contrast-agent 3.11.0 → 3.13.1

data/lib/contrast/api/communication/messaging_queue.rb

@@ -0,0 +1,79 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/agent/worker_thread'
+
+module Contrast
+  module Api
+    module Communication
+      # Top level gateway to messaging with speedracer
+      class MessagingQueue < Contrast::Agent::WorkerThread
+        include Contrast::Components::Interface
+        access_component :analysis, :logging, :settings
+
+        attr_reader :queue, :speedracer
+
+        def initialize
+          @queue = Queue.new
+          @speedracer = Contrast::Api::Communication::Speedracer.new
+          super
+        end
+
+        # Use this to bypass the messaging queue and leave response processing to the caller
+        def send_event_immediately event
+          send_event(event, true)
+        end
+
+        # Use this to add a message to the queue and process the response internally
+        def send_event_eventually event
+          logger.debug('Enqueued event for sending', event_type: event.cs__class)
+          queue << event if event
+        end
+
+        def start_thread!
+          speedracer.ensure_startup!
+          return if running?
+
+          @_thread = Contrast::Agent::Thread.new do
+            loop do
+              event = queue.pop
+
+              begin
+                logger.debug('Dequeued event for sending', event_type: event.cs__class)
+                send_event(event)
+              rescue StandardError => e
+                logger.error('Could not send message to service from messaging queue thread.', e)
+              end
+            end
+          end
+          logger.debug('Started background sending thread.')
+        end
+
+        private
+
+        # return_response is used to determine if we want to return the response to the caller or process it internally
+        def send_event event, return_response = false
+          preprocess_event(event)
+          if return_response
+            speedracer.return_response(event)
+          else
+            speedracer.process_internally(event)
+          end
+        end
+
+        # For now this only handles appending assess tags
+        # eventually we could break out preprocessors for every event type
+        def preprocess_event event
+          return unless event.is_a?(Contrast::Api::Dtm::Activity)
+
+          # So set their tags
+          event.finding_tags = Contrast::Utils::StringUtils.force_utf8(ASSESS.tags)
+
+          # and see if they're even enabled
+          event.findings.delete_if { |finding| ASSESS.rule_disabled?(finding.rule_id) }
+        end
+      end
+    end
+  end
+end

data/lib/contrast/{utils/service_response_util.rb → api/communication/response_processor.rb}

@@ -1,23 +1,18 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/logger'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/assess/sampling_util'
+cs__scoped_require 'contrast/agent/reaction_processor'
 
 module Contrast
-  module Utils
-    # Utility class for processing responses from the Contrast Service. Specifically, this class
-    # processes Server and Application settings and updates the Settings component.
-    module ServiceResponseUtil
-      include Contrast::Components::Interface
-      access_component :analysis, :contrast_service, :logging, :settings
-
-      class << self
-        # TODO: RUBY-119
-        def process_response response
-          fs = Contrast::Agent::FeatureState.instance
-          fs.last_update = response&.sent_ms
+  module Api
+    module Communication
+      # Handles processing deferred messages
+      class ResponseProcessor
+        include Contrast::Components::Interface
+        access_component :agent, :analysis, :logging, :settings
+
+        def process response
+          logger.debug('Received a response', sent_ms: response&.sent_ms)
 
           server_features = process_server_response(response)
           app_settings = process_application_response(response)
@@ -25,17 +20,13 @@ module Contrast
           # ReactionProcessor is a design pattern from TeamServer.
           # Right now, there's one potential reaction, which is disabling the agent
           Contrast::Agent::ReactionProcessor.process(response&.application_settings)
-          # Determine new accumulator state
-          if (new_accum = response&.accumulator_settings)
-            SETTINGS.accumulator_settings.replace(new_accum)
-          end
 
-          Contrast::Agent::Logger.instance.update(server_features&.log_file, server_features&.log_level)
+          Contrast::Logger::Log.instance.update(server_features&.log_file, server_features&.log_level)
           update_features(server_features, app_settings)
           logger.trace(
               'Agent settings updated in response to Service',
-              protect_on: fs.protect_enabled?,
-              assess_on: fs.assess_enabled?)
+              protect_on: PROTECT.enabled?,
+              assess_on: ASSESS.enabled?)
         end
 
         private
@@ -68,10 +59,12 @@ module Contrast
         # I don't think it should go into contrast_service because that only handles connection specific data
         def update_features server_features, app_settings
           return unless !!(server_features || app_settings)
+          return unless AGENT.enabled?
 
           logger.trace_with_time('Rebuilding rule modes') do
             SETTINGS.build_protect_rules if PROTECT.enabled?
             SETTINGS.build_assess_rules  if ASSESS.enabled?
+            AGENT.reset_ruleset
 
             logger.info('Current rule settings:')
             PROTECT.rules.each { |k, v| logger.info('Protect Rule mode set', rule: k, mode: v.mode) }

data/lib/contrast/api/communication/service_lifecycle.rb

@@ -0,0 +1,61 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Api
+    module Communication
+      # Handles local service startup
+      module ServiceLifecycle
+        include Contrast::Components::Interface
+        access_component :logging, :contrast_service
+
+        def attempt_local_service_startup
+          zombie_check
+          service_starter_thread.join(5)
+          is_service_started = Contrast::Utils::OS.running?
+          if is_service_started
+            logger.info('The bundled service was successfully started.')
+          else
+            logger.error('The bundled service could not be started. The agent will not function properly.')
+          end
+          is_service_started
+        end
+
+        # check if there's a zombie service that exists, and wait on it if so.
+        # currently, this only happens when trying to initialize speedracer
+        def zombie_check
+          zombie_pid_list = Contrast::Utils::OS.zombie_pids
+          zombie_pid_list.each do |pid|
+            Process.wait(pid.to_i)
+          end
+        end
+
+        def determine_startup_options
+          return { out: :out, err: :out } if CONTRAST_SERVICE.logger_path == 'STDOUT'
+          return { out: :err, err: :err } if CONTRAST_SERVICE.logger_path == 'STDERR'
+
+          { out: File::NULL, err: File::NULL }
+        end
+
+        # This is a separate method so we can overwrite it globally in specs
+        def spawn_service
+          options = determine_startup_options
+          logger.debug('Spawning service')
+          spawn 'contrast_service', options
+        end
+
+        def service_starter_thread
+          Contrast::Agent::Thread.new do
+            # Always check to see if it already started
+            unless Contrast::Utils::OS.running?
+              # Spawn the service process
+              spawn_service
+              # Block until service is running
+              sleep(0.1) until Contrast::Utils::OS.running?
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/api/communication/socket.rb

@@ -0,0 +1,45 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Api
+    module Communication
+      # Behavior common to all sockets used
+      # to communicate with the Contrast Service.
+      module Socket
+        SOCKET_MONITOR = Monitor.new
+
+        # Send a message across the socket and read back the response.
+        # @param marshaled [String] some marshaled form of data to be sent across
+        #   the socket. Typically an encoded form of Contrast::Api::Dtm::Message.
+        # @return [String] some marshalled form of data returned by the socket.
+        #   Typically an encoded form of Contrast::Api::Settings::AgentSettings.
+        def send_marshaled marshaled
+          SOCKET_MONITOR.synchronize do
+            socket = new_socket
+
+            # write message length
+            len = marshaled.length
+            socket.write([len].pack(Contrast::Api::ENCODING_STRING))
+
+            # write the entire message
+            socket.write(marshaled)
+            socket.close_write
+
+            # read the response length
+            len = socket.read(4).unpack1(Contrast::Api::ENCODING_STRING)
+
+            # read expected response to end
+            socket.read(len)
+          end
+        end
+
+        # Override this method to return a socket.
+        # Should be interface compatible with TCPSocket, UNIXSocket, etc.
+        def new_socket
+          raise NoMethodError, 'This is abstract, override it.'
+        end
+      end
+    end
+  end
+end

data/lib/contrast/api/communication/socket_client.rb

@@ -0,0 +1,76 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'socket'
+cs__scoped_require 'uri'
+
+cs__scoped_require 'contrast/api/communication/tcp_socket'
+cs__scoped_require 'contrast/api/communication/unix_socket'
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Api
+    module Communication
+      # SocketClient acts as a interface between the agent and the service. It instantiates a
+      # service proxy and tracks the state of that proxy.
+      class SocketClient
+        include Contrast::Components::Interface
+        access_component :contrast_service, :logging
+
+        def initialize
+          @socket = init_connection
+        end
+
+        # Wrap the given DTM in a Contrast::Api::Dtm::Message and send it to the
+        # Service for processing
+        #
+        # @param event [Contrast::Api::Dtm] One of the DTMs valid for the event field of
+        #   Contrast::Api::Dtm::Message
+        def send_one event
+          msg = Contrast::Api::Dtm::Message.build(event)
+          send_message(msg)
+        end
+
+        private
+
+        def init_connection
+          if CONTRAST_SERVICE.use_tcp?
+            Contrast::Api::Communication::TcpSocket.new(CONTRAST_SERVICE.host, CONTRAST_SERVICE.port)
+          else
+            Contrast::Api::Communication::UnixSocket.new(CONTRAST_SERVICE.socket_path)
+          end
+        end
+
+        def send_message msg
+          return unless msg
+
+          logger.debug('Sending message.',
+                       msg_id: msg.__id__,
+                       p_id: msg.pid,
+                       msg_count: msg.message_count)
+          to_service = Contrast::Api::Dtm::Message.encode(msg)
+          from_service = send_marshaled(to_service)
+          response = Contrast::Api::Settings::AgentSettings.decode(from_service)
+          logger.debug('Received response.',
+                       msg_id: msg.__id__,
+                       p_id: msg.pid,
+                       msg_count: msg.message_count,
+                       response_id: response&.__id__)
+          response
+        rescue StandardError => e
+          logger.error('Sending failed for message.',
+                       e,
+                       msg_id: msg.__id__,
+                       p_id: msg.pid,
+                       msg_count: msg.message_count,
+                       response_id: response&.__id__)
+          raise e # reraise to let Speedracer manage the connection
+        end
+
+        def send_marshaled marshaled
+          @socket.send_marshaled(marshaled)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/api/communication/speedracer.rb

@@ -0,0 +1,111 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Api
+    module Communication
+      # Wraps all connection data to speedracer
+      class Speedracer
+        include Contrast::Api::Communication::ServiceLifecycle
+        include Contrast::Components::Interface
+        access_component :contrast_service, :logging, :app_context
+
+        attr_reader :status, :response_processor, :socket_client, :ensure_running
+
+        def initialize
+          @status = Contrast::Api::Communication::ConnectionStatus.new
+          @socket_client = Contrast::Api::Communication::SocketClient.new
+          @response_processor = Contrast::Api::Communication::ResponseProcessor.new
+          @ensure_running = Mutex.new
+        end
+
+        def ensure_startup!
+          return if status.connected?
+
+          ensure_running.synchronize do
+            if CONTRAST_SERVICE.use_bundled_service?
+              logger.info('Attempting to start local service')
+              unless attempt_local_service_startup
+                logger.error('Failed to start local service')
+                return
+              end
+            end
+            unless status.startup_messages_sent?
+              startup_responses = send_initialization_messages
+              return false unless startup_responses
+
+              startup_responses.each { |response| response_processor.process(response) }
+            end
+          end
+        end
+
+        def return_response event
+          send_to_speedracer(event) do |response|
+            return response
+          end
+        end
+
+        def process_internally event
+          send_to_speedracer(event) do |response|
+            response_processor.process(response)
+          end
+        end
+
+        private
+
+        def send_to_speedracer event
+          ensure_startup!
+
+          logger.debug_with_time(event.cs__class.name) do
+            response = socket_client.send_one event
+            status.success!
+            yield response
+          end
+        rescue StandardError => e
+          status.failure!
+          logger.error('Unable to send message.', e,
+                       event_id: event.__id__,
+                       event_type: event.cs__class.name)
+          nil
+        end
+
+        def send_initialization_messages
+          agent_startup_msg = APP_CONTEXT.build_agent_startup_message
+          app_startup_msg = APP_CONTEXT.build_app_startup_message
+
+          logger.debug('Preparing to send startup messages')
+          # 1 initial attempt, + 3 potential retries.
+          # The agent-service-api REQUIREMENTS.md spec mandates this #.
+          4.times do
+            log_send_event(agent_startup_msg)
+            next unless (agent_response = socket_client.send_one(agent_startup_msg))
+
+            # Connection was successful
+            log_send_event(app_startup_msg)
+            app_response = socket_client.send_one(app_startup_msg)
+
+            status.success!
+            logger.debug('Successfully sent startup messages to service.')
+            return [agent_response, app_response]
+          end
+
+          status.failure!
+          logger.error('Could not send agent startup message context')
+          nil
+        rescue StandardError => e
+          logger.error('Could not build service context', e)
+          status.failure!
+          nil
+        end
+
+        def log_send_event event
+          logger.debug('Immediately sending event.',
+                       event_id: event.__id__,
+                       event_type: event.cs__class.name)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/api/communication/tcp_socket.rb

@@ -0,0 +1,31 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/api/communication/socket'
+
+module Contrast
+  module Api
+    module Communication
+      # This class allows us to create a TCP Socket to communicate to the Service
+      # (Speed Racer). Either it or the Unix Socket will be used, as determined
+      # by the configuration options set for Service communication.
+      class TcpSocket
+        include Contrast::Api::Communication::Socket
+
+        attr_reader :host, :port
+
+        # Create the socket
+        # @param host [String] socket target hostname or IP address
+        # @param port [String,Integer] socket target port
+        def initialize host, port
+          @host = host.to_s
+          @port = port.to_i
+        end
+
+        def new_socket
+          ::TCPSocket.new(host, port)
+        end
+      end
+    end
+  end
+end