aikido-zen 1.0.2-aarch64-linux

data/lib/aikido/zen/attack_wave.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require_relative "cache"
+require_relative "attack_wave/helpers"
+
+module Aikido::Zen
+  module AttackWave
+    class Detector
+      def initialize(config: Aikido::Zen.config, clock: nil)
+        @config = config
+
+        @event_times = Cache.new(@config.attack_wave_max_cache_entries, ttl: @config.attack_wave_min_time_between_events, clock: clock)
+
+        @request_counts = Cache.new(@config.attack_wave_max_cache_entries, 0, ttl: @config.attack_wave_min_time_between_requests, clock: clock)
+      end
+
+      def attack_wave?(context)
+        client_ip = context.request.client_ip
+
+        return false unless client_ip
+
+        return false if @event_times[client_ip]
+
+        return false unless AttackWave::Helpers.web_scanner?(context)
+
+        request_count = @request_counts[client_ip] += 1
+
+        return false if request_count < @config.attack_wave_threshold
+
+        @event_times[client_ip] = Time.now.utc
+
+        true
+      end
+    end
+
+    class Request
+      # @return [String]
+      attr_reader :ip_address
+
+      # @return [String]
+      attr_reader :user_agent
+
+      # @return [String]
+      attr_reader :source
+
+      # @param ip_address [String]
+      # @param user_agent [String]
+      # @param source [String]
+      # @return [Aikido::Zen::AttackWave::Request]
+      def initialize(ip_address:, user_agent:, source:)
+        @ip_address = ip_address
+        @user_agent = user_agent
+        @source = source
+      end
+
+      def as_json
+        {
+          ipAddress: @ip_address,
+          userAgent: @user_agent,
+          source: @source
+        }.compact
+      end
+    end
+
+    class Attack
+      # @return [Hash<String, String>]
+      attr_reader :metadata
+
+      # @return [Aikido::Zen::Actor]
+      attr_reader :user
+
+      # @param metadata [Hash<String, String>]
+      # @param metadata [Aikido::Zen::Actor]
+      # @return [Aikido::Zen::AttackWave::Attack]
+      def initialize(metadata:, user:)
+        @metadata = metadata
+        @user = user
+      end
+
+      def as_json
+        {
+          metadata: @metadata.as_json,
+          user: @user.as_json
+        }.compact
+      end
+    end
+  end
+end

data/lib/aikido/zen/background_worker.rb

@@ -0,0 +1,52 @@
+module Aikido::Zen
+  # Generic background worker class backed by queue. Meant to be used by any
+  # background process that needs to do heavy tasks.
+  class BackgroundWorker
+    # @param block [block] A block that receives 1 message directly from the queue
+    def initialize(&block)
+      @queue = Queue.new
+      @block = block
+    end
+
+    # starts the background thread, blocking the thread until a new messages arrives
+    # or the queue is stopped.
+    def start
+      @thread = Thread.new do
+        while running? || actions?
+          action = wait_for_action
+          @block.call(action) unless action.nil?
+        end
+      end
+    end
+
+    def restart
+      stop
+      @queue = Queue.new # re-open the queue
+      start
+    end
+
+    # Drain the queue to do not lose any messages
+    def stop
+      @queue.close # stop accepting messages
+      @thread.join # wait for the queue to be drained
+    end
+
+    def enqueue(scan)
+      @queue.push(scan)
+    end
+
+    private
+
+    def actions?
+      !@queue.empty?
+    end
+
+    def running?
+      !@queue.closed?
+    end
+
+    def wait_for_action
+      @queue.pop(false)
+    end
+  end
+end

data/lib/aikido/zen/cache.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+module Aikido::Zen
+  class Cache
+    extend Forwardable
+
+    # @api private
+    # Visible for testing.
+    def_delegators :@data,
+      :size, :empty?
+
+    def initialize(capacity, default_value = nil, ttl:, clock: nil)
+      @default_value = default_value
+      @ttl = ttl
+      @clock = clock
+
+      @data = CappedMap.new(capacity, mode: :lru)
+    end
+
+    def key?(key)
+      @data.key?(key) && !@data[key].expired?
+    end
+
+    # @param key [Object] the key
+    # @param value [Object] the value
+    # @return [Object] the value that the key was set to
+    def []=(key, value)
+      if key?(key)
+        entry = @data[key]
+        entry.refresh
+        entry.value = value
+      else
+        @data[key] = CacheEntry.new(value, ttl: @ttl, clock: @clock)
+      end
+    end
+
+    def [](key)
+      if key?(key)
+        @data[key].value
+      else
+        @default_value
+      end
+    end
+
+    def delete(key)
+      if key?(key)
+        @data.delete(key).value
+      else
+        @data.delete(key)
+        nil
+      end
+    end
+
+    # @api private
+    # Visible for testing.
+    def to_a
+      @data.map { |key, entry| [key, entry.value] }
+    end
+
+    # @api private
+    # Visible for testing.
+    def to_h
+      to_a.to_h
+    end
+  end
+
+  class CacheEntry
+    attr_accessor :value
+
+    DEFAULT_CLOCK = -> { Process.clock_gettime(Process::CLOCK_MONOTONIC, :millisecond) }
+
+    # @param value [Object] the value
+    # @param ttl [Integer] the time-to-live in milliseconds
+    # @return [Aikido::Zen::CacheEntry]
+    def initialize(value, ttl:, clock: nil)
+      @value = value
+      @ttl = ttl
+      @clock = clock || DEFAULT_CLOCK
+
+      refresh
+    end
+
+    def refresh
+      @expires = @clock.call + @ttl
+    end
+
+    def expired?
+      @clock.call >= @expires
+    end
+  end
+end

data/lib/aikido/zen/capped_collections.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+require "forwardable"
+
+module Aikido::Zen
+  # @api private
+  #
+  # Provides a FIFO set with a maximum size. Adding an element after the
+  # capacity has been reached kicks the oldest element in the set out,
+  # while maintaining the uniqueness property of a set (relying on #eql?
+  # and #hash).
+  class CappedSet
+    include Enumerable
+    extend Forwardable
+
+    def_delegators :@data, :size, :empty?
+
+    # @return [Integer]
+    attr_reader :capacity
+
+    def initialize(capacity, mode: :fifo)
+      @data = CappedMap.new(capacity, mode: mode)
+    end
+
+    def <<(element)
+      @data[element] = nil
+      self
+    end
+    alias_method :add, :<<
+    alias_method :push, :<<
+
+    def each(&b)
+      @data.each_key(&b)
+    end
+
+    def as_json
+      map(&:as_json)
+    end
+  end
+
+  # @api private
+  #
+  # Provides a FIFO hash-like structure with a maximum size. Adding a new key
+  # after the capacity has been reached kicks the first element pair added out.
+  class CappedMap
+    include Enumerable
+    extend Forwardable
+
+    def_delegators :@data,
+      :delete, :key?,
+      :each, :each_key, :each_value,
+      :size, :empty?, :to_hash
+
+    # @return [Integer]
+    attr_reader :capacity
+
+    def initialize(capacity, mode: :fifo)
+      raise ArgumentError, "cannot set capacity lower than 1: #{capacity}" if capacity < 1
+
+      unless [:fifo, :lru].include?(mode)
+        raise ArgumentError, "unsupported mode: #{mode}"
+      end
+
+      @capacity = capacity
+      @mode = mode
+
+      @data = {}
+    end
+
+    def []=(key, value)
+      @data[key] = value
+      @data.delete(@data.each_key.first) if @data.size > @capacity
+    end
+
+    def [](key)
+      @data[key] = @data.delete(key) if @mode == :lru && key?(key)
+      @data[key]
+    end
+
+    def fetch(key, ...)
+      return self[key] if key?(key)
+
+      @data.fetch(key, ...)
+    end
+  end
+end

data/lib/aikido/zen/collector/event.rb

@@ -0,0 +1,238 @@
+# frozen_string_literal: true
+
+module Aikido::Zen
+  class Collector
+    class Event
+      @@registry = {}
+
+      # @api protected
+      def self.register(type)
+        const_set(:TYPE, type)
+        @@registry[type] = self
+      end
+
+      def self.from_json(data)
+        type = data[:type]
+        subclass = @@registry[type]
+        subclass.from_json(data)
+      end
+
+      attr_reader :type
+
+      def initialize
+        @type = self.class::TYPE
+      end
+
+      def as_json
+        {
+          type: @type
+        }
+      end
+
+      def handle(collector)
+        raise NotImplementedError, "implement in subclasses"
+      end
+    end
+
+    # @api private
+    module Events
+      class TrackRequest < Event
+        register "track_request"
+
+        def self.from_json(data)
+          new
+        end
+
+        def handle(collector)
+          collector.handle_track_request
+        end
+
+        def inspect
+          "#<#{self.class.name}>"
+        end
+      end
+
+      class TrackAttackWave < Event
+        register "track_attack_wave"
+
+        def self.from_json(data)
+          new(
+            being_blocked: data[:being_blocked]
+          )
+        end
+
+        def initialize(being_blocked:)
+          super()
+          @being_blocked = being_blocked
+        end
+
+        def as_json
+          super.update({
+            being_blocked: @being_blocked
+          })
+        end
+
+        def handle(collector)
+          collector.handle_track_attack_wave(being_blocked: @being_blocked)
+        end
+
+        def inspect
+          "#<#{self.class.name} #{@being_blocked}>"
+        end
+      end
+
+      class TrackScan < Event
+        register "track_scan"
+
+        def self.from_json(data)
+          new(
+            data[:sink_name],
+            data[:duration],
+            has_errors: data[:has_errors]
+          )
+        end
+
+        def initialize(sink_name, duration, has_errors:)
+          super()
+          @sink_name = sink_name
+          @duration = duration
+          @has_errors = has_errors
+        end
+
+        def as_json
+          super.update({
+            sink_name: @sink_name,
+            duration: @duration,
+            has_errors: @has_errors
+          })
+        end
+
+        def handle(collector)
+          collector.handle_track_scan(@sink_name, @duration, has_errors: @has_errors)
+        end
+
+        def inspect
+          "#<#{self.class.name} #{@sink_name} #{format "%0.6f", @duration} #{@has_errors}>"
+        end
+      end
+
+      class TrackAttack < Event
+        register "track_attack"
+
+        def self.from_json(data)
+          new(
+            data[:sink_name],
+            being_blocked: data[:being_blocked]
+          )
+        end
+
+        def initialize(sink_name, being_blocked:)
+          super()
+          @sink_name = sink_name
+          @being_blocked = being_blocked
+        end
+
+        def as_json
+          super.update({
+            sink_name: @sink_name,
+            being_blocked: @being_blocked
+          })
+        end
+
+        def handle(collector)
+          collector.handle_track_attack(@sink_name, being_blocked: @being_blocked)
+        end
+
+        def inspect
+          "#<#{self.class.name} #{@sink_name} #{@being_blocked}>"
+        end
+      end
+
+      class TrackUser < Event
+        register "track_user"
+
+        def self.from_json(data)
+          new(Aikido::Zen::Actor.from_json(data[:actor]))
+        end
+
+        def initialize(actor)
+          super()
+          @actor = actor
+        end
+
+        def as_json
+          super.update({
+            actor: @actor.as_json
+          })
+        end
+
+        def handle(collector)
+          collector.handle_track_user(@actor)
+        end
+
+        def inspect
+          "#<#{self.class.name} #{@actor.id} #{@actor.name}>"
+        end
+      end
+
+      class TrackOutbound < Event
+        register "track_outbound"
+
+        def self.from_json(data)
+          new(OutboundConnection.from_json(data[:connection]))
+        end
+
+        def initialize(connection)
+          super()
+          @connection = connection
+        end
+
+        def as_json
+          super.update({
+            connection: @connection.as_json
+          })
+        end
+
+        def handle(collector)
+          collector.handle_track_outbound(@connection)
+        end
+
+        def inspect
+          "#<#{self.class.name} #{@connection.host}:#{@connection.port}>"
+        end
+      end
+
+      class TrackRoute < Event
+        register "track_route"
+
+        def self.from_json(data)
+          new(
+            Route.from_json(data[:route]),
+            Request::Schema.from_json(data[:schema])
+          )
+        end
+
+        def initialize(route, schema)
+          super()
+          @route = route
+          @schema = schema
+        end
+
+        def as_json
+          super.update({
+            route: @route.as_json,
+            schema: @schema.as_json
+          })
+        end
+
+        def handle(collector)
+          collector.handle_track_route(@route, @schema)
+        end
+
+        def inspect
+          "#<#{self.class.name} #{@route.verb} #{@route.path.inspect}>"
+        end
+      end
+    end
+  end
+end

data/lib/aikido/zen/collector/hosts.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require_relative "../capped_collections"
+
+module Aikido::Zen
+  # @api private
+  #
+  # Keeps track of the hostnames to which the app has made outbound HTTP
+  # requests.
+  class Collector::Hosts < Aikido::Zen::CappedMap
+    def initialize(config = Aikido::Zen.config)
+      super(config.max_outbound_connections)
+    end
+
+    # @param host [Aikido::Zen::OutboundConnection]
+    # @return [void]
+    def add(host)
+      self[host] ||= host
+      self[host].hit
+    end
+
+    def each(&blk)
+      each_value(&blk)
+    end
+
+    def as_json
+      map(&:as_json)
+    end
+  end
+end

data/lib/aikido/zen/collector/routes.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require_relative "../request/schema/empty_schema"
+
+module Aikido::Zen
+  # @api private
+  #
+  # Keeps track of the visited routes.
+  class Collector::Routes
+    # @api private
+    # Visible for testing.
+    attr_reader :visits
+
+    def initialize(config = Aikido::Zen.config)
+      @config = config
+      @visits = Hash.new { |h, k| h[k] = Record.new }
+    end
+
+    # @param route [Aikido::Zen::Route] the route of the request
+    # @param schema [Aikido::Zen::Request::Schema] the schema for the request
+    # @return [void]
+    def add(route, schema)
+      @visits[route].increment(schema) unless route.nil?
+    end
+
+    def as_json
+      @visits.map do |route, record|
+        {
+          method: route.verb,
+          path: route.path,
+          hits: record.hits,
+          apispec: record.schema.as_json
+        }.compact
+      end
+    end
+
+    # @api private
+    # Visible for testing.
+    def [](route)
+      @visits[route]
+    end
+
+    # @api private
+    def empty?
+      @visits.empty?
+    end
+
+    # @api private
+    Record = Struct.new(:hits, :schema, :samples) do
+      def initialize(config = Aikido::Zen.config)
+        super(0, Aikido::Zen::Request::Schema::EMPTY_SCHEMA, 0)
+        @config = config
+      end
+
+      def increment(schema)
+        self.hits += 1
+
+        if sample_schema?
+          self.samples += 1
+          self.schema |= schema
+        end
+      end
+
+      private
+
+      def sample_schema?
+        samples < @config.api_schema_max_samples
+      end
+    end
+  end
+end