endpoint_security 0.1.0-universal-darwin

data/ext/endpoint_security/client.h

@@ -0,0 +1,88 @@
+#ifndef ESRB_CLIENT_H
+#define ESRB_CLIENT_H
+
+#include <EndpointSecurity/EndpointSecurity.h>
+#include <pthread.h>
+#include <ruby.h>
+#include <stdatomic.h>
+#include <stdbool.h>
+
+#include "queue.h"
+
+typedef struct {
+    _Atomic size_t sequence;
+    esrb_slot_t *slot;
+    size_t position;
+    uint64_t fire_at;
+} esrb_watchdog_request_t;
+
+typedef struct {
+    esrb_slot_t *slot;
+    size_t position;
+    uint64_t fire_at;
+} esrb_watchdog_entry_t;
+
+typedef struct {
+    size_t capacity;
+    size_t mask;
+    esrb_watchdog_request_t *requests;
+    _Atomic size_t enqueue_position;
+    _Atomic size_t dequeue_position;
+    esrb_watchdog_entry_t *heap;
+    size_t heap_size;
+    pthread_mutex_t mutex;
+    pthread_cond_t condition;
+} esrb_watchdog_t;
+
+typedef struct {
+    es_client_t *client;
+    esrb_queue_t queue;
+    int wakeup_fd[2];
+    pthread_t watchdog_thread;
+    esrb_watchdog_t watchdog;
+    bool watchdog_thread_started;
+    _Atomic bool watchdog_running;
+    _Atomic bool watchdog_stopped;
+    _Atomic bool delete_ready;
+    _Atomic bool client_ready;
+    _Atomic es_new_client_result_t creation_result;
+    _Atomic bool notified;
+    _Atomic bool closed;
+    _Atomic uint32_t active_callbacks;
+    _Atomic uint64_t dropped;
+    _Atomic uint64_t delivered;
+    _Atomic uint64_t timeouts;
+    _Atomic uint64_t response_errors;
+    _Atomic uint64_t delete_errors;
+    _Atomic uint64_t errors;
+    _Atomic uint64_t seq_gaps;
+    _Atomic uint64_t leaked_messages;
+    _Atomic uint64_t last_global_seq;
+    _Atomic bool seen_global_seq;
+    _Atomic uint64_t last_event_seq[ES_EVENT_TYPE_LAST];
+    _Atomic bool seen_event_seq[ES_EVENT_TYPE_LAST];
+    es_auth_result_t default_auth;
+    bool default_cache;
+    bool strict_cache;
+    bool strict_version;
+    bool warn_on_truncated_path;
+    double deadline_margin;
+    uint64_t min_margin_ticks;
+    pid_t owner_pid;
+} esrb_client_t;
+
+extern const rb_data_type_t esrb_client_type;
+
+void esrb_init_client(VALUE endpoint_security);
+void esrb_notify(esrb_client_t *client);
+es_respond_result_t esrb_send_response(esrb_client_t *client, es_client_t *native_client,
+    const es_message_t *message, es_auth_result_t result, uint32_t flags, bool cache);
+bool esrb_respond_slot(esrb_client_t *client, esrb_slot_t *slot, es_auth_result_t result, uint32_t flags, bool cache,
+    es_respond_result_t *response);
+bool esrb_watchdog_init(esrb_watchdog_t *watchdog, size_t capacity);
+void esrb_watchdog_destroy(esrb_watchdog_t *watchdog);
+void esrb_watchdog_abandon(esrb_watchdog_t *watchdog);
+bool esrb_watchdog_arm(esrb_watchdog_t *watchdog, esrb_slot_t *slot);
+void *esrb_watchdog_main(void *argument);
+
+#endif

data/ext/endpoint_security/endpoint_security.c

@@ -0,0 +1,17 @@
+/* endpoint_security.c
+ * Calling thread: Ruby VM thread with the GVL.
+ */
+#include <ruby.h>
+
+#include "client.h"
+#include "field.h"
+#include "message.h"
+
+RUBY_FUNC_EXPORTED void
+Init_endpoint_security(void)
+{
+    VALUE endpoint_security = rb_define_module("EndpointSecurity");
+    esrb_init_field(endpoint_security);
+    esrb_init_message(endpoint_security);
+    esrb_init_client(endpoint_security);
+}

data/ext/endpoint_security/extconf.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require "mkmf"
+require "open3"
+require "shellwords"
+
+abort "endpoint_security requires macOS 13 or newer" unless RUBY_PLATFORM.include?("darwin")
+macos_version, macos_status = Open3.capture2("sw_vers", "-productVersion")
+abort "endpoint_security requires macOS 13 or newer" unless macos_status.success? && macos_version.to_i >= 13
+
+sdk, status = Open3.capture2("xcrun", "--show-sdk-path")
+abort "xcrun could not locate the macOS SDK; install Xcode Command Line Tools" unless status.success?
+
+sdk = sdk.strip
+dir_config("endpoint_security", File.join(sdk, "usr/include"), File.join(sdk, "usr/lib"))
+$CFLAGS << " -std=c11 -fblocks -Wall -Wextra -Wno-unused-parameter -Werror=implicit-function-declaration"
+$CFLAGS << " -Wno-default-const-init-field-unsafe" if try_compile("int main(void) { return 0; }",
+                                                                  "-Werror -Wno-default-const-init-field-unsafe")
+$CFLAGS << " -fvisibility=hidden -mmacosx-version-min=13.0"
+$LDFLAGS << " -isysroot #{sdk.shellescape} -mmacosx-version-min=13.0"
+$INCFLAGS << " -I#{File.expand_path("../../support/esmock", __dir__).shellescape}"
+
+abort "EndpointSecurity headers are missing from #{sdk}" unless have_header("EndpointSecurity/EndpointSecurity.h")
+if ENV["ES_MOCK"] == "1"
+  $defs << "-DESRB_MOCK"
+  $LDFLAGS << " -L#{File.expand_path("../../build", __dir__).shellescape} -Wl,-rpath,@loader_path/../../build"
+  endpoint_security_found = have_library("esmock")
+else
+  endpoint_security_found = have_framework("EndpointSecurity") || have_library("EndpointSecurity")
+end
+abort "EndpointSecurity library is unavailable" unless endpoint_security_found
+abort "libbsm is unavailable" unless have_library("bsm")
+
+$VPATH << "$(srcdir)/generated"
+$srcs = Dir[File.join(__dir__, "*.c")].map { |path| File.basename(path) }
+$srcs << "es_schema.c" if File.exist?(File.join(__dir__, "generated/es_schema.c"))
+create_makefile("endpoint_security/endpoint_security")