aikido-zen 1.0.2-aarch64-linux

data/lib/aikido/zen/detached_agent/server.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require "fileutils"
+
+module Aikido::Zen::DetachedAgent
+  class Server
+    # Initialize and start a detached agent server instance.
+    #
+    # @return [Aikido::Zen::DetachedAgent::Server]
+    def self.start(**opts)
+      new(**opts).tap(&:start!)
+    end
+
+    def initialize(config: Aikido::Zen.config)
+      @started_at = nil
+
+      @config = config
+
+      @socket_path = config.detached_agent_socket_path
+      @socket_uri = config.detached_agent_socket_uri
+    end
+
+    def started?
+      !!@started_at
+    end
+
+    def start!
+      @config.logger.info("Starting DRb Server...")
+
+      # Try to ensure that the DRb service can start if the DRb service did
+      # not stop cleanly.
+      begin
+        # Check whether the Unix domain socket is in use by another process.
+        UNIXSocket.new(@socket_path).close
+      rescue Errno::ECONNREFUSED
+        @config.logger.debug("Removing residual Unix domain socket...")
+
+        # Remove the residual Unix domain socket.
+        FileUtils.rm_f(@socket_path)
+      rescue
+        # empty
+      end
+
+      @front = FrontObject.new
+
+      # If the Unix domain socket is in use by another process and/or the
+      # residual Unix domain socket could not be removed DRb will raise an
+      # appropriate error.
+      @drb_server = DRb.start_service(@socket_uri, @front)
+
+      # Only show DRb output in debug mode.
+      @drb_server.verbose = @config.logger.debug?
+
+      # Ensure that the DRb server is alive.
+      max_attempts = 10
+      attempts = 0
+      until @drb_server.alive?
+        @config.logger.info("DRb Server still not alive. #{max_attempts - attempts} attempts remaining")
+        sleep 0.1
+        attempts += 1
+        raise Aikido::Zen::DetachedAgentError.new("Impossible to start the dRB server (socket=#{Aikido::Zen.config.detached_agent_socket_path})") \
+          if attempts == max_attempts
+      end
+
+      @started_at = Time.now.utc
+
+      at_exit { stop! if started? }
+    end
+
+    def stop!
+      @config.logger.info("Stopping DRb Server...")
+      @started_at = nil
+
+      @drb_server.stop_service if @drb_server.alive?
+      DRb.stop_service
+    end
+  end
+end

data/lib/aikido/zen/detached_agent.rb

@@ -0,0 +1,2 @@
+require_relative "detached_agent/agent"
+require_relative "detached_agent/server"

data/lib/aikido/zen/errors.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+require "forwardable"
+
+module Aikido
+  # @!visibility private
+  # Support rescuing Aikido::Error without forcing a single base class to all
+  # errors (so things that should be e.g. a TypeError, can have the correct
+  # superclass).
+  module Error; end # :nodoc:
+
+  # @!visibility private
+  # Generic error for problems with the Agent.
+  class ZenError < RuntimeError
+    include Error
+  end
+
+  module Zen
+    # Wrapper for all low-level network errors communicating with the API. You
+    # can access the original error by calling #cause.
+    class NetworkError < StandardError
+      include Error
+
+      def initialize(request, cause = nil)
+        @request = request.dup
+
+        super("Error in #{request.method} #{request.path}: #{cause.message}")
+      end
+    end
+
+    # Raised whenever a request to the API results in a 4XX or 5XX response.
+    class APIError < StandardError
+      include Error
+
+      attr_reader :request
+      attr_reader :response
+
+      def initialize(request, response)
+        @request = anonimize_token(request.dup)
+        @response = response
+
+        super("Error in #{request.method} #{request.path}: #{response.code} #{response.message} (#{response.body})")
+      end
+
+      private def anonimize_token(request)
+        # Anonimize the token to `********************xxxx`,
+        # mimicking what we show in the dashbaord.
+        request["Authorization"] = request["Authorization"].to_s
+          .gsub(/\A.*(.{4})\z/, ("*" * 20) + "\\1")
+        request
+      end
+    end
+
+    # Raised whenever a response to the API results in a 429 response.
+    class RateLimitedError < APIError; end
+
+    class UnderAttackError < StandardError
+      include Error
+
+      attr_reader :attack
+
+      def initialize(attack)
+        @attack = attack
+      end
+    end
+
+    class SQLInjectionError < UnderAttackError
+      extend Forwardable
+      def_delegators :@attack, :query, :input, :dialect
+    end
+
+    class SSRFDetectedError < UnderAttackError
+      extend Forwardable
+      def_delegators :@attack, :request, :input
+    end
+
+    class PathTraversalError < UnderAttackError
+      extend Forwardable
+      def_delegators :@attack, :input
+    end
+
+    class ShellInjectionError < UnderAttackError
+      extend Forwardable
+      def_delegators :@attack, :input
+    end
+
+    # Raised when there's any problem communicating (or loading) libzen.
+    class InternalsError < ZenError
+      # @param attempt [String] description of what we were trying to do.
+      # @param problem [String] what couldn't be done.
+      # @param libname [String] the name of the file (including the arch).
+      def initialize(attempt, problem, libname)
+        super(format(<<~MSG.chomp, attempt, problem, libname))
+          Zen could not scan %s due to a problem %s the library `%s'
+        MSG
+      end
+    end
+
+    class DetachedAgentError < ZenError
+      extend Forwardable
+
+      def initialize(msg)
+        super
+      end
+    end
+  end
+end

data/lib/aikido/zen/event.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+module Aikido::Zen
+  # Base class for all events. You should be using one of the subclasses defined
+  # in the Events module.
+  class Event
+    attr_reader :type
+    attr_reader :time
+    attr_reader :system_info
+
+    def initialize(type:, system_info: Aikido::Zen.system_info, time: Time.now.utc)
+      @type = type
+      @time = time
+      @system_info = system_info
+    end
+
+    def as_json
+      {
+        type: type,
+        time: time.to_i * 1000,
+        agent: system_info.as_json
+      }
+    end
+  end
+
+  module Events
+    # Event sent when starting up the agent.
+    class Started < Event
+      def initialize(**opts)
+        super(type: "started", **opts)
+      end
+    end
+
+    class Attack < Event
+      attr_reader :attack
+
+      def initialize(attack:, **opts)
+        @attack = attack
+        super(type: "detected_attack", **opts)
+      end
+
+      def as_json
+        super.update(
+          {
+            attack: @attack.as_json,
+            request: @attack.context&.request&.as_json
+          }.compact
+        )
+      end
+    end
+
+    class Heartbeat < Event
+      def initialize(stats:, users:, hosts:, routes:, middleware_installed:, **opts)
+        super(type: "heartbeat", **opts)
+        @stats = stats
+        @users = users
+        @hosts = hosts
+        @routes = routes
+        @middleware_installed = middleware_installed
+      end
+
+      def as_json
+        super.update(
+          stats: @stats.as_json,
+          users: @users.as_json,
+          routes: @routes.as_json,
+          hostnames: @hosts.as_json,
+          middlewareInstalled: @middleware_installed
+        )
+      end
+    end
+
+    class AttackWave < Event
+      # @param [Aikido::Zen::Context] a context
+      # @return [Aikido::Zen::Events::AttackWave] an attack wave event
+      def self.from_context(context)
+        request = Aikido::Zen::AttackWave::Request.new(
+          ip_address: context.request.client_ip,
+          user_agent: context.request.user_agent,
+          source: context.request.framework
+        )
+
+        attack = Aikido::Zen::AttackWave::Attack.new(
+          metadata: {}, # not used yet
+          user: context.request.actor
+        )
+
+        new(request: request, attack: attack)
+      end
+
+      # @return [Aikido::Zen::AttackWave::Request]
+      attr_reader :request
+
+      # @return [Aikido::Zen::AttackWave::Attack]
+      attr_reader :attack
+
+      # @param [Aikido::Zen::AttackWave::Request] the attack wave request
+      # @param [Aikido::Zen::AttackWave::Attack] the attack wave attack
+      # @param opts [Hash<Symbol, Object>] any other options to pass to
+      #   the superclass initializer.
+      # @return [Aikido::Zen::Events::AttackWave] an attack wave event
+      def initialize(request:, attack:, **opts)
+        super(type: "detected_attack_wave", **opts)
+        @request = request
+        @attack = attack
+      end
+
+      def as_json
+        super.update(
+          request: @request.as_json,
+          attack: @attack.as_json
+        )
+      end
+    end
+  end
+end

data/lib/aikido/zen/helpers.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Aikido
+  module Zen
+    # @api private
+    module Helpers
+      # Normalizes a path by:
+      #
+      #   1. Collapsing consecutive forward slashes into a single forward slash.
+      #   2. Removing forward trailing slash, unless the normalized path is "/".
+      #
+      # @param path [String, nil] the path to normalize.
+      # @return [String, nil] the normalized path.
+      def self.normalize_path(path)
+        return path unless path
+
+        normalized_path = path.dup
+        normalized_path.squeeze!("/")
+        normalized_path.chomp!("/") unless normalized_path == "/"
+        normalized_path
+      end
+    end
+  end
+end

data/lib/aikido/zen/internals.rb

@@ -0,0 +1,123 @@
+# frozen_string_literal: true
+
+require "ffi"
+require_relative "errors"
+
+module Aikido::Zen
+  module Internals
+    extend FFI::Library
+
+    def self.libzen_names
+      lib_name = "libzen-v#{LIBZEN_VERSION}"
+      lib_ext = FFI::Platform::LIBSUFFIX
+
+      # Gem::Platform#version should be understood as an arbitrary Ruby defined
+      # OS specific string. A platform with a version string is considered more
+      # specific than a platform without a version string.
+      # https://docs.ruby-lang.org/en/3.3/Gem/Platform.html
+
+      platform = Gem::Platform.local.dup
+
+      # Library names in preferred order.
+      #
+      # If two library names are added, the specific platform library names is
+      # first and the generic platform library name is second.
+      names = []
+
+      names << "#{lib_name}-#{platform}.#{lib_ext}"
+
+      unless platform.version.nil?
+        platform.version = nil
+        names << "#{lib_name}-#{platform}.#{lib_ext}"
+      end
+
+      names
+    end
+
+    # @return [String] the name of the extension we're loading, which we can
+    # use in error messages.
+    def self.libzen_name
+      # The most generic platform library name.
+      libzen_names.last
+    end
+
+    # Load the most specific library
+    def self.load_libzen
+      libzen_names.each do |name|
+        path = File.expand_path(name, __dir__)
+        begin
+          return ffi_lib(path)
+        rescue LoadError
+          # empty
+        end
+      end
+      raise LoadError, "Zen could not load its native extension #{libzen_name}"
+    end
+
+    begin
+      load_libzen
+
+      # @!method self.detect_sql_injection_native(query, input, dialect)
+      # @param (see .detect_sql_injection)
+      # @returns [Integer] 0 if no injection detected, 1 if an injection was
+      #   detected, 2 if there was an internal error, or 3 if SQL tokenization failed.
+      # @raise [Aikido::Zen::InternalsError] if there's a problem loading or
+      #   calling libzen.
+      attach_function :detect_sql_injection_native, :detect_sql_injection,
+        [:pointer, :size_t, :pointer, :size_t, :int], :int
+    rescue LoadError, FFI::NotFoundError => err # rubocop:disable Lint/ShadowedException
+      # :nocov:
+
+      # Emit an $stderr warning at startup.
+      warn "Zen could not load its native extension #{libzen_name}: #{err}"
+
+      def self.detect_sql_injection(query, *)
+        attempt = format("%p for SQL injection", query)
+        raise InternalsError.new(attempt, "loading", libzen_name)
+      end
+
+      # :nocov:
+    else
+      # Analyzes the SQL query to detect if the provided user input is being
+      # passed as-is without escaping.
+      #
+      # @param query [String]
+      # @param input [String]
+      # @param dialect [Integer, #to_int] the SQL Dialect identifier in libzen.
+      #   See {Aikido::Zen::Scanners::SQLInjectionScanner::DIALECTS}.
+      #
+      # @returns [Boolean]
+      # @raise [Aikido::Zen::InternalsError] if there's a problem loading or
+      #   calling libzen.
+      def self.detect_sql_injection(query, input, dialect)
+        query_bytes = encode_safely(query)
+        input_bytes = encode_safely(input)
+
+        query_ptr = FFI::MemoryPointer.new(:uint8, query_bytes.bytesize)
+        input_ptr = FFI::MemoryPointer.new(:uint8, input_bytes.bytesize)
+
+        query_ptr.put_bytes(0, query_bytes)
+        input_ptr.put_bytes(0, input_bytes)
+
+        case detect_sql_injection_native(query_ptr, query_bytes.bytesize, input_ptr, input_bytes.bytesize, dialect)
+        when 0 then false
+        when 1 then true
+        when 2
+          attempt = format("%s query %p with input %p", dialect, query, input)
+          raise InternalsError.new(attempt, "calling detect_sql_injection in", libzen_name)
+        when 3
+          # SQL tokenization failed - return false (no injection detected)
+          false
+        end
+      end
+    end
+
+    class << self
+      private
+
+      def encode_safely(string)
+        string.encode("UTF-8", invalid: :replace, undef: :replace)
+      end
+    end
+  end
+end

data/lib/aikido/zen/middleware/allowed_address_checker.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Aikido::Zen
+  module Middleware
+    # Middleware that rejects requests from IPs blocked in the Aikido dashboard.
+    class AllowedAddressChecker
+      def initialize(app, config: Aikido::Zen.config, settings: Aikido::Zen.runtime_settings)
+        @app = app
+        @config = config
+        @settings = settings
+      end
+
+      def call(env)
+        request = Aikido::Zen::Middleware.request_from(env)
+
+        allowed_ips = @settings.endpoints[request.route].allowed_ips
+
+        if allowed_ips.empty? || allowed_ips.include?(request.ip)
+          @app.call(env)
+        else
+          @config.blocked_responder.call(request, :ip)
+        end
+      end
+    end
+  end
+end

data/lib/aikido/zen/middleware/attack_wave_protector.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module Aikido
+  module Zen
+    module Middleware
+      class AttackWaveProtector
+        def initialize(app, zen: Aikido::Zen, settings: Aikido::Zen.runtime_settings)
+          @app = app
+          @zen = zen
+          @settings = settings
+        end
+
+        def call(env)
+          response = @app.call(env)
+
+          context = @zen.current_context
+          protect(context)
+
+          response
+        end
+
+        # @api private
+        # Visible for testing.
+        def attack_wave?(context)
+          request = context.request
+          return false if request.nil?
+
+          # Bypass attack wave protection for allowed IPs
+          return false if @settings.allowed_ips.include?(request.ip)
+
+          @zen.attack_wave_detector.attack_wave?(context)
+        end
+
+        # @api private
+        # Visible for testing.
+        def protect(context)
+          if attack_wave?(context)
+            attack_wave = Aikido::Zen::Events::AttackWave.from_context(context)
+            @zen.track_attack_wave(attack_wave)
+            @zen.agent.report(attack_wave)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/aikido/zen/middleware/context_setter.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require_relative "../context"
+
+module Aikido::Zen
+  # @!visibility private
+  ENV_KEY = "aikido.context"
+
+  module Middleware
+    # Rack middleware that keeps the current context in a Thread/Fiber-local
+    # variable so that other parts of the agent/firewall can access it.
+    class ContextSetter
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        Aikido::Zen.current_context = env[ENV_KEY] = Context.from_rack_env(env)
+
+        @app.call(env)
+      ensure
+        Aikido::Zen.current_context = nil
+      end
+    end
+  end
+end

data/lib/aikido/zen/middleware/fork_detector.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Aikido
+  module Zen
+    module Middleware
+      # This middleware is responsible for detecting when a process has forked
+      # (e.g., in a Puma or Unicorn worker) and resetting the state of the
+      # Aikido Zen agent. It should be inserted early in the middleware stack.
+      class ForkDetector
+        def initialize(app)
+          @app = app
+        end
+
+        def call(env)
+          # This is the single, reliable trigger point for the fork check.
+          Aikido::Zen.check_and_handle_fork
+
+          @app.call(env)
+        end
+      end
+    end
+  end
+end

data/lib/aikido/zen/middleware/middleware.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Aikido::Zen::Middleware
+  def self.request_from(env)
+    if (current_context = Aikido::Zen.current_context)
+      current_context.request
+    else
+      Aikido::Zen::Context.from_rack_env(env).request
+    end
+  end
+end

data/lib/aikido/zen/middleware/rack_throttler.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require_relative "../context"
+
+module Aikido::Zen
+  module Middleware
+    # Rack middleware that rejects requests from clients that are making too many
+    # requests to a given endpoint, based in the runtime configuration in the
+    # Aikido dashboard.
+    class RackThrottler
+      def initialize(
+        app,
+        config: Aikido::Zen.config,
+        settings: Aikido::Zen.runtime_settings,
+        detached_agent: Aikido::Zen.detached_agent
+      )
+        @app = app
+        @config = config
+        @settings = settings
+        @detached_agent = detached_agent
+      end
+
+      def call(env)
+        request = Aikido::Zen::Middleware.request_from(env)
+
+        if should_throttle?(request)
+          @config.rate_limited_responder.call(request)
+        else
+          @app.call(env)
+        end
+      end
+
+      private
+
+      def should_throttle?(request)
+        # Bypass rate limiting for allowed IPs
+        return false if @settings.allowed_ips.include?(request.ip)
+
+        return false unless @settings.endpoints[request.route].rate_limiting.enabled?
+
+        result = @detached_agent.calculate_rate_limits(request)
+
+        return false unless result
+
+        request.env["aikido.rate_limiting"] = result
+        request.env["aikido.rate_limiting"].throttled?
+      end
+    end
+  end
+end