnitName];
-}
-
-- (NSString *)countryName {
-  return self.decodedObjects[(__bridge id)kSecOIDCountryName];
-}
-
-#pragma mark Private
-
-/**
- * The DER data provided by NSURLProtectionSpace.distinguishedNames looks like
- * this:
- *
- * SEQUENCE {
- *   SET {
- *     SEQUENCE {
- *       OBJECT IDENTIFIER (2 5 4 6)
- *       PrintableString 'US'
- *     }
- *   }
- *   SET {
- *     SEQUENCE {
- *       OBJECT IDENTIFIER (2 5 4 10)
- *       PrintableString 'Megaco Inc'
- *     }
- *   }
- * }
- *
- * This method assumes the passed in data will be in that format. If it isn't,
- * the DER decoding will fail and this method will return nil.
- **/
-- (NSDictionary *)decodeData:(NSData *)data {
-  typedef struct {
-    SecAsn1Oid oid;
-    SecAsn1Item value;
-  } OIDKeyValue;
-
-  static const SecAsn1Template kOIDValueTemplate[] = {
-      {SEC_ASN1_SEQUENCE, 0, NULL, sizeof(OIDKeyValue)},
-      {SEC_ASN1_OBJECT_ID, offsetof(OIDKeyValue, oid), NULL, 0},
-      {SEC_ASN1_ANY_CONTENTS, offsetof(OIDKeyValue, value), NULL, 0},
-      {0, 0, NULL, 0}};
-
-  typedef struct {
-    OIDKeyValue **vals;
-  } OIDKeyValueList;
-
-  static const SecAsn1Template kSetOfOIDValueTemplate[] = {
-      {SEC_ASN1_SET_OF, 0, kOIDValueTemplate, sizeof(OIDKeyValueList)},
-      {0, 0, NULL, 0}};
-
-  typedef struct {
-    OIDKeyValueList **lists;
-  } OIDKeyValueListSeq;
-
-  static const SecAsn1Template kSequenceOfSetOfOIDValueTemplate[] = {
-      {SEC_ASN1_SEQUENCE_OF, 0, kSetOfOIDValueTemplate, sizeof(OIDKeyValueListSeq)},
-      {0, 0, NULL, 0}};
-
-  OSStatus err = errSecSuccess;
-  SecAsn1CoderRef coder;
-
-  err = SecAsn1CoderCreate(&coder);
-  if (err != errSecSuccess) return nil;
-
-  OIDKeyValueListSeq a;
-  err = SecAsn1Decode(coder,
-                      data.bytes,
-                      data.length,
-                      kSequenceOfSetOfOIDValueTemplate,
-                      &a);
-  if (err != errSecSuccess) {
-    SecAsn1CoderRelease(coder);
-    return nil;
-  }
-
-  // The data is decoded but now it's in a number of embedded structs.
-  // Massage that into a nice dictionary of OID->String pairs.
-  NSMutableDictionary *dict = [NSMutableDictionary dictionary];
-  OIDKeyValueList *anAttr;
-  for (NSUInteger i = 0; (anAttr = a.lists[i]); ++i) {
-    OIDKeyValue *keyValue = anAttr->vals[0];
-
-    // Sanity check
-    if (keyValue->value.Length > data.length) {
-      SecAsn1CoderRelease(coder);
-      return nil;
-    }
-
-    // Get the string value. First try creating as a UTF-8 string. If that fails,
-    // fallback to trying as an ASCII string. If it still doesn't work, continue on
-    // to the next value.
-    NSString *valueString;
-    valueString = [[NSString alloc] initWithBytes:keyValue->value.Data
-                                           length:keyValue->value.Length
-                                         encoding:NSUTF8StringEncoding];
-    if (!valueString) {
-      valueString = [[NSString alloc] initWithBytes:keyValue->value.Data
-                                             length:keyValue->value.Length
-                                           encoding:NSASCIIStringEncoding];
-    }
-    if (!valueString) continue;
-
-    // The OID is still encoded, so we need to decode it.
-    NSString *objectId = [SNTDERDecoder decodeOIDWithBytes:keyValue->oid.Data
-                                                    length:keyValue->oid.Length];
-
-    // Add to the dictionary
-    dict[objectId] = valueString;
-  }
-
-  SecAsn1CoderRelease(coder);
-  return dict;
-}
-
-/**
- * Decodes an ASN.1 Object Identifier into a string separated by periods.
- * See http://msdn.microsoft.com/en-us/library/bb540809(v=vs.85).aspx for
- * details of the encoding.
- **/
-+ (NSString *)decodeOIDWithBytes:(unsigned char *)bytes length:(NSUInteger)length {
-  NSMutableArray *objectId = [NSMutableArray array];
-  BOOL inVariableLengthByte = NO;
-  NSUInteger variableLength = 0;
-  for (NSUInteger i = 0; i < length; ++i) {
-    if (i == 0) {
-      // The first byte is actually two values, the top 4 bits are the first value * 40
-      // and the bottom 4 bits are the second value.
-      [objectId addObject:@((NSUInteger)bytes[i] / 40)];
-      [objectId addObject:@((NSUInteger)bytes[i] % 40)];
-    } else {
-      // The remaining bytes are encoded with Variable Length Quantity.
-      unsigned char byte = bytes[i];
-      if (byte & 0x80) {
-        inVariableLengthByte = YES;
-
-        NSUInteger a = (NSUInteger)(byte & ~0x80);
-        variableLength = variableLength << 7;
-        variableLength += a;
-      } else if (inVariableLengthByte) {
-        NSUInteger a = (NSUInteger)(byte & ~0x80);
-        variableLength = variableLength << 7;
-        variableLength += a;
-        inVariableLengthByte = NO;
-        [objectId addObject:@(variableLength)];
-        variableLength = 0;
-      } else {
-        [objectId addObject:@((NSUInteger)byte)];
-      }
-    }
-  }
-  return [objectId componentsJoinedByString:@"."];
-}
-
-@end

Source/santad/DataLayer/SNTRuleTable.m

@@ -29,7 +29,7 @@
 
 - (uint32_t)initializeDatabase:(FMDatabase *)db fromVersion:(uint32_t)version {
   // Lock this database from other processes
-  [db executeQuery:@"PRAGMA locking_mode = EXCLUSIVE;"];
+  [[db executeQuery:@"PRAGMA locking_mode = EXCLUSIVE;"] close];
 
   uint32_t newVersion = 0;
 

Source/santad/SNTApplication.m

@@ -14,6 +14,7 @@
 
 #import "SNTApplication.h"
 
+#import <DiskArbitration/DiskArbitration.h>
 #include <sys/stat.h>
 #include <sys/types.h>
 
@@ -33,6 +34,7 @@
 #import "SNTXPCControlInterface.h"
 
 @interface SNTApplication ()
+@property DASessionRef diskArbSession;
 @property SNTDriverManager *driverManager;
 @property SNTEventLog *eventLog;
 @property SNTExecutionController *execController;
@@ -78,12 +80,34 @@
     _controlConnection.exportedObject = dc;
     [_controlConnection resume];
 
-    _configFileWatcher = [[SNTFileWatcher alloc] initWithFilePath:kDefaultConfigFilePath handler:^{
-      [[SNTConfigurator configurator] reloadConfigData];
+    __block SNTClientMode origMode = [[SNTConfigurator configurator] clientMode];
+    _configFileWatcher = [[SNTFileWatcher alloc] initWithFilePath:kDefaultConfigFilePath
+                                                          handler:^(unsigned long data) {
+      if (data & DISPATCH_VNODE_ATTRIB) {
+        const char *cPath = [kDefaultConfigFilePath fileSystemRepresentation];
+        struct stat fileStat;
+        stat(cPath, &fileStat);
+        int mask = S_IRWXU | S_IRWXG | S_IRWXO;
+        int desired = S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH;
+        if (fileStat.st_uid != 0 || fileStat.st_gid != 0 || (fileStat.st_mode & mask) != desired) {
+          LOGD(@"Config file permissions changed, fixing.");
+          chown(cPath, 0, 0);
+          chmod(cPath, desired);
+        }
+      } else {
+        LOGD(@"Config file changed, reloading.");
+        [[SNTConfigurator configurator] reloadConfigData];
 
-      // Ensure config file remains root:wheel 0644
-      chown([kDefaultConfigFilePath fileSystemRepresentation], 0, 0);
-      chmod([kDefaultConfigFilePath fileSystemRepresentation], 0644);
+        // Flush cache if client just went into lockdown.
+        SNTClientMode newMode = [[SNTConfigurator configurator] clientMode];
+        if (origMode != newMode) {
+          origMode = newMode;
+          if (newMode == SNTClientModeLockdown) {
+            LOGI(@"Changed client mode, flushing cache.");
+            [self.driverManager flushCache];
+          }
+        }
+      }
     }];
 
     _eventLog = [[SNTEventLog alloc] init];
@@ -105,6 +129,7 @@
 
   [self performSelectorInBackground:@selector(beginListeningForDecisionRequests) withObject:nil];
   [self performSelectorInBackground:@selector(beginListeningForLogRequests) withObject:nil];
+  [self performSelectorInBackground:@selector(beginListeningForDiskMounts) withObject:nil];
 }
 
 - (void)beginListeningForDecisionRequests {
@@ -171,4 +196,38 @@
   }];
 }
 
+- (void)beginListeningForDiskMounts {
+  dispatch_queue_t disk_queue = dispatch_queue_create(
+      "com.google.santad.disk_queue", DISPATCH_QUEUE_SERIAL);
+
+  _diskArbSession = DASessionCreate(NULL);
+  DASessionSetDispatchQueue(_diskArbSession, disk_queue);
+
+  DARegisterDiskAppearedCallback(
+      _diskArbSession, NULL, diskAppearedCallback, (__bridge void *)self);
+  DARegisterDiskDescriptionChangedCallback(
+      _diskArbSession, NULL, NULL, diskDescriptionChangedCallback, (__bridge void *)self);
+  DARegisterDiskDisappearedCallback(
+      _diskArbSession, NULL, diskDisappearedCallback, (__bridge void *)self);
+}
+
+void diskAppearedCallback(DADiskRef disk, void *context) {
+  SNTApplication *app = (__bridge SNTApplication *)context;
+  NSDictionary *props = CFBridgingRelease(DADiskCopyDescription(disk));
+  [app.eventLog logDiskAppeared:props];
+}
+
+void diskDescriptionChangedCallback(DADiskRef disk, CFArrayRef keys, void *context) {
+  SNTApplication *app = (__bridge SNTApplication *)context;
+  NSDictionary *props = CFBridgingRelease(DADiskCopyDescription(disk));
+  if (props[@"DAVolumePath"]) [app.eventLog logDiskAppeared:props];
+}
+
+void diskDisappearedCallback(DADiskRef disk, void *context) {
+  SNTApplication *app = (__bridge SNTApplication *)context;
+  NSDictionary *props = CFBridgingRelease(DADiskCopyDescription(disk));
+  [app.eventLog logDiskDisappeared:props];
+}
+
+
 @end

Source/santad/SNTDaemonControlController.m

@@ -33,6 +33,7 @@ double watchdogCPUPeak = 0;
 double watchdogRAMPeak = 0;
 
 @interface SNTDaemonControlController ()
+@property NSString *_syncXsrfToken;
 @property dispatch_source_t syncTimer;
 @end
 
@@ -129,6 +130,14 @@ double watchdogRAMPeak = 0;
   [[SNTDatabaseController eventTable] deleteEventsWithIds:ids];
 }
 
+- (void)databaseBinaryRuleForSHA256:(NSString *)sha256 reply:(void (^)(SNTRule *))reply {
+  reply([[SNTDatabaseController ruleTable] binaryRuleForSHA256:sha256]);
+}
+
+- (void)databaseCertificateRuleForSHA256:(NSString *)sha256 reply:(void (^)(SNTRule *))reply {
+  reply([[SNTDatabaseController ruleTable] certificateRuleForSHA256:sha256]);
+}
+
 #pragma mark Config Ops
 
 - (void)clientMode:(void (^)(SNTClientMode))reply {
@@ -136,7 +145,19 @@ double watchdogRAMPeak = 0;
 }
 
 - (void)setClientMode:(SNTClientMode)mode reply:(void (^)())reply {
-  [[SNTConfigurator configurator] setClientMode:mode];
+  if ([[SNTConfigurator configurator] clientMode] != mode) {
+    [[SNTConfigurator configurator] setClientMode:mode];
+    [[self.notQueue.notifierConnection remoteObjectProxy] postClientModeNotification:mode];
+  }
+  reply();
+}
+
+- (void)xsrfToken:(void (^)(NSString *))reply {
+  reply(self._syncXsrfToken);
+}
+
+- (void)setXsrfToken:(NSString *)token reply:(void (^)())reply {
+  self._syncXsrfToken = token;
   reply();
 }
 

Source/santad/SNTEventLog.h

@@ -21,6 +21,9 @@
 ///
 @interface SNTEventLog : NSObject
 
+- (void)logDiskAppeared:(NSDictionary *)diskProperties;
+- (void)logDiskDisappeared:(NSDictionary *)diskProperties;
+
 - (void)logFileModification:(santa_message_t)message;
 
 - (void)saveDecisionDetails:(SNTCachedDecision *)cd;

Source/santad/SNTEventLog.m

@@ -195,6 +195,43 @@
   LOGI(@"%@", outLog);
 }
 
+- (void)logDiskAppeared:(NSDictionary *)diskProperties {
+  if (![diskProperties[@"DAVolumeMountable"] boolValue]) return;
+
+  NSString *dmgPath = @"";
+  NSString *serial = @"";
+  if ([diskProperties[@"DADeviceModel"] isEqual:@"Disk Image"]) {
+    dmgPath = [self diskImageForDevice:diskProperties[@"DADevicePath"]];
+  } else {
+    serial = [self serialForDevice:diskProperties[@"DADevicePath"]];
+    serial = [serial stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceCharacterSet]];
+  }
+
+  NSString *model = [NSString stringWithFormat:@"%@ %@",
+                        diskProperties[@"DADeviceVendor"] ?: @"",
+                        diskProperties[@"DADeviceModel"] ?: @""];
+  model = [model stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceCharacterSet]];
+
+  LOGI(@"action=DISKAPPEAR|mount=%@|volume=%@|bsdname=%@|fs=%@|model=%@|serial=%@|bus=%@|dmgpath=%@",
+       [diskProperties[@"DAVolumePath"] path] ?: @"",
+       diskProperties[@"DAVolumeName"] ?: @"",
+       diskProperties[@"DAMediaBSDName"] ?: @"",
+       diskProperties[@"DAVolumeKind"] ?: @"",
+       model ?: @"",
+       serial,
+       diskProperties[@"DADeviceProtocol"] ?: @"",
+       dmgPath);
+}
+
+- (void)logDiskDisappeared:(NSDictionary *)diskProperties {
+  if (![diskProperties[@"DAVolumeMountable"] boolValue]) return;
+
+  LOGI(@"action=DISKDISAPPEAR|mount=%@|volume=%@|bsdname=%@",
+       [diskProperties[@"DAVolumePath"] path] ?: @"",
+       diskProperties[@"DAVolumeName"] ?: @"",
+       diskProperties[@"DAMediaBSDName"]);
+}
+
 #pragma mark Helpers
 
 - (NSString *)sanitizeString:(NSString *)inStr {
@@ -204,6 +241,9 @@
   return inStr;
 }
 
+/**
+  Use sysctl to get the arguments for a PID, returned as a single string.
+*/
 - (NSString *)argsForPid:(pid_t)pid {
   int mib[3];
 
@@ -260,4 +300,59 @@
   return [args componentsJoinedByString:@" "];
 }
 
+/**
+  Given an IOKit device path (like those provided by DiskArbitration), find the disk
+  image path by looking up the device in the IOKit registry and getting its properties.
+
+  This is largely the same as the way hdiutil gathers info for the "info" command.
+*/
+- (NSString *)diskImageForDevice:(NSString *)devPath {
+  devPath = [devPath stringByDeletingLastPathComponent];
+  if (!devPath.length) return nil;
+  io_registry_entry_t device = IORegistryEntryCopyFromPath(
+      kIOMasterPortDefault, (__bridge CFStringRef)devPath);
+  CFMutableDictionaryRef deviceProperties = NULL;
+  IORegistryEntryCreateCFProperties(device, &deviceProperties, kCFAllocatorDefault, kNilOptions);
+  NSDictionary *properties = CFBridgingRelease(deviceProperties);
+  IOObjectRelease(device);
+
+  NSData *pathData = properties[@"image-path"];
+  NSString *result = [[NSString alloc] initWithData:pathData encoding:NSUTF8StringEncoding];
+
+  return result;
+}
+
+/**
+ Given an IOKit device path (like those provided by DiskArbitration), find the device serial number,
+ if there is one. This has only really been tested with USB and internal devices.
+*/
+- (NSString *)serialForDevice:(NSString *)devPath {
+  if (!devPath.length) return nil;
+  NSString *serial;
+  io_registry_entry_t device = IORegistryEntryCopyFromPath(
+      kIOMasterPortDefault, (__bridge CFStringRef)devPath);
+  while (!serial && device) {
+    CFMutableDictionaryRef deviceProperties = NULL;
+    IORegistryEntryCreateCFProperties(device, &deviceProperties, kCFAllocatorDefault, kNilOptions);
+    NSDictionary *properties = CFBridgingRelease(deviceProperties);
+    if (properties[@"Serial Number"]) {
+      serial = properties[@"Serial Number"];
+    } else if (properties[@"kUSBSerialNumberString"]) {
+      serial = properties[@"kUSBSerialNumberString"];
+    }
+
+    if (serial) {
+      IOObjectRelease(device);
+      break;
+    }
+
+    io_registry_entry_t parent;
+    IORegistryEntryGetParentEntry(device, kIOServicePlane, &parent);
+    IOObjectRelease(device);
+    device = parent;
+  }
+
+  return serial;
+}
+
 @end

Source/santad/SNTExecutionController.m

@@ -22,6 +22,7 @@
 
 #import "MOLCertificate.h"
 #import "MOLCodesignChecker.h"
+#import "SNTBlockMessage.h"
 #import "SNTCachedDecision.h"
 #import "SNTCommonEnums.h"
 #import "SNTConfigurator.h"
@@ -120,6 +121,9 @@
     return;
   }
 
+  // PrinterProxy workaround, see description above the method for more details.
+  if ([self printerProxyWorkaround:binInfo]) return;
+
   // Get codesigning info about the file.
   MOLCodesignChecker *csInfo = [[MOLCodesignChecker alloc] initWithBinaryPath:binInfo.path];
 
@@ -154,27 +158,26 @@
     se.ppid = @(message.ppid);
     se.parentName = @(message.pname);
 
+    // Bundle data
     se.fileBundleID = [binInfo bundleIdentifier];
     se.fileBundleName = [binInfo bundleName];
-
+    se.fileBundlePath = [binInfo bundlePath];
     if ([binInfo bundleShortVersionString]) {
       se.fileBundleVersionString = [binInfo bundleShortVersionString];
     }
-
     if ([binInfo bundleVersion]) {
       se.fileBundleVersion = [binInfo bundleVersion];
     }
 
+    // User data
     struct passwd *user = getpwuid(message.uid);
-    if (user) {
-      se.executingUser = @(user->pw_name);
-    }
-
+    if (user) se.executingUser = @(user->pw_name);
     NSArray *loggedInUsers, *currentSessions;
     [self loggedInUsers:&loggedInUsers sessions:&currentSessions];
     se.currentSessions = currentSessions;
     se.loggedInUsers = loggedInUsers;
 
+    // Quarantine data
     se.quarantineDataURL = binInfo.quarantineDataURL;
     se.quarantineRefererURL = binInfo.quarantineRefererURL;
     se.quarantineTimestamp = binInfo.quarantineTimestamp;
@@ -191,6 +194,16 @@
       [self initiateEventUploadForEvent:se];
 
       if (!cd.silentBlock) {
+        // Let the user know what happened, both on the terminal and in the GUI.
+        NSAttributedString *s = [SNTBlockMessage attributedBlockMessageForEvent:se
+                                                                  customMessage:cd.customMsg];
+        NSString *msg = [NSString stringWithFormat:@"\033[1mSanta\033[0m\n\n%@\n\n", s.string];
+        NSURL *detailURL = [SNTBlockMessage eventDetailURLForEvent:se];
+        if (detailURL) {
+          msg = [msg stringByAppendingFormat:@"%@\n\n", detailURL.absoluteString];
+        }
+        [self printMessage:msg toTTYForPID:message.ppid];
+
         [self.notifierQueue addEvent:se customMessage:cd.customMsg];
       }
     }
@@ -236,6 +249,47 @@
   return nil;
 }
 
+/**
+  Workaround for issue with PrinterProxy.app.
+ 
+  Every time a new printer is added to the machine, a copy of the PrinterProxy.app is copied from
+  the Print.framework to ~/Library/Printers with the name of the printer as the name of the app.
+  The binary inside is changed slightly (in a way that is unique to the printer name) and then 
+  re-signed with an adhoc signature. I don't know why this is done but it seems that the binary 
+  itself doesn't need to be changed as copying the old one back in-place seems to work,
+  so that's what we do.
+ 
+  If this workaround is applied the decision request is not responded to as the existing request
+  is invalidated when the file is closed which will trigger a brand new request coming from the
+  kernel.
+ 
+  @param fi, SNTFileInfo object for the binary being executed.
+  @return YES if the workaround was applied, NO otherwise.
+*/
+- (BOOL)printerProxyWorkaround:(SNTFileInfo *)fi {
+  if ([fi.path hasSuffix:@"/Contents/MacOS/PrinterProxy"] &&
+      [fi.path containsString:@"Library/Printers"]) {
+    NSString *proxyPath = (@"/System/Library/Frameworks/Carbon.framework/Versions/Current/"
+                           @"Frameworks/Print.framework/Versions/Current/Plugins/PrinterProxy.app/"
+                           @"Contents/MacOS/PrinterProxy");
+    SNTFileInfo *proxyFi = [[SNTFileInfo alloc] initWithPath:proxyPath];
+    if ([proxyFi.SHA256 isEqual:fi.SHA256]) return NO;
+
+    NSFileHandle *inFh = [NSFileHandle fileHandleForReadingAtPath:proxyPath];
+    NSFileHandle *outFh = [NSFileHandle fileHandleForWritingAtPath:fi.path];
+    [outFh writeData:[inFh readDataToEndOfFile]];
+    [inFh closeFile];
+    [outFh truncateFileAtOffset:[outFh offsetInFile]];
+    [outFh synchronizeFile];
+    [outFh closeFile];
+
+    LOGW(@"PrinterProxy workaround applied to %@", fi.path);
+
+    return YES;
+  }
+  return NO;
+}
+
 - (void)initiateEventUploadForEvent:(SNTStoredEvent *)event {
   // The event upload is skipped if the full path is equal to that of santactl so that
   // on the off chance that santactl is not whitelisted, we don't get into an infinite loop.
@@ -244,14 +298,26 @@
       ![[SNTConfigurator configurator] syncBaseURL] ||
       [[SNTConfigurator configurator] syncBackOff]) return;
 
+  // The event upload is skipped if an event upload has been initiated for it in the
+  // last 10 minutes.
+  static dispatch_once_t onceToken;
+  static NSMutableDictionary *uploadBackoff;
+  dispatch_once(&onceToken, ^{
+    uploadBackoff = [NSMutableDictionary dictionary];
+  });
+  NSDate *backoff = uploadBackoff[event.fileSHA256];
+  NSDate *now = [NSDate date];
+  if (([now timeIntervalSince1970] - [backoff timeIntervalSince1970]) < 600) return;
+  uploadBackoff[event.fileSHA256] = now;
+
   if (fork() == 0) {
     // Ensure we have no privileges
     if (!DropRootPrivileges()) {
       _exit(EPERM);
     }
 
-    _exit(execl(kSantaCtlPath, kSantaCtlPath, "sync", "singleevent",
-                [event.fileSHA256 UTF8String], NULL));
+    _exit(execl(kSantaCtlPath, kSantaCtlPath, "sync", "--syslog",
+                "singleevent", [event.fileSHA256 UTF8String], NULL));
   }
 }
 
@@ -273,6 +339,22 @@
   }
 }
 
+- (void)printMessage:(NSString *)msg toTTYForPID:(pid_t)pid {
+  if (pid < 2) return;  // don't bother even looking for launchd.
+
+  struct proc_bsdinfo taskInfo = {};
+  if (proc_pidinfo(pid, PROC_PIDTBSDINFO, 0,  &taskInfo, sizeof(taskInfo)) < 1) {
+    return;
+  }
+
+  NSString *devPath = [NSString stringWithFormat:@"/dev/%s", devname(taskInfo.e_tdev, S_IFCHR)];
+  int fd = open(devPath.UTF8String, O_WRONLY | O_NOCTTY);
+  @try {
+    NSFileHandle *fh = [[NSFileHandle alloc] initWithFileDescriptor:fd closeOnDealloc:YES];
+    [fh writeData:[msg dataUsingEncoding:NSUTF8StringEncoding]];
+  } @catch (NSException *) { /* do nothing */ }
+}
+
 - (void)loggedInUsers:(NSArray **)users sessions:(NSArray **)sessions {
   NSMutableDictionary *loggedInUsers = [[NSMutableDictionary alloc] init];
   NSMutableDictionary *loggedInHosts = [[NSMutableDictionary alloc] init];

Tests/LogicTests/Resources/sync_eventupload_input_basic.plist

@@ -0,0 +1,505 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>$archiver</key>
+	<string>NSKeyedArchiver</string>
+	<key>$objects</key>
+	<array>
+		<string>$null</string>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>25</integer>
+			</dict>
+			<key>NS.objects</key>
+			<array>
+				<dict>
+					<key>CF$UID</key>
+					<integer>2</integer>
+				</dict>
+				<dict>
+					<key>CF$UID</key>
+					<integer>30</integer>
+				</dict>
+			</array>
+		</dict>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>29</integer>
+			</dict>
+			<key>currentSessions</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>26</integer>
+			</dict>
+			<key>decision</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>19</integer>
+			</dict>
+			<key>executingUser</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>16</integer>
+			</dict>
+			<key>filePath</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>5</integer>
+			</dict>
+			<key>fileSHA256</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>4</integer>
+			</dict>
+			<key>idx</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>3</integer>
+			</dict>
+			<key>loggedInUsers</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>23</integer>
+			</dict>
+			<key>occurrenceDate</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>17</integer>
+			</dict>
+			<key>parentName</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>22</integer>
+			</dict>
+			<key>pid</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>20</integer>
+			</dict>
+			<key>ppid</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>21</integer>
+			</dict>
+			<key>signingChain</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>6</integer>
+			</dict>
+		</dict>
+		<integer>14887</integer>
+		<string>ff98fa0c0a1095fedcbe4d388a9760e71399a5c3c017a847ffa545663b57929a</string>
+		<string>/usr/bin/yes</string>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>15</integer>
+			</dict>
+			<key>NS.objects</key>
+			<array>
+				<dict>
+					<key>CF$UID</key>
+					<integer>7</integer>
+				</dict>
+				<dict>
+					<key>CF$UID</key>
+					<integer>11</integer>
+				</dict>
+				<dict>
+					<key>CF$UID</key>
+					<integer>13</integer>
+				</dict>
+			</array>
+		</dict>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>10</integer>
+			</dict>
+			<key>certData</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>8</integer>
+			</dict>
+		</dict>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>9</integer>
+			</dict>
+			<key>NS.data</key>
+			<data>
+			MIIFOzCCBCOgAwIBAgIIKtpxuqe9F58wDQYJKoZIhvcNAQEFBQAw
+			fzELMAkGA1UEBhMCVVMxEzARBgNVBAoMCkFwcGxlIEluYy4xJjAk
+			BgNVBAsMHUFwcGxlIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MTMw
+			MQYDVQQDDCpBcHBsZSBDb2RlIFNpZ25pbmcgQ2VydGlmaWNhdGlv
+			biBBdXRob3JpdHkwHhcNMTMwNDEyMjIzNDM1WhcNMjEwNDEyMjIz
+			NDM1WjBWMQswCQYDVQQGEwJVUzETMBEGA1UECgwKQXBwbGUgSW5j
+			LjEXMBUGA1UECwwOQXBwbGUgU29mdHdhcmUxGTAXBgNVBAMMEFNv
+			ZnR3YXJlIFNpZ25pbmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+			ggEKAoIBAQC/MLh0mE+uBguklG4xVG0J0TyjsDkQqdDmqmAiXdPk
+			hKJAQZBkxmA9kWHaUqhFJ54sZMvkHqgkClI6s9PsFkF4wZ7RBuZ4
+			JWMI89/KQeYd/jXpUVwTFYvp0Z1xe9HJqkuemdqPwCm4L5BvpLtl
+			j4Bq1z1obeR4wqUSL/gy6X7JXVyMPhYgG9denRuGLQj3vBmkTQ5B
+			pErbaxqARVAEqUyNFQfqaie9u4iePD+yUjmX47fI61RSmIovI1Zl
+			5ekq2VG0I/oE3ffroN/VmvJeCPFfh/CxR2x1sbGM0RPjesHsYkF0
+			poM08fladGQ5P1luzyzAYIMpPOfeT18N85M5XzCNAgMBAAGjggHi
+			MIIB3jAdBgNVHQ4EFgQUxu0+Svsu6D8T1aAVs13Z57P3aDUwDAYD
+			VR0TAQH/BAIwADAfBgNVHSMEGDAWgBSOaabEd0JOBKVWQpxRH4ba
+			0iCPCTCCARwGA1UdIASCARMwggEPMIIBCwYJKoZIhvdjZAUBMIH9
+			MDUGCCsGAQUFBwIBFilodHRwOi8vd3d3LmFwcGxlLmNvbS9jZXJ0
+			aWZpY2F0ZWF1dGhvcml0eTCBwwYIKwYBBQUHAgIwgbYMgbNSZWxp
+			YW5jZSBvbiB0aGlzIGNlcnRpZmljYXRlIGJ5IGFueSBwYXJ0eSBh
+			c3N1bWVzIGFjY2VwdGFuY2Ugb2YgdGhlIHRoZW4gYXBwbGljYWJs
+			ZSBzdGFuZGFyZCB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB1c2Us
+			IGNlcnRpZmljYXRlIHBvbGljeSBhbmQgY2VydGlmaWNhdGlvbiBw
+			cmFjdGljZSBzdGF0ZW1lbnRzLjA1BgNVHR8ELjAsMCqgKKAmhiRo
+			dHRwOi8vY3JsLmFwcGxlLmNvbS9jb2Rlc2lnbmluZy5jcmwwDgYD
+			VR0PAQH/BAQDAgeAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMDMA8G
+			CSqGSIb3Y2QGFgQCBQAwDQYJKoZIhvcNAQEFBQADggEBAFfUxSFX
+			GxTaEjIsEQUMBA+VqtTi+vLEbWjeUlINInPIhXMd71FO8IpJsGiU
+			ZVEi3/1AjzW0aEBSuyWOzPrOfBJW2MDQVQW1SrG1YfyVfJFectEo
+			tB0rbdpLZ58F/ObnWUpDXh97hDe+/rqKKzMFlFCDuP6a2wO7jWLy
+			GW13k+N1zzZZMV4IbV0BHGVTUpN2eJwXCxAelLw2kFZLRC6Y2aYx
+			ofAcZpSZVHMTtVE4vCSioDA7emWHrMC8FfReMMedoyoE38TPR4Rt
+			n/3/RcOgGaw8u62PlPm5x8hxNhHt6AG6tHVIgqQqUxoFBZudxkcb
+			9eggcqAbS+W+ZPw4DZr/Q0E=
+			</data>
+		</dict>
+		<dict>
+			<key>$classes</key>
+			<array>
+				<string>NSMutableData</string>
+				<string>NSData</string>
+				<string>NSObject</string>
+			</array>
+			<key>$classname</key>
+			<string>NSMutableData</string>
+		</dict>
+		<dict>
+			<key>$classes</key>
+			<array>
+				<string>MOLCertificate</string>
+				<string>NSObject</string>
+			</array>
+			<key>$classname</key>
+			<string>MOLCertificate</string>
+		</dict>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>10</integer>
+			</dict>
+			<key>certData</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>12</integer>
+			</dict>
+		</dict>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>9</integer>
+			</dict>
+			<key>NS.data</key>
+			<data>
+			MIIEDjCCAvagAwIBAgIBITANBgkqhkiG9w0BAQUFADBiMQswCQYD
+			VQQGEwJVUzETMBEGA1UEChMKQXBwbGUgSW5jLjEmMCQGA1UECxMd
+			QXBwbGUgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNVBAMT
+			DUFwcGxlIFJvb3QgQ0EwHhcNMTExMDI0MTczOTQxWhcNMjYxMDI0
+			MTczOTQxWjB/MQswCQYDVQQGEwJVUzETMBEGA1UECgwKQXBwbGUg
+			SW5jLjEmMCQGA1UECwwdQXBwbGUgQ2VydGlmaWNhdGlvbiBBdXRo
+			b3JpdHkxMzAxBgNVBAMMKkFwcGxlIENvZGUgU2lnbmluZyBDZXJ0
+			aWZpY2F0aW9uIEF1dGhvcml0eTCCASIwDQYJKoZIhvcNAQEBBQAD
+			ggEPADCCAQoCggEBAKKoEXH/DvkLa/glDZiBXWtZvVobibPn5e7O
+			OZgjNTlInyGrJ9nunCDwZDgIawynz9xQth0GxFvxXRqbVGWGcy9i
+			5Ti9ARBkcm18aUdhnBAFJuPrhcIsJNxqwj+I/MysKUyhSXkRmnV2
+			5R640NIJtExTePvfGHahj6SpMsqRp7b6l705qs0bUBGIq2rt62bK
+			IEusOy3vqufWyYgtacKkKmEv24cC86EhuUyfDvj52S3KcgR/Ha5u
+			+j+Is8yjQO4XhxhRlrzP5C2twulZTl0cZTMnA6pno5Mkh8eHeQK5
+			XZizDu7NaQg+jEiSJLJt1zC+z9jkyKeXgdAeI9w4mV9h/oUCAwEA
+			AaOBsTCBrjAOBgNVHQ8BAf8EBAMCAYYwEwYDVR0lBAwwCgYIKwYB
+			BQUHAwMwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUjmmmxHdC
+			TgSlVkKcUR+G2tIgjwkwHwYDVR0jBBgwFoAUK9BpR5R2Cf70a40u
+			QKb3R01/CF4wNgYDVR0fBC8wLTAroCmgJ4YlaHR0cDovL3d3dy5h
+			cHBsZS5jb20vYXBwbGVjYS9yb290LmNybDANBgkqhkiG9w0BAQUF
+			AAOCAQEAcHOt9lIVarcVGN6pKtGddpsesmmWx8LD4SvQ7wddcPja
+			PFpIR9s5bIDKc95iG7c6yqNaHuOH2iVKk5vvcxCTc13j9J1+3g+B
+			9qmZwVhunPSJAL7PT/8C0w789fP0choysconDt6o05mPauaZ+2HJ
+			T/IXsRhn8DDAxgruyESBpIm78XlBw+6uyGtnfMxsSYZMAtPTam4Y
+			nPhcOMgwh5ow2mcouOKaedqfpTsfUWI7IvF+U3waC8PwTdxJRPKI
+			iM46W7md6bK3W1KnxtVYiXK32MyzqBgdUJc/Hdpqrji/e3kxvmO5
+			94WFF+ltisTiGJQv129SpZmx3USbB3CSiCZ32w==
+			</data>
+		</dict>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>10</integer>
+			</dict>
+			<key>certData</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>14</integer>
+			</dict>
+		</dict>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>9</integer>
+			</dict>
+			<key>NS.data</key>
+			<data>
+			MIIEuzCCA6OgAwIBAgIBAjANBgkqhkiG9w0BAQUFADBiMQswCQYD
+			VQQGEwJVUzETMBEGA1UEChMKQXBwbGUgSW5jLjEmMCQGA1UECxMd
+			QXBwbGUgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNVBAMT
+			DUFwcGxlIFJvb3QgQ0EwHhcNMDYwNDI1MjE0MDM2WhcNMzUwMjA5
+			MjE0MDM2WjBiMQswCQYDVQQGEwJVUzETMBEGA1UEChMKQXBwbGUg
+			SW5jLjEmMCQGA1UECxMdQXBwbGUgQ2VydGlmaWNhdGlvbiBBdXRo
+			b3JpdHkxFjAUBgNVBAMTDUFwcGxlIFJvb3QgQ0EwggEiMA0GCSqG
+			SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDkkakJH5HbHkdQ6wXtXnmE
+			Les2oldMVeyLGYne+Uts9QerIjAC6Bg++FAJ039BqJj50cpmnCRr
+			EdCju+QbKsMflZ56DKRHi1vUFjczy8QPTc4UadHJGXL1XQ7Vf1+b
+			8iUDulWPTV0N8WQ1IxVLFVkds5T39pyez1C6wVhQZ48ItCD3y6ws
+			IG9wtj8BMIy3Q88PnT3zK0koGsj+zrW5DtleHNbLPbU6rfQPDgCS
+			C7EhFi501TwN22IWq6NxkkdTVcGvL0Gz+PvjcM3mo0xFfh9Ma1CW
+			QYnEdGILEINBhzOKgbEwWOxaBDKMaLOPHd5lc/9nXmW8Sdh2nzMU
+			ZaF3lMktAgMBAAGjggF6MIIBdjAOBgNVHQ8BAf8EBAMCAQYwDwYD
+			VR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUK9BpR5R2Cf70a40uQKb3
+			R01/CF4wHwYDVR0jBBgwFoAUK9BpR5R2Cf70a40uQKb3R01/CF4w
+			ggERBgNVHSAEggEIMIIBBDCCAQAGCSqGSIb3Y2QFATCB8jAqBggr
+			BgEFBQcCARYeaHR0cHM6Ly93d3cuYXBwbGUuY29tL2FwcGxlY2Ev
+			MIHDBggrBgEFBQcCAjCBthqBs1JlbGlhbmNlIG9uIHRoaXMgY2Vy
+			dGlmaWNhdGUgYnkgYW55IHBhcnR5IGFzc3VtZXMgYWNjZXB0YW5j
+			ZSBvZiB0aGUgdGhlbiBhcHBsaWNhYmxlIHN0YW5kYXJkIHRlcm1z
+			IGFuZCBjb25kaXRpb25zIG9mIHVzZSwgY2VydGlmaWNhdGUgcG9s
+			aWN5IGFuZCBjZXJ0aWZpY2F0aW9uIHByYWN0aWNlIHN0YXRlbWVu
+			dHMuMA0GCSqGSIb3DQEBBQUAA4IBAQBcNplMLXi37Yyb3PN3m/J2
+			0ncwT8EfhYOFG5k9RzfyqZtAjizUsZAS2L70c5vu0mQPy3lPNNii
+			Pvl4/2vIB+x9OYOLUyDTOMSxv5pPCmv/K/xZpwUJfBdAVhEedNO3
+			iyM7R6PVbyTi69G3cN8PReEnyvFteO3ntRcXqNx+IjXKJdXZD9Zr
+			1KIkIxH3oayPc4FgxhtbCS+SsvhESPBgOJ4V9T0mZyCKM2r3DYLP
+			3uujL/lTaltkwGMzd/c6ByxW69oPIQ7aunMZT7XZNn/Bh1XZp5m5
+			MkL72NVxnn6hUrcbvZNCJBIqxw8dtk2cXmPIS4AXUKqK1drk/NAJ
+			BzewdXUh
+			</data>
+		</dict>
+		<dict>
+			<key>$classes</key>
+			<array>
+				<string>NSMutableArray</string>
+				<string>NSArray</string>
+				<string>NSObject</string>
+			</array>
+			<key>$classname</key>
+			<string>NSMutableArray</string>
+		</dict>
+		<string>root</string>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>18</integer>
+			</dict>
+			<key>NS.time</key>
+			<real>485894498.53763503</real>
+		</dict>
+		<dict>
+			<key>$classes</key>
+			<array>
+				<string>NSDate</string>
+				<string>NSObject</string>
+			</array>
+			<key>$classname</key>
+			<string>NSDate</string>
+		</dict>
+		<integer>6</integer>
+		<integer>11196</integer>
+		<integer>10760</integer>
+		<string>bash</string>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>25</integer>
+			</dict>
+			<key>NS.objects</key>
+			<array>
+				<dict>
+					<key>CF$UID</key>
+					<integer>24</integer>
+				</dict>
+			</array>
+		</dict>
+		<string>foouser</string>
+		<dict>
+			<key>$classes</key>
+			<array>
+				<string>NSArray</string>
+				<string>NSObject</string>
+			</array>
+			<key>$classname</key>
+			<string>NSArray</string>
+		</dict>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>25</integer>
+			</dict>
+			<key>NS.objects</key>
+			<array>
+				<dict>
+					<key>CF$UID</key>
+					<integer>27</integer>
+				</dict>
+				<dict>
+					<key>CF$UID</key>
+					<integer>28</integer>
+				</dict>
+			</array>
+		</dict>
+		<string>foouser@console</string>
+		<string>foouser@ttys000</string>
+		<dict>
+			<key>$classes</key>
+			<array>
+				<string>SNTStoredEvent</string>
+				<string>NSObject</string>
+			</array>
+			<key>$classname</key>
+			<string>SNTStoredEvent</string>
+		</dict>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>29</integer>
+			</dict>
+			<key>currentSessions</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>38</integer>
+			</dict>
+			<key>decision</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>35</integer>
+			</dict>
+			<key>executingUser</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>24</integer>
+			</dict>
+			<key>filePath</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>33</integer>
+			</dict>
+			<key>fileSHA256</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>32</integer>
+			</dict>
+			<key>idx</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>31</integer>
+			</dict>
+			<key>loggedInUsers</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>37</integer>
+			</dict>
+			<key>occurrenceDate</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>34</integer>
+			</dict>
+			<key>parentName</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>22</integer>
+			</dict>
+			<key>pid</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>36</integer>
+			</dict>
+			<key>ppid</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>21</integer>
+			</dict>
+		</dict>
+		<integer>14888</integer>
+		<string>2b3a38f4e4e981afc517b0c7903ffe2f79193c67e2329dd77cf2e74b046ca3a7</string>
+		<string>/usr/local/Cellar/hub/2.2.3/bin/hub</string>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>18</integer>
+			</dict>
+			<key>NS.time</key>
+			<real>485894568.92822498</real>
+		</dict>
+		<integer>1</integer>
+		<integer>11427</integer>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>25</integer>
+			</dict>
+			<key>NS.objects</key>
+			<array>
+				<dict>
+					<key>CF$UID</key>
+					<integer>24</integer>
+				</dict>
+			</array>
+		</dict>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>25</integer>
+			</dict>
+			<key>NS.objects</key>
+			<array>
+				<dict>
+					<key>CF$UID</key>
+					<integer>27</integer>
+				</dict>
+				<dict>
+					<key>CF$UID</key>
+					<integer>28</integer>
+				</dict>
+			</array>
+		</dict>
+	</array>
+	<key>$top</key>
+	<dict>
+		<key>root</key>
+		<dict>
+			<key>CF$UID</key>
+			<integer>1</integer>
+		</dict>
+	</dict>
+	<key>$version</key>
+	<integer>100000</integer>
+</dict>
+</plist>

Tests/LogicTests/Resources/sync_eventupload_input_quarantine.plist

@@ -0,0 +1,454 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>$archiver</key>
+	<string>NSKeyedArchiver</string>
+	<key>$objects</key>
+	<array>
+		<string>$null</string>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>28</integer>
+			</dict>
+			<key>NS.objects</key>
+			<array>
+				<dict>
+					<key>CF$UID</key>
+					<integer>2</integer>
+				</dict>
+			</array>
+		</dict>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>36</integer>
+			</dict>
+			<key>currentSessions</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>29</integer>
+			</dict>
+			<key>decision</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>24</integer>
+			</dict>
+			<key>executingUser</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>21</integer>
+			</dict>
+			<key>fileBundleID</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>8</integer>
+			</dict>
+			<key>fileBundleName</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>6</integer>
+			</dict>
+			<key>fileBundlePath</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>7</integer>
+			</dict>
+			<key>fileBundleVersion</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>9</integer>
+			</dict>
+			<key>fileBundleVersionString</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>10</integer>
+			</dict>
+			<key>filePath</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>5</integer>
+			</dict>
+			<key>fileSHA256</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>4</integer>
+			</dict>
+			<key>idx</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>3</integer>
+			</dict>
+			<key>loggedInUsers</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>27</integer>
+			</dict>
+			<key>occurrenceDate</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>22</integer>
+			</dict>
+			<key>parentName</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>26</integer>
+			</dict>
+			<key>pid</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>25</integer>
+			</dict>
+			<key>ppid</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>24</integer>
+			</dict>
+			<key>quarantineAgentBundleID</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>35</integer>
+			</dict>
+			<key>quarantineDataURL</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>32</integer>
+			</dict>
+			<key>quarantineRefererURL</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>33</integer>
+			</dict>
+			<key>quarantineTimestamp</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>34</integer>
+			</dict>
+			<key>signingChain</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>11</integer>
+			</dict>
+		</dict>
+		<integer>14896</integer>
+		<string>9dce073ce17dc86cf08182bf1b2c9adff5a5bd7a9b133a963b611daa2dc0f68c</string>
+		<string>/Applications/Paw.app/Contents/MacOS/Paw</string>
+		<string>Paw</string>
+		<string>/Applications/Paw.app</string>
+		<string>com.luckymarmot.Paw</string>
+		<string>2003004001</string>
+		<string>2.3.4</string>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>20</integer>
+			</dict>
+			<key>NS.objects</key>
+			<array>
+				<dict>
+					<key>CF$UID</key>
+					<integer>12</integer>
+				</dict>
+				<dict>
+					<key>CF$UID</key>
+					<integer>16</integer>
+				</dict>
+				<dict>
+					<key>CF$UID</key>
+					<integer>18</integer>
+				</dict>
+			</array>
+		</dict>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>15</integer>
+			</dict>
+			<key>certData</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>13</integer>
+			</dict>
+		</dict>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>14</integer>
+			</dict>
+			<key>NS.data</key>
+			<data>
+			MIIFaTCCBFGgAwIBAgIIbgRYjgjmV00wDQYJKoZIhvcNAQELBQAw
+			eTEtMCsGA1UEAwwkRGV2ZWxvcGVyIElEIENlcnRpZmljYXRpb24g
+			QXV0aG9yaXR5MSYwJAYDVQQLDB1BcHBsZSBDZXJ0aWZpY2F0aW9u
+			IEF1dGhvcml0eTETMBEGA1UECgwKQXBwbGUgSW5jLjELMAkGA1UE
+			BhMCVVMwHhcNMTIxMjA1MDUzMDIwWhcNMTcxMjA2MDUzMDIwWjCB
+			ijEaMBgGCgmSJomT8ixkAQEMCjg0NTk5Ukw1OEExMTAvBgNVBAMM
+			KERldmVsb3BlciBJRCBBcHBsaWNhdGlvbjogTWljaGEgTWF6YWhl
+			cmkxEzARBgNVBAsMCjg0NTk5Ukw1OEExFzAVBgNVBAoMDk1pY2hh
+			IE1hemFoZXJpMQswCQYDVQQGEwJGUjCCASIwDQYJKoZIhvcNAQEB
+			BQADggEPADCCAQoCggEBAODR8cTAZZCZb/8+/fgVfM3Mu3dr0ga0
+			ry+CoHEZLuWiiHEPbcalOp13DyC1x9bYY341dr2TJcrVFhIRg/bi
+			3arx9U3AQl60W4Ybo223jwdnt5FPK+WuXg2kL1OmE8Aqd9sKWcX0
+			QlLVuVF4HjiKukD44qRMyP8vAxLFPIqPFizw1m1qNSaMa66JaKos
+			hDJOT2WgpLEdPTsxw8U1NMXLVnh+V8Ax+BAjMsIPOE6V7P36TUyt
+			L2J/YgcIdiYo/kr05ATmfQEEk/E680gFAXX2z5L8sxZbKMwPyhJZ
+			antw7u9ygHH/XnL850gcxXr7ggOKjgcJGhlBRpb+j9AIXj4nHl0C
+			AwEAAaOCAeEwggHdMD4GCCsGAQUFBwEBBDIwMDAuBggrBgEFBQcw
+			AYYiaHR0cDovL29jc3AuYXBwbGUuY29tL29jc3AtZGV2aWQwMTAd
+			BgNVHQ4EFgQU4EU6eGBHWGVUVOnfZpSf28AGQfkwDAYDVR0TAQH/
+			BAIwADAfBgNVHSMEGDAWgBRXF+2iz9x8mKEQ4Py+hy0s8uMXVDCC
+			AQ4GA1UdIASCAQUwggEBMIH+BgkqhkiG92NkBQEwgfAwKAYIKwYB
+			BQUHAgEWHGh0dHA6Ly93d3cuYXBwbGUuY29tL2FwcGxlY2EwgcMG
+			CCsGAQUFBwICMIG2DIGzUmVsaWFuY2Ugb24gdGhpcyBjZXJ0aWZp
+			Y2F0ZSBieSBhbnkgcGFydHkgYXNzdW1lcyBhY2NlcHRhbmNlIG9m
+			IHRoZSB0aGVuIGFwcGxpY2FibGUgc3RhbmRhcmQgdGVybXMgYW5k
+			IGNvbmRpdGlvbnMgb2YgdXNlLCBjZXJ0aWZpY2F0ZSBwb2xpY3kg
+			YW5kIGNlcnRpZmljYXRpb24gcHJhY3RpY2Ugc3RhdGVtZW50cy4w
+			DgYDVR0PAQH/BAQDAgeAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMD
+			MBMGCiqGSIb3Y2QGAQ0BAf8EAgUAMA0GCSqGSIb3DQEBCwUAA4IB
+			AQAzGxszYVEE5wCR4OnFvk8Ea1A4/uyy8jjQ/loMJXIbeJ436IqX
+			uc+6eCVIbkM+X4c5SEogq0td7NCkupgJUAuxEY2LCD/N3E5sDHaW
+			09qBEV+hVBSF1+mwigLSLexaGgH9lQBNabbwjgkloFpFCdDDRtyT
+			lUhC0Mo1jcjrFH9jfH76yn66SgY4oSnU1r/TiJFdt0a1e6Jbhc4U
+			L9r/mhJFYYjl811DZQUjBrdqnGq9KP6mU6B8MHzay9jUb0vgbFqQ
+			cxoWNKr7fW5U/oHZKAh1LtechJFairDpIsXr9euIOq4UHHjqQ1R7
+			zFBVaYHXWcyNjk9UCQq2Ejjw6NkAr4AA
+			</data>
+		</dict>
+		<dict>
+			<key>$classes</key>
+			<array>
+				<string>NSMutableData</string>
+				<string>NSData</string>
+				<string>NSObject</string>
+			</array>
+			<key>$classname</key>
+			<string>NSMutableData</string>
+		</dict>
+		<dict>
+			<key>$classes</key>
+			<array>
+				<string>MOLCertificate</string>
+				<string>NSObject</string>
+			</array>
+			<key>$classname</key>
+			<string>MOLCertificate</string>
+		</dict>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>15</integer>
+			</dict>
+			<key>certData</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>17</integer>
+			</dict>
+		</dict>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>14</integer>
+			</dict>
+			<key>NS.data</key>
+			<data>
+			MIIEBDCCAuygAwIBAgIIGHqpqMKWIQwwDQYJKoZIhvcNAQELBQAw
+			YjELMAkGA1UEBhMCVVMxEzARBgNVBAoTCkFwcGxlIEluYy4xJjAk
+			BgNVBAsTHUFwcGxlIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MRYw
+			FAYDVQQDEw1BcHBsZSBSb290IENBMB4XDTEyMDIwMTIyMTIxNVoX
+			DTI3MDIwMTIyMTIxNVoweTEtMCsGA1UEAwwkRGV2ZWxvcGVyIElE
+			IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSYwJAYDVQQLDB1BcHBs
+			ZSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTETMBEGA1UECgwKQXBw
+			bGUgSW5jLjELMAkGA1UEBhMCVVMwggEiMA0GCSqGSIb3DQEBAQUA
+			A4IBDwAwggEKAoIBAQCJdk8GW5pB7qUjKwKjX9dzP8A1sIuECj8G
+			JH+nlT/rTw6Tr7QO0Mg+5W0Ysx/oiUe/1wkI5P9WmCkV55SduTWj
+			Cs20wOHiYPTK7Cl4RWlpYGtfipL8niPmOsIiszFPHLrytjRZQu6w
+			qQIDGJEEtrN4LjMfgEUNRW+7Dlpbfzrn2AjXCw4ybfuGNuRsq8QR
+			inCEJqqfRNHxuMZ7lBebSPcLWBa6I8WfFTl+yl3DMl8P4FJ/QOq+
+			rAhklVvJGpzlgMofakQcbD7EsCYfHex7r16gaj1HqVgSMT8gdiht
+			HRywwk4RaSaLy9bQEYLJTg/xVnTQ2QhLZniiq6yn4tJMh1nJAgMB
+			AAGjgaYwgaMwHQYDVR0OBBYEFFcX7aLP3HyYoRDg/L6HLSzy4xdU
+			MA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUK9BpR5R2Cf70
+			a40uQKb3R01/CF4wLgYDVR0fBCcwJTAjoCGgH4YdaHR0cDovL2Ny
+			bC5hcHBsZS5jb20vcm9vdC5jcmwwDgYDVR0PAQH/BAQDAgGGMBAG
+			CiqGSIb3Y2QGAgYEAgUAMA0GCSqGSIb3DQEBCwUAA4IBAQBCOXRr
+			odzGpI83KoyzHQpEvJUsf7xZuKxh+weQkjK51L87wVA5akR0ouxb
+			H3Dlqt1LbBwjcS1f0cWTvu6binBlgp0W4xoQF4ktqM39DHhYSQwo
+			fzPuAHobtHastrW7T9+oG53IGZdKC1ZnL8I+trPEgzrwd210xC4j
+			Ue6apQNvYPSlSKcGwrta4h8fRkV+5Jf1JxC3ICJyb3LaxlB1xT0l
+			j12jAOmfNoxIOY+zO+qQgC6VmmD0eM70DgpTPqL6T9geroSVjTK8
+			Vk2J6XgY4KyaQrp6RhuEoonOFOiI0ViL9q5WxCwFKkWvC9lLqQIP
+			NKyIx2FViUTJJ3MH7oLlTvVw
+			</data>
+		</dict>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>15</integer>
+			</dict>
+			<key>certData</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>19</integer>
+			</dict>
+		</dict>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>14</integer>
+			</dict>
+			<key>NS.data</key>
+			<data>
+			MIIEuzCCA6OgAwIBAgIBAjANBgkqhkiG9w0BAQUFADBiMQswCQYD
+			VQQGEwJVUzETMBEGA1UEChMKQXBwbGUgSW5jLjEmMCQGA1UECxMd
+			QXBwbGUgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxFjAUBgNVBAMT
+			DUFwcGxlIFJvb3QgQ0EwHhcNMDYwNDI1MjE0MDM2WhcNMzUwMjA5
+			MjE0MDM2WjBiMQswCQYDVQQGEwJVUzETMBEGA1UEChMKQXBwbGUg
+			SW5jLjEmMCQGA1UECxMdQXBwbGUgQ2VydGlmaWNhdGlvbiBBdXRo
+			b3JpdHkxFjAUBgNVBAMTDUFwcGxlIFJvb3QgQ0EwggEiMA0GCSqG
+			SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDkkakJH5HbHkdQ6wXtXnmE
+			Les2oldMVeyLGYne+Uts9QerIjAC6Bg++FAJ039BqJj50cpmnCRr
+			EdCju+QbKsMflZ56DKRHi1vUFjczy8QPTc4UadHJGXL1XQ7Vf1+b
+			8iUDulWPTV0N8WQ1IxVLFVkds5T39pyez1C6wVhQZ48ItCD3y6ws
+			IG9wtj8BMIy3Q88PnT3zK0koGsj+zrW5DtleHNbLPbU6rfQPDgCS
+			C7EhFi501TwN22IWq6NxkkdTVcGvL0Gz+PvjcM3mo0xFfh9Ma1CW
+			QYnEdGILEINBhzOKgbEwWOxaBDKMaLOPHd5lc/9nXmW8Sdh2nzMU
+			ZaF3lMktAgMBAAGjggF6MIIBdjAOBgNVHQ8BAf8EBAMCAQYwDwYD
+			VR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUK9BpR5R2Cf70a40uQKb3
+			R01/CF4wHwYDVR0jBBgwFoAUK9BpR5R2Cf70a40uQKb3R01/CF4w
+			ggERBgNVHSAEggEIMIIBBDCCAQAGCSqGSIb3Y2QFATCB8jAqBggr
+			BgEFBQcCARYeaHR0cHM6Ly93d3cuYXBwbGUuY29tL2FwcGxlY2Ev
+			MIHDBggrBgEFBQcCAjCBthqBs1JlbGlhbmNlIG9uIHRoaXMgY2Vy
+			dGlmaWNhdGUgYnkgYW55IHBhcnR5IGFzc3VtZXMgYWNjZXB0YW5j
+			ZSBvZiB0aGUgdGhlbiBhcHBsaWNhYmxlIHN0YW5kYXJkIHRlcm1z
+			IGFuZCBjb25kaXRpb25zIG9mIHVzZSwgY2VydGlmaWNhdGUgcG9s
+			aWN5IGFuZCBjZXJ0aWZpY2F0aW9uIHByYWN0aWNlIHN0YXRlbWVu
+			dHMuMA0GCSqGSIb3DQEBBQUAA4IBAQBcNplMLXi37Yyb3PN3m/J2
+			0ncwT8EfhYOFG5k9RzfyqZtAjizUsZAS2L70c5vu0mQPy3lPNNii
+			Pvl4/2vIB+x9OYOLUyDTOMSxv5pPCmv/K/xZpwUJfBdAVhEedNO3
+			iyM7R6PVbyTi69G3cN8PReEnyvFteO3ntRcXqNx+IjXKJdXZD9Zr
+			1KIkIxH3oayPc4FgxhtbCS+SsvhESPBgOJ4V9T0mZyCKM2r3DYLP
+			3uujL/lTaltkwGMzd/c6ByxW69oPIQ7aunMZT7XZNn/Bh1XZp5m5
+			MkL72NVxnn6hUrcbvZNCJBIqxw8dtk2cXmPIS4AXUKqK1drk/NAJ
+			BzewdXUh
+			</data>
+		</dict>
+		<dict>
+			<key>$classes</key>
+			<array>
+				<string>NSMutableArray</string>
+				<string>NSArray</string>
+				<string>NSObject</string>
+			</array>
+			<key>$classname</key>
+			<string>NSMutableArray</string>
+		</dict>
+		<string>rah</string>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>23</integer>
+			</dict>
+			<key>NS.time</key>
+			<real>485897711.079467</real>
+		</dict>
+		<dict>
+			<key>$classes</key>
+			<array>
+				<string>NSDate</string>
+				<string>NSObject</string>
+			</array>
+			<key>$classname</key>
+			<string>NSDate</string>
+		</dict>
+		<integer>1</integer>
+		<integer>16331</integer>
+		<string>launchd</string>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>28</integer>
+			</dict>
+			<key>NS.objects</key>
+			<array>
+				<dict>
+					<key>CF$UID</key>
+					<integer>21</integer>
+				</dict>
+			</array>
+		</dict>
+		<dict>
+			<key>$classes</key>
+			<array>
+				<string>NSArray</string>
+				<string>NSObject</string>
+			</array>
+			<key>$classname</key>
+			<string>NSArray</string>
+		</dict>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>28</integer>
+			</dict>
+			<key>NS.objects</key>
+			<array>
+				<dict>
+					<key>CF$UID</key>
+					<integer>30</integer>
+				</dict>
+				<dict>
+					<key>CF$UID</key>
+					<integer>31</integer>
+				</dict>
+			</array>
+		</dict>
+		<string>rah@ttys000</string>
+		<string>rah@console</string>
+		<string>https://d3hevc2w7wq7nj.cloudfront.net/paw/Paw-2.3.4-2003004001.zip</string>
+		<string>https://luckymarmot.com/paw</string>
+		<dict>
+			<key>$class</key>
+			<dict>
+				<key>CF$UID</key>
+				<integer>23</integer>
+			</dict>
+			<key>NS.time</key>
+			<real>485897668</real>
+		</dict>
+		<string>com.google.Chrome</string>
+		<dict>
+			<key>$classes</key>
+			<array>
+				<string>SNTStoredEvent</string>
+				<string>NSObject</string>
+			</array>
+			<key>$classname</key>
+			<string>SNTStoredEvent</string>
+		</dict>
+	</array>
+	<key>$top</key>
+	<dict>
+		<key>root</key>
+		<dict>
+			<key>CF$UID</key>
+			<integer>1</integer>
+		</dict>
+	</dict>
+	<key>$version</key>
+	<integer>100000</integer>
+</dict>
+</plist>

Tests/LogicTests/Resources/sync_preflight_basic.json

@@ -0,0 +1 @@
+{"whitelist_regex": null, "client_mode": "MONITOR", "blacklist_regex": null, "batch_size": 100}

Tests/LogicTests/Resources/sync_preflight_lockdown.json

@@ -0,0 +1 @@
+{"whitelist_regex": null, "client_mode": "LOCKDOWN", "blacklist_regex": null, "batch_size": 100}

Tests/LogicTests/Resources/sync_ruledownload_batch1.json

@@ -0,0 +1 @@
+{"rules": [{"rule_type": "BINARY", "policy": "BLACKLIST", "sha256": "ee382e199f7eda58863a93a7854b930ade35798bc6856ee8e6ab6ce9277f0eab", "custom_msg": ""},{"rule_type": "CERTIFICATE", "policy": "WHITELIST", "sha256": "46f8c706d0533a54554af5fc163eea704f10c08b30f8a5db12bfdc04fb382fc3", "custom_msg": ""}],"cursor": "this-is-a-cursor="}

Tests/LogicTests/Resources/sync_ruledownload_batch2.json

@@ -0,0 +1 @@
+{"rules": [{"rule_type": "CERTIFICATE", "policy": "BLACKLIST", "sha256": "7846698e47ef41be80b83fb9e2b98fa6dc46c9188b068bff323c302955a00142", "custom_msg": "Hi There"}]}

Tests/LogicTests/SNTCommandSyncTest.m

@@ -0,0 +1,395 @@
+/// Copyright 2016 Google Inc. All rights reserved.
+///
+/// Licensed under the Apache License, Version 2.0 (the "License");
+/// you may not use this file except in compliance with the License.
+/// You may obtain a copy of the License at
+///
+///    http://www.apache.org/licenses/LICENSE-2.0
+///
+///    Unless required by applicable law or agreed to in writing, software
+///    distributed under the License is distributed on an "AS IS" BASIS,
+///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+///    See the License for the specific language governing permissions and
+///    limitations under the License.
+
+#import <XCTest/XCTest.h>
+
+#import <OCMock/OCMock.h>
+
+#import "SNTCommandSyncConstants.h"
+#import "SNTCommandSyncEventUpload.h"
+#import "SNTCommandSyncPostflight.h"
+#import "SNTCommandSyncPreflight.h"
+#import "SNTCommandSyncRuleDownload.h"
+#import "SNTCommandSyncState.h"
+#import "SNTCommandSyncStage.h"
+#import "SNTCommonEnums.h"
+#import "SNTRule.h"
+#import "SNTStoredEvent.h"
+#import "SNTXPCConnection.h"
+#import "SNTXPCControlInterface.h"
+
+// Prevent Zlib compression during testing
+@implementation NSData (Zlib)
+- (NSData *)zlibCompressed {
+  return nil;
+}
+- (NSData *)gzipCompressed {
+  return nil;
+}
+@end
+
+@interface SNTCommandSyncEventUpload (Testing)
+- (NSArray *)findRelatedBinaries:(SNTStoredEvent *)event;
+@end
+
+@interface SNTCommandSyncTest : XCTestCase
+@property SNTCommandSyncState *syncState;
+@property id<SNTDaemonControlXPC> daemonConnRop;
+@end
+
+@implementation SNTCommandSyncTest
+
+- (void)setUp {
+  [super setUp];
+
+  self.syncState = [[SNTCommandSyncState alloc] init];
+  self.syncState.daemonConn = OCMClassMock([SNTXPCConnection class]);
+  self.daemonConnRop = OCMProtocolMock(@protocol(SNTDaemonControlXPC));
+  OCMStub([self.syncState.daemonConn remoteObjectProxy]).andReturn(self.daemonConnRop);
+
+  self.syncState.session = OCMClassMock([NSURLSession class]);
+
+  self.syncState.syncBaseURL = [NSURL URLWithString:@"https://myserver.local/"];
+  self.syncState.machineID = [[NSUUID UUID] UUIDString];
+  self.syncState.machineOwner = NSUserName();
+}
+
+#pragma mark Test Helpers
+
+/**
+  Stub out dataTaskWithRequest:completionHandler:
+
+  @param respData The HTTP body to return.
+  @param resp The NSHTTPURLResponse to return. If nil, a basic 200 response will be sent.
+  @param err The error object to return to the handler.
+  @param validateBlock Use to validate the request is the one intended to be stubbed.
+      Returning NO means this stub is not applied.
+*/
+- (void)stubRequestBody:(NSData *)respData
+               response:(NSURLResponse *)resp
+                  error:(NSError *)err
+          validateBlock:(BOOL(^)(NSURLRequest *req))validateBlock {
+  if (!respData) respData = (NSData *)[NSNull null];
+  if (!resp) resp = [self responseWithCode:200 headerDict:nil];
+  if (!err) err = (NSError *)[NSNull null];
+
+  // Cast the value into an NSURLRequest to save callers doing it.
+  BOOL (^validateBlockWrapper)(id value) = ^BOOL(id value) {
+    if (!validateBlock) return YES;
+    NSURLRequest *req = (NSURLRequest *)value;
+    return validateBlock(req);
+  };
+
+  OCMStub([self.syncState.session dataTaskWithRequest:[OCMArg checkWithBlock:validateBlockWrapper]
+                                    completionHandler:([OCMArg invokeBlockWithArgs:respData,
+                                                           resp, err, nil])]);
+}
+
+/**
+  Generate an NSHTTPURLResponse with the provided HTTP status code and header dictionary.
+
+  @param code The HTTP status code for this response
+  @param headerDict A dictionary of HTTP headers to add to the response.
+  @returns An initialized NSHTTPURLResponse.
+*/
+- (NSHTTPURLResponse *)responseWithCode:(NSInteger)code headerDict:(NSDictionary *)headerDict {
+  return [[NSHTTPURLResponse alloc] initWithURL:[NSURL URLWithString:@"a"]
+                                     statusCode:code
+                                    HTTPVersion:@"1.1"
+                                   headerFields:headerDict];
+}
+
+/**
+  Parses the JSON dictionary from the HTTP body of a request.
+
+  @param request The request to parse the dictionary from.
+  @returns The JSON dictionary or nil if parsing failed.
+*/
+- (NSDictionary *)dictFromRequest:(NSURLRequest *)request {
+  NSData *bod = [request HTTPBody];
+  if (bod) return [NSJSONSerialization JSONObjectWithData:bod options:0 error:NULL];
+  return nil;
+}
+
+/**
+  Generate a JSON data body from a dictionary
+
+  @param dict, The dictionary of values
+  @return A JSON-encoded representation of the dictionary as NSData
+*/
+- (NSData *)dataFromDict:(NSDictionary *)dict {
+  return [NSJSONSerialization dataWithJSONObject:dict options:0 error:NULL];
+}
+
+/**
+  Return data from a file in the Resources folder of the test bundle.
+
+  @param file, The name of the file.
+  @returns The contents of the named file, or nil.
+*/
+- (NSData *)dataFromFixture:(NSString *)file {
+  NSString *path = [[NSBundle bundleForClass:[self class]] pathForResource:file ofType:nil];
+  return [NSData dataWithContentsOfFile:path];
+}
+
+#pragma mark - SNTCommandSyncStage Tests
+
+- (void)testBaseFetchXSRFTokenSuccess {
+  // NOTE: This test only works if the other tests don't return a 403 and run before this test.
+  // The XSRF fetching code is inside a dispatch_once.
+
+  // Stub initial failing request
+  NSURLResponse *resp = [self responseWithCode:403 headerDict:nil];
+  [self stubRequestBody:nil response:resp error:nil validateBlock:^BOOL(NSURLRequest *req) {
+    return ([req.URL.absoluteString containsString:@"/a/"] &&
+            ![req valueForHTTPHeaderField:@"X-XSRF-TOKEN"]);
+  }];
+
+  // Stub XSRF token request
+  resp = [self responseWithCode:200 headerDict:@{ @"X-XSRF-TOKEN": @"my-xsrf-token" }];
+  [self stubRequestBody:nil response:resp error:nil validateBlock:^BOOL(NSURLRequest *req) {
+    return [req.URL.absoluteString containsString:@"/xsrf/"];
+  }];
+
+  // Stub succeeding request
+  [self stubRequestBody:nil response:nil error:nil validateBlock:^BOOL(NSURLRequest *req) {
+    return ([req.URL.absoluteString containsString:@"/a/"] &&
+            [[req valueForHTTPHeaderField:@"X-XSRF-TOKEN"] isEqual:@"my-xsrf-token"]);
+  }];
+
+  NSString *stageName = [@"a" stringByAppendingFormat:@"/%@", self.syncState.machineID];
+  NSURL *u1 = [NSURL URLWithString:stageName relativeToURL:self.syncState.syncBaseURL];
+
+  SNTCommandSyncStage *sut = [[SNTCommandSyncStage alloc] initWithState:self.syncState];
+  NSMutableURLRequest *req = [NSMutableURLRequest requestWithURL:u1];
+  XCTAssertTrue([sut performRequest:req]);
+  XCTAssertEqualObjects(self.syncState.xsrfToken, @"my-xsrf-token");
+}
+
+#pragma mark - SNTCommandSyncPreflight Tests
+
+- (void)testPreflightBasicResponse {
+  SNTCommandSyncPreflight *sut = [[SNTCommandSyncPreflight alloc] initWithState:self.syncState];
+
+  NSData *respData = [self dataFromFixture:@"sync_preflight_basic.json"];
+  [self stubRequestBody:respData response:nil error:nil validateBlock:nil];
+
+  XCTAssertTrue([sut sync]);
+  XCTAssertEqual(self.syncState.clientMode, SNTClientModeMonitor);
+  XCTAssertEqual(self.syncState.eventBatchSize, 100);
+  XCTAssertNil(self.syncState.whitelistRegex);
+  XCTAssertNil(self.syncState.blacklistRegex);
+}
+
+- (void)testPreflightDatabaseCounts {
+  SNTCommandSyncPreflight *sut = [[SNTCommandSyncPreflight alloc] initWithState:self.syncState];
+
+  int64_t bin = 5, cert = 8;
+  OCMStub([self.daemonConnRop databaseRuleCounts:([OCMArg invokeBlockWithArgs:OCMOCK_VALUE(bin),
+                                                                              OCMOCK_VALUE(cert),
+                                                                              nil])]);
+
+  [self stubRequestBody:nil response:nil error:nil validateBlock:^BOOL(NSURLRequest *req) {
+    NSDictionary *requestDict = [self dictFromRequest:req];
+    XCTAssertEqualObjects(requestDict[kBinaryRuleCount], @(5));
+    XCTAssertEqualObjects(requestDict[kCertificateRuleCount], @(8));
+    return YES;
+  }];
+
+  [sut sync];
+}
+
+- (void)testPreflightCleanSync {
+  SNTCommandSyncPreflight *sut = [[SNTCommandSyncPreflight alloc] initWithState:self.syncState];
+
+  id processInfoMock = OCMClassMock([NSProcessInfo class]);
+  OCMStub([processInfoMock processInfo]).andReturn(processInfoMock);
+  [OCMStub([processInfoMock arguments]) andReturn:@[ @"xctest", @"--clean" ]];
+
+  NSData *respData = [self dataFromDict:@{ kCleanSync: @YES }];
+  [self stubRequestBody:respData response:nil error:nil validateBlock:^BOOL(NSURLRequest *req) {
+    NSDictionary *requestDict = [self dictFromRequest:req];
+    XCTAssertEqualObjects(requestDict[kRequestCleanSync], @YES);
+    return YES;
+  }];
+
+  [sut sync];
+
+  XCTAssertEqual(self.syncState.cleanSync, YES);
+}
+
+- (void)testPreflightLockdown {
+  SNTCommandSyncPreflight *sut = [[SNTCommandSyncPreflight alloc] initWithState:self.syncState];
+
+  NSData *respData = [self dataFromFixture:@"sync_preflight_lockdown.json"];
+  [self stubRequestBody:respData response:nil error:nil validateBlock:nil];
+
+  [sut sync];
+
+  XCTAssertEqual(self.syncState.clientMode, SNTClientModeLockdown);
+}
+
+#pragma mark - SNTCommandSyncEventUpload Tests
+
+- (void)testEventUploadBasic {
+  SNTCommandSyncEventUpload *sut = [[SNTCommandSyncEventUpload alloc] initWithState:self.syncState];
+  self.syncState.eventBatchSize = 50;
+
+  NSData *eventData = [self dataFromFixture:@"sync_eventupload_input_basic.plist"];
+  NSArray *events = [NSKeyedUnarchiver unarchiveObjectWithData:eventData];
+
+  OCMStub([self.daemonConnRop databaseEventsPending:([OCMArg invokeBlockWithArgs:events, nil])]);
+
+  [self stubRequestBody:nil response:nil error:nil validateBlock:^BOOL(NSURLRequest *req) {
+    NSDictionary *requestDict = [self dictFromRequest:req];
+    NSArray *events = requestDict[@"events"];
+
+    XCTAssertEqual(events.count, 2);
+
+    NSDictionary *event = events[0];
+    XCTAssertEqualObjects(event[@"file_sha256"],
+                          @"ff98fa0c0a1095fedcbe4d388a9760e71399a5c3c017a847ffa545663b57929a");
+    XCTAssertEqualObjects(event[@"file_name"], @"yes");
+    XCTAssertEqualObjects(event[@"file_path"], @"/usr/bin");
+    XCTAssertEqualObjects(event[@"decision"], @"BLOCK_BINARY");
+    NSArray *sessions = @[ @"foouser@console", @"foouser@ttys000"];
+    XCTAssertEqualObjects(event[@"current_sessions"], sessions);
+    NSArray *users = @[ @"foouser" ];
+    XCTAssertEqualObjects(event[@"logged_in_users"], users);
+    XCTAssertEqualObjects(event[@"executing_user"], @"root");
+    XCTAssertEqualObjects(event[@"pid"], @(11196));
+    XCTAssertEqualObjects(event[@"ppid"], @(10760));
+    XCTAssertEqualObjects(event[@"execution_time"], @(1464201698.537635));
+
+    NSArray *certs = event[@"signing_chain"];
+    XCTAssertEqual(certs.count, 3);
+
+    NSDictionary *cert = [certs firstObject];
+    XCTAssertEqualObjects(cert[@"sha256"],
+                          @"2aa4b9973b7ba07add447ee4da8b5337c3ee2c3a991911e80e7282e8a751fc32");
+    XCTAssertEqualObjects(cert[@"cn"], @"Software Signing");
+    XCTAssertEqualObjects(cert[@"org"], @"Apple Inc.");
+    XCTAssertEqualObjects(cert[@"ou"], @"Apple Software");
+    XCTAssertEqualObjects(cert[@"valid_from"], @(1365806075));
+    XCTAssertEqualObjects(cert[@"valid_until"], @(1618266875));
+
+    event = events[1];
+    XCTAssertEqualObjects(event[@"file_name"], @"hub");
+    XCTAssertEqualObjects(event[@"executing_user"], @"foouser");
+    certs = event[@"signing_chain"];
+    XCTAssertEqual(certs.count, 0);
+
+    return YES;
+  }];
+
+  [sut sync];
+}
+
+- (void)testEventUploadBundleAndQuarantineData {
+  SNTCommandSyncEventUpload *sut = [[SNTCommandSyncEventUpload alloc] initWithState:self.syncState];
+  sut = OCMPartialMock(sut);
+  OCMStub([sut findRelatedBinaries:OCMOCK_ANY]);
+
+  NSData *eventData = [self dataFromFixture:@"sync_eventupload_input_quarantine.plist"];
+  NSArray *events = [NSKeyedUnarchiver unarchiveObjectWithData:eventData];
+  OCMStub([self.daemonConnRop databaseEventsPending:([OCMArg invokeBlockWithArgs:events, nil])]);
+
+  [self stubRequestBody:nil response:nil error:nil validateBlock:^BOOL(NSURLRequest *req) {
+    NSDictionary *requestDict = [self dictFromRequest:req];
+    NSArray *events = requestDict[@"events"];
+
+    XCTAssertEqual(events.count, 1);
+
+    NSDictionary *event = [events firstObject];
+    XCTAssertEqualObjects(event[@"file_bundle_id"], @"com.luckymarmot.Paw");
+    XCTAssertEqualObjects(event[@"file_bundle_path"], @"/Applications/Paw.app");
+    XCTAssertEqualObjects(event[@"file_bundle_version"], @"2003004001");
+    XCTAssertEqualObjects(event[@"file_bundle_version_string"], @"2.3.4");
+    XCTAssertEqualObjects(event[@"quarantine_timestamp"], @(1464204868));
+    XCTAssertEqualObjects(event[@"quarantine_agent_bundle_id"], @"com.google.Chrome");
+    XCTAssertEqualObjects(event[@"quarantine_data_url"],
+                          @"https://d3hevc2w7wq7nj.cloudfront.net/paw/Paw-2.3.4-2003004001.zip");
+    XCTAssertEqualObjects(event[@"quarantine_referer_url"], @"https://luckymarmot.com/paw");
+
+    return YES;
+  }];
+  
+  [sut sync];
+}
+
+- (void)testEventUploadBatching {
+  SNTCommandSyncEventUpload *sut = [[SNTCommandSyncEventUpload alloc] initWithState:self.syncState];
+  self.syncState.eventBatchSize = 1;
+  sut = OCMPartialMock(sut);
+  OCMStub([sut findRelatedBinaries:OCMOCK_ANY]);
+
+  NSData *eventData = [self dataFromFixture:@"sync_eventupload_input_basic.plist"];
+  NSArray *events = [NSKeyedUnarchiver unarchiveObjectWithData:eventData];
+  OCMStub([self.daemonConnRop databaseEventsPending:([OCMArg invokeBlockWithArgs:events, nil])]);
+
+  __block int requestCount;
+
+  [self stubRequestBody:nil response:nil error:nil validateBlock:^BOOL(NSURLRequest *req) {
+    requestCount++;
+    return YES;
+  }];
+
+  [sut sync];
+
+  XCTAssertEqual(requestCount, 2);
+}
+
+#pragma mark - SNTCommandSyncRuleDownload Tests
+
+- (void)testRuleDownload {
+  SNTCommandSyncRuleDownload *sut =
+      [[SNTCommandSyncRuleDownload alloc] initWithState:self.syncState];
+
+  NSData *respData = [self dataFromFixture:@"sync_ruledownload_batch1.json"];
+  [self stubRequestBody:respData response:nil error:nil validateBlock:^BOOL(NSURLRequest *req) {
+    NSDictionary *requestDict = [self dictFromRequest:req];
+    return requestDict[@"cursor"] == nil;
+  }];
+
+  respData = [self dataFromFixture:@"sync_ruledownload_batch2.json"];
+  [self stubRequestBody:respData response:nil error:nil validateBlock:^BOOL(NSURLRequest *req) {
+    NSDictionary *requestDict = [self dictFromRequest:req];
+    return requestDict[@"cursor"] != nil;
+  }];
+
+  // Stub out the call to invoke the block, verification of the input is later
+  OCMStub([self.daemonConnRop databaseRuleAddRules:OCMOCK_ANY
+                                        cleanSlate:NO
+                                             reply:([OCMArg invokeBlockWithArgs:[NSNull null], nil])]);
+  [sut sync];
+
+  NSArray *rules = @[
+    [[SNTRule alloc] initWithShasum:@"ee382e199f7eda58863a93a7854b930ade35798bc6856ee8e6ab6ce9277f0eab"
+                              state:SNTRuleStateBlacklist
+                               type:SNTRuleTypeBinary
+                          customMsg:@""],
+    [[SNTRule alloc] initWithShasum:@"46f8c706d0533a54554af5fc163eea704f10c08b30f8a5db12bfdc04fb382fc3"
+                              state:SNTRuleStateWhitelist
+                               type:SNTRuleTypeCertificate
+                          customMsg:@""],
+    [[SNTRule alloc] initWithShasum:@"7846698e47ef41be80b83fb9e2b98fa6dc46c9188b068bff323c302955a00142"
+                              state:SNTRuleStateBlacklist
+                               type:SNTRuleTypeCertificate
+                          customMsg:@"Hi There"],
+  ];
+
+  OCMVerify([self.daemonConnRop databaseRuleAddRules:rules cleanSlate:NO reply:OCMOCK_ANY]);
+}
+
+@end

Tests/LogicTests/SNTDERDecoderTest.m

@@ -1,61 +0,0 @@
-/// Copyright 2015 Google Inc. All rights reserved.
-///
-/// Licensed under the Apache License, Version 2.0 (the "License");
-/// you may not use this file except in compliance with the License.
-/// You may obtain a copy of the License at
-///
-///    http://www.apache.org/licenses/LICENSE-2.0
-///
-///    Unless required by applicable law or agreed to in writing, software
-///    distributed under the License is distributed on an "AS IS" BASIS,
-///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-///    See the License for the specific language governing permissions and
-///    limitations under the License.
-
-#import <XCTest/XCTest.h>
-
-#import "SNTDERDecoder.h"
-
-@interface SNTDERDecoder (Testing)
-+ (NSString *)decodeOIDWithBytes:(unsigned char *)bytes length:(NSUInteger)length;
-@end
-
-@interface SNTDERDecoderTest : XCTestCase
-@end
-
-@implementation SNTDERDecoderTest
-
-- (void)setUp {
-  [super setUp];
-}
-
-- (void)tearDown {
-  [super tearDown];
-}
-
-- (void)testAllFields {
-  NSString *file = [[NSBundle bundleForClass:[self class]] pathForResource:@"dn" ofType:@"plist"];
-  NSArray *distinguishedNames = [NSArray arrayWithContentsOfFile:file];
-
-  SNTDERDecoder *sut = [[SNTDERDecoder alloc] initWithData:[distinguishedNames firstObject]];
-  XCTAssertEqualObjects(sut.commonName, @"auth.server.com");
-  XCTAssertEqualObjects(sut.organizationName, @"Internet Widgits Pty Ltd");
-  XCTAssertEqualObjects(sut.organizationalUnit, @"Awesome Authentication Authority");
-  XCTAssertEqualObjects(sut.countryName, @"US");
-}
-
-- (void)testOIDDecoding {
-  unsigned char oidBytes1[] = {0x2b, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x15, 0x14};
-  NSString *oidStr = [SNTDERDecoder decodeOIDWithBytes:oidBytes1 length:sizeof(oidBytes1)];
-  XCTAssertEqualObjects(oidStr, @"1.3.6.1.4.1.311.21.20");
-
-  unsigned char oidBytes2[] = {0x2b, 0x06, 0x01, 0x04, 0x01, 0xAB, 0x0E, 0x01, 0x05, 0x2F};
-  oidStr = [SNTDERDecoder decodeOIDWithBytes:oidBytes2 length:sizeof(oidBytes2)];
-  XCTAssertEqualObjects(oidStr, @"1.3.6.1.4.1.5518.1.5.47");
-
-  unsigned char oidBytes3[] = {0x56, 0x04, 0x0A};
-  oidStr = [SNTDERDecoder decodeOIDWithBytes:oidBytes3 length:sizeof(oidBytes3)];
-  XCTAssertEqualObjects(oidStr, @"2.6.4.10");
-}
-
-@end

Tests/LogicTests/SNTFileWatcherTest.m

@@ -54,7 +54,7 @@
 - (void)testInitFileExists {
   __weak XCTestExpectation *exp = [self expectationWithDescription:@"Init: callback called"];
   __unused SNTFileWatcher *sut = [[SNTFileWatcher alloc] initWithFilePath:self.file
-                                                                  handler:^{
+                                                                  handler:^(unsigned long data) {
       [exp fulfill];
   }];
   [self waitForExpectationsWithTimeout:5.0 handler:nil];
@@ -65,7 +65,7 @@
 
   __weak XCTestExpectation *exp = [self expectationWithDescription:@"Init: callback called"];
   __unused SNTFileWatcher *sut = [[SNTFileWatcher alloc] initWithFilePath:self.file
-                                                                  handler:^{
+                                                                  handler:^(unsigned long data) {
       [exp fulfill];
   }];
 
@@ -77,7 +77,7 @@
   __block BOOL fulfilled = NO;
   __weak XCTestExpectation *exp = [self expectationWithDescription:@"Changed: callback called"];
   __unused SNTFileWatcher *sut = [[SNTFileWatcher alloc] initWithFilePath:self.file
-                                                                  handler:^{
+                                                                  handler:^(unsigned long data) {
       NSString *d = [NSString stringWithContentsOfFile:self.file
                                               encoding:NSUTF8StringEncoding
                                                  error:nil];
@@ -97,7 +97,7 @@
   __block BOOL fulfilled = NO;
   __weak XCTestExpectation *exp = [self expectationWithDescription:@"Replaced: callback called"];
   __unused SNTFileWatcher *sut = [[SNTFileWatcher alloc] initWithFilePath:self.file
-                                                                  handler:^{
+                                                                  handler:^(unsigned long data) {
       NSString *d = [NSString stringWithContentsOfFile:self.file
                                               encoding:NSUTF8StringEncoding
                                                  error:nil];
@@ -119,7 +119,7 @@
   __block BOOL fulfilled = NO;
   __weak XCTestExpectation *exp = [self expectationWithDescription:@"Extended: callback called"];
   __unused SNTFileWatcher *sut = [[SNTFileWatcher alloc] initWithFilePath:self.file
-                                                                  handler:^{
+                                                                  handler:^(unsigned long data) {
       int file = open(self.file.fileSystemRepresentation, O_RDONLY);
       char fileData[10];
       read(file, fileData, 10);