contrast-agent 3.10.2 → 3.13.0

data/lib/contrast/agent/scope.rb

@@ -99,12 +99,6 @@ module Contrast
         send(call)
       end
 
-      def with_scope name, &block
-        cs__class.ensure_valid_scope! name
-        call = with_contrast_scope { :"with_#{ name }_scope" }
-        send(call, &block)
-      end
-
       class << self
         def valid_scope? scope_sym
           Contrast::Agent::Scope::SCOPE_LIST.include? scope_sym
@@ -113,7 +107,7 @@ module Contrast
         def ensure_valid_scope! scope_sym
           unless valid_scope? scope_sym # rubocop:disable Style/GuardClause
             with_contrast_scope do
-              raise NotImplementedError, "Scope '#{ scope_sym.inspect }' is not registered as a scope."
+              raise NoMethodError, "Scope '#{ scope_sym.inspect }' is not registered as a scope."
             end
           end
         end

data/lib/contrast/agent/service_heartbeat.rb

@@ -2,39 +2,36 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/agent/worker_thread'
 
 module Contrast
   module Agent
     # The ServiceHeartbeat functions to keep the Contrast Service alive and
     # ensure that it maintains this Agent's ApplicationContext.
-    class ServiceHeartbeat
+    class ServiceHeartbeat < WorkerThread
       include Contrast::Components::Interface
-      access_component :contrast_service, :logging
+      access_component :logging
 
       # Spec recommends 30 seconds, we're going with 15.
       REFRESH_INTERVAL_SEC = 15
 
-      def updater_thread
-        @_updater_thread ||= Contrast::Agent::Thread.new do
-          logger.debug(nil, 'Starting heartbeat thread.')
+      def start_thread!
+        return if running?
+
+        @_thread = Contrast::Agent::Thread.new do
+          logger.info('Starting heartbeat thread.')
           loop do
             begin
-              logger.debug(nil, 'Sending Heartbeat...')
-              CONTRAST_SERVICE.queue_message(poll_message)
+              Contrast::Agent.messaging_queue.send_event_eventually(poll_message)
             end
             sleep REFRESH_INTERVAL_SEC
           end
         end
       end
-      alias_method :start, :updater_thread
 
       def poll_message
         @_poll_message ||= Contrast::Api::Dtm::Poll.new
       end
-
-      def stop
-        Thread.kill(@_updater_thread) if @_updater_thread&.alive?
-      end
     end
   end
 end

data/lib/contrast/agent/static_analysis.rb

@@ -0,0 +1,41 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/gemfile_reader'
+cs__scoped_require 'contrast/api/decorators/application_update'
+
+module Contrast
+  module Agent
+    # this module handles one time static analysis tasks
+    class StaticAnalysis
+      include Singleton
+      include Contrast::Components::Interface
+      access_component :logging, :analysis, :scope
+      class << self
+        # After the first request is complete, we do a one-time manual catchup to review and
+        # report the already-loaded gems.
+        def catchup
+          @_catchup ||= begin
+                          with_contrast_scope do
+                            Contrast::Utils::GemfileReader.instance.map_loaded_classes
+                            send_inventory_message
+                            true
+                          end
+                        end
+        rescue StandardError => e
+          logger.warn('Unable to run post-initialization static analysis', e)
+        end
+
+        def send_inventory_message
+          return unless INVENTORY.enabled?
+
+          app_update_msg = Contrast::Api::Dtm::ApplicationUpdate.build
+
+          Contrast::Utils::InventoryUtil.append_db_config(app_update_msg)
+          Contrast::Agent.messaging_queue.send_event_eventually(app_update_msg)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/thread.rb

@@ -9,7 +9,7 @@ module Contrast
     class Thread < ::Thread
       include Contrast::Components::Interface
 
-      access_component :logging, :scope
+      access_component :scope
 
       # Make our internal code run in Contrast scope.
       def initialize *args

data/lib/contrast/agent/thread_watcher.rb

@@ -0,0 +1,49 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/agent/service_heartbeat'
+
+module Contrast
+  module Agent
+    # This class used to ensure that our worker threads are running in multi-process environments
+    class ThreadWatcher
+      include Contrast::Components::Interface
+      access_component :logging
+
+      attr_reader :heartbeat
+
+      def initialize
+        @pids = {}
+        @heartbeat = Contrast::Agent::ServiceHeartbeat.new
+      end
+
+      def startup!
+        unless heartbeat.running?
+          logger.debug('Attempting to start heartbeat thread')
+          heartbeat.start_thread!
+        end
+        heartbeat_result = heartbeat.running?
+        logger.debug('Heartbeat thread status', alive: heartbeat_result)
+
+        unless Contrast::Agent.messaging_queue.running?
+          logger.debug('Attempting to start messaging queue thread')
+          Contrast::Agent.messaging_queue.start_thread!
+        end
+        messaging_result = Contrast::Agent.messaging_queue.running?
+        logger.debug('Messaging thread status', alive: messaging_result)
+
+        logger.debug('ThreadWatcher started threads')
+
+        @pids[Process.pid] = messaging_result && heartbeat_result
+      end
+
+      def ensure_running?
+        return if @pids[Process.pid] == true
+
+        logger.debug('ThreadWatcher - threads not running')
+        startup!
+      end
+    end
+  end
+end

data/lib/contrast/agent/tracepoint_hook.rb

@@ -12,10 +12,6 @@ module Contrast
       access_component :logging, :scope
 
       class << self
-        def active?
-          instance_variable_defined?(:@require_hook) && @require_hook.enabled?
-        end
-
         def enable!
           @require_hook ||= TracePoint.new(:end) do |tracepoint_event|
             process(tracepoint_event)
@@ -33,7 +29,7 @@ module Contrast
 
         def process tracepoint_event
           with_contrast_scope do
-            logger.debug("Received end event for #{ tracepoint_event.self }")
+            logger.trace('Received TracePoint end event', module: tracepoint_event.self.to_s)
 
             loaded_module = tracepoint_event.self
             path = tracepoint_event.path

data/lib/contrast/agent/version.rb

@@ -3,6 +3,6 @@
 
 module Contrast
   module Agent
-    VERSION = '3.10.2'
+    VERSION = '3.13.0'
   end
 end

data/lib/contrast/agent/worker_thread.rb

@@ -0,0 +1,24 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    # Base class for threads that do async processing
+    class WorkerThread
+      def initialize
+        @_thread = nil
+      end
+
+      def running?
+        !!@_thread&.alive?
+      end
+
+      def stop!
+        return unless running?
+
+        Thread.kill(@_thread)
+        @_thread = nil
+      end
+    end
+  end
+end

data/lib/contrast/api.rb

@@ -10,9 +10,7 @@ module Contrast
   end
 end
 
-cs__scoped_require 'contrast/api/dtm_pb'
-cs__scoped_require 'contrast/api/settings_pb'
-cs__scoped_require 'contrast/delegators'
-cs__scoped_require 'contrast/api/unix_socket'
-cs__scoped_require 'contrast/api/tcp_socket'
-cs__scoped_require 'contrast/api/speedracer'
+cs__scoped_require 'contrast/api/dtm.pb'
+cs__scoped_require 'contrast/api/settings.pb'
+cs__scoped_require 'contrast/api/decorators'
+cs__scoped_require 'contrast/api/communication'

data/lib/contrast/api/communication.rb

@@ -0,0 +1,20 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Api
+    # Used to contain all modules that handle communication with speedracer
+    module Communication
+    end
+  end
+end
+
+cs__scoped_require 'contrast/api/communication/service_lifecycle'
+cs__scoped_require 'contrast/api/communication/connection_status'
+cs__scoped_require 'contrast/api/communication/socket'
+cs__scoped_require 'contrast/api/communication/tcp_socket'
+cs__scoped_require 'contrast/api/communication/unix_socket'
+cs__scoped_require 'contrast/api/communication/socket_client'
+cs__scoped_require 'contrast/api/communication/messaging_queue'
+cs__scoped_require 'contrast/api/communication/response_processor'
+cs__scoped_require 'contrast/api/communication/speedracer'

data/lib/contrast/api/communication/connection_status.rb

@@ -0,0 +1,41 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Api
+    module Communication
+      # Keeps track of the state of connections to the service.
+      class ConnectionStatus
+        def initialize
+          @last_success = nil
+          @last_failure = nil
+          @startup_messages_sent = false
+        end
+
+        # Whether we have sent startup message to the service. True after successfully
+        # sending startup messages to service and reset to false if we lose connection
+        # to the service.
+        def startup_messages_sent?
+          @startup_messages_sent
+        end
+
+        # The last message sent was successful
+        def connected?
+          @last_success && (@last_failure.nil? || @last_success > @last_failure)
+        end
+
+        # The current state of the service is active with a successful message sent
+        def success!
+          @startup_messages_sent = true
+          @last_success = Time.now.to_f
+        end
+
+        # The service may be in some sort of error state
+        def failure!
+          @startup_messages_sent = false
+          @last_failure = Time.now.to_f
+        end
+      end
+    end
+  end
+end

data/lib/contrast/api/communication/messaging_queue.rb

@@ -0,0 +1,79 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/agent/worker_thread'
+
+module Contrast
+  module Api
+    module Communication
+      # Top level gateway to messaging with speedracer
+      class MessagingQueue < Contrast::Agent::WorkerThread
+        include Contrast::Components::Interface
+        access_component :analysis, :logging, :settings
+
+        attr_reader :queue, :speedracer
+
+        def initialize
+          @queue = Queue.new
+          @speedracer = Contrast::Api::Communication::Speedracer.new
+          super
+        end
+
+        # Use this to bypass the messaging queue and leave response processing to the caller
+        def send_event_immediately event
+          send_event(event, true)
+        end
+
+        # Use this to add a message to the queue and process the response internally
+        def send_event_eventually event
+          logger.debug('Enqueued event for sending', event_type: event.cs__class)
+          queue << event if event
+        end
+
+        def start_thread!
+          speedracer.ensure_startup!
+          return if running?
+
+          @_thread = Contrast::Agent::Thread.new do
+            loop do
+              event = queue.pop
+
+              begin
+                logger.debug('Dequeued event for sending', event_type: event.cs__class)
+                send_event(event)
+              rescue StandardError => e
+                logger.error('Could not send message to service from messaging queue thread.', e)
+              end
+            end
+          end
+          logger.debug('Started background sending thread.')
+        end
+
+        private
+
+        # return_response is used to determine if we want to return the response to the caller or process it internally
+        def send_event event, return_response = false
+          preprocess_event(event)
+          if return_response
+            speedracer.return_response(event)
+          else
+            speedracer.process_internally(event)
+          end
+        end
+
+        # For now this only handles appending assess tags
+        # eventually we could break out preprocessors for every event type
+        def preprocess_event event
+          return unless event.is_a?(Contrast::Api::Dtm::Activity)
+
+          # So set their tags
+          event.finding_tags = Contrast::Utils::StringUtils.force_utf8(ASSESS.tags)
+
+          # and see if they're even enabled
+          event.findings.delete_if { |finding| ASSESS.rule_disabled?(finding.rule_id) }
+        end
+      end
+    end
+  end
+end

data/lib/contrast/api/communication/response_processor.rb

@@ -0,0 +1,77 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/reaction_processor'
+
+module Contrast
+  module Api
+    module Communication
+      # Handles processing deferred messages
+      class ResponseProcessor
+        include Contrast::Components::Interface
+        access_component :agent, :analysis, :logging, :settings
+
+        def process response
+          logger.debug('Received a response', sent_ms: response&.sent_ms)
+
+          server_features = process_server_response(response)
+          app_settings = process_application_response(response)
+
+          # ReactionProcessor is a design pattern from TeamServer.
+          # Right now, there's one potential reaction, which is disabling the agent
+          Contrast::Agent::ReactionProcessor.process(response&.application_settings)
+
+          Contrast::Logger::Log.instance.update(server_features&.log_file, server_features&.log_level)
+          update_features(server_features, app_settings)
+          logger.trace(
+              'Agent settings updated in response to Service',
+              protect_on: PROTECT.enabled?,
+              assess_on: ASSESS.enabled?)
+        end
+
+        private
+
+        # Given some protobuf messages, update settings.
+        # This is the bridge between Contrast Service <-> Settings.
+        def process_server_response response
+          server_features = response&.server_features
+          return unless server_features
+
+          logger.trace('Agent: Received updated server features')
+
+          SETTINGS.update_from_server_features(server_features)
+
+          server_features
+        end
+
+        def process_application_response response
+          app_settings = response&.application_settings
+          return unless app_settings
+
+          logger.debug('Agent: Received updated application settings')
+
+          SETTINGS.update_from_application_settings(app_settings)
+
+          app_settings
+        end
+
+        # This can't go in the Settings component because protect and assess depend on settings
+        # I don't think it should go into contrast_service because that only handles connection specific data
+        def update_features server_features, app_settings
+          return unless !!(server_features || app_settings)
+          return unless AGENT.enabled?
+
+          logger.trace_with_time('Rebuilding rule modes') do
+            SETTINGS.build_protect_rules if PROTECT.enabled?
+            SETTINGS.build_assess_rules  if ASSESS.enabled?
+            AGENT.reset_ruleset
+
+            logger.info('Current rule settings:')
+            PROTECT.rules.each { |k, v| logger.info('Protect Rule mode set', rule: k, mode: v.mode) }
+            ASSESS.rules.each { |k, v| logger.info('Assess Rule mode set', rule: k, mode: v.enabled?) }
+          end
+        end
+      end
+    end
+  end
+end