contrast-agent 3.12.2 → 3.13.0

data/lib/contrast/agent/request_context.rb

@@ -14,7 +14,7 @@ module Contrast
     # in a standardized and normalized format which the Agent understands.
     class RequestContext
       include Contrast::Components::Interface
-      access_component :agent, :analysis, :logging, :settings, :scope
+      access_component :agent, :analysis, :logging, :scope
 
       EMPTY_INPUT_ANALYSIS_PB = Contrast::Api::Settings::InputAnalysis.new
 
@@ -90,7 +90,6 @@ module Contrast
         # For TS routes
         @observed_route.signature  = route.route
         @observed_route.verb       = route.verb
-        @observed_route.session_id = SETTINGS.session_id
         @observed_route.url        = route.url if route.url
       end
 
@@ -113,7 +112,7 @@ module Contrast
         return false unless PROTECT.enabled?
         return false if @do_not_track
 
-        service_response = Contrast::Utils::ServiceSenderUtil.send_event_immediately(@activity.http_request)
+        service_response = Contrast::Agent.messaging_queue.send_event_immediately(@activity.http_request)
         return false unless service_response
 
         handle_protect_state(service_response)
@@ -127,8 +126,8 @@ module Contrast
           logger.trace('Analysis from Contrast Service was empty.')
           false
         end
-      rescue Contrast::SecurityException
-        raise
+      rescue Contrast::SecurityException => e
+        raise e
       rescue StandardError => e
         logger.warn('Unable to extract Contrast Service information from request', e)
         false
@@ -138,21 +137,20 @@ module Contrast
       # when the protect state indicates a security exception should be thrown. This method
       # ensures that the attack reports are generated. Normally these should be generated on
       # Speedracer for any attacks detected during prefilter.
+      #
+      # @param agent_settings [Contrast::Api::Settings::AgentSettings]
       def handle_protect_state agent_settings
-        return unless agent_settings
-        return unless agent_settings.protect_state
-
-        @uuid = agent_settings.protect_state.uuid
-        @do_not_track = true unless agent_settings.protect_state.track_request
+        return unless agent_settings&.protect_state
 
-        return unless agent_settings.protect_state.security_exception
+        state = agent_settings.protect_state
+        @uuid = state.uuid
+        @do_not_track = true unless state.track_request
+        return unless state.security_exception
 
         # If Contrast Service has NOT handled the input analysis, handle them here
         build_attack_results(agent_settings)
-
-        msg = agent_settings.protect_state.security_message
-        logger.warn('Contrast Service said to block this request')
-        raise Contrast::SecurityException.new(nil, (msg || 'Blocking suspicious behavior'))
+        logger.debug('Contrast Service said to block this request')
+        raise Contrast::SecurityException.new(nil, (state.security_message || 'Blocking suspicious behavior'))
       end
 
       # append anything we've learned to the request seen message
@@ -183,6 +181,8 @@ module Contrast
 
       # Generate attack results directly from any evaluations on the
       # agent settings object.
+      #
+      # @param agent_settings [Contrast::Api::Settings::AgentSettings]
       def build_attack_results agent_settings
         return unless agent_settings&.input_analysis&.results&.any?
 

data/lib/contrast/agent/request_handler.rb

@@ -20,7 +20,7 @@ module Contrast
       def send_activity_messages
         Contrast::Utils::GemfileReader.instance.generate_library_usage(context.activity)
         [context.server_activity, context.activity, context.observed_route].each do |message|
-          Contrast::Utils::ServiceSenderUtil.push_to_ready_queue(message)
+          Contrast::Agent.messaging_queue.send_event_eventually(message)
         end
       end
 

data/lib/contrast/agent/response.rb

@@ -43,7 +43,7 @@ module Contrast
       def dtm
         context_response = Contrast::Api::Dtm::HttpResponse.new
         context_response.response_code = response_code.to_i
-        headers.each_pair do |key, value|
+        headers&.each_pair do |key, value|
           k = Contrast::Utils::StringUtils.force_utf8(key)
           v = Contrast::Utils::StringUtils.force_utf8(value)
           context_response.response_headers[k] = v
@@ -75,23 +75,11 @@ module Contrast
         end
       end
 
-      # Header keys upcased and any underscores replaced with dashes
-      # We cannot memoize this, b/c response headers can change during the
-      # request lifecycle.
-      def normalized_headers
-        hash = {}
-        headers.each_pair do |header_name, header_value|
-          hash[Contrast::Utils::StringUtils.normalized_key(header_name)] = header_value
-        end
-        hash
-      end
-
-      CONTENT_TYPE_HEADER = 'CONTENT-TYPE'.cs__freeze
       def content_type
         return unless rack_response
 
         if @is_array
-          normalized_headers[CONTENT_TYPE_HEADER]
+          headers[Rack::CONTENT_TYPE]
         else
           rack_response.content_type
         end

data/lib/contrast/agent/scope.rb

@@ -107,7 +107,7 @@ module Contrast
         def ensure_valid_scope! scope_sym
           unless valid_scope? scope_sym # rubocop:disable Style/GuardClause
             with_contrast_scope do
-              raise NotImplementedError, "Scope '#{ scope_sym.inspect }' is not registered as a scope."
+              raise NoMethodError, "Scope '#{ scope_sym.inspect }' is not registered as a scope."
             end
           end
         end

data/lib/contrast/agent/service_heartbeat.rb

@@ -2,38 +2,36 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/agent/worker_thread'
 
 module Contrast
   module Agent
     # The ServiceHeartbeat functions to keep the Contrast Service alive and
     # ensure that it maintains this Agent's ApplicationContext.
-    class ServiceHeartbeat
+    class ServiceHeartbeat < WorkerThread
       include Contrast::Components::Interface
       access_component :logging
 
       # Spec recommends 30 seconds, we're going with 15.
       REFRESH_INTERVAL_SEC = 15
 
-      def updater_thread
-        @_updater_thread ||= Contrast::Agent::Thread.new do
+      def start_thread!
+        return if running?
+
+        @_thread = Contrast::Agent::Thread.new do
           logger.info('Starting heartbeat thread.')
           loop do
             begin
-              Contrast::Utils::ServiceSenderUtil.push_to_ready_queue(poll_message)
+              Contrast::Agent.messaging_queue.send_event_eventually(poll_message)
             end
             sleep REFRESH_INTERVAL_SEC
           end
         end
       end
-      alias_method :start, :updater_thread
 
       def poll_message
         @_poll_message ||= Contrast::Api::Dtm::Poll.new
       end
-
-      def stop
-        Thread.kill(@_updater_thread) if @_updater_thread&.alive?
-      end
     end
   end
 end

data/lib/contrast/agent/static_analysis.rb

@@ -33,7 +33,7 @@ module Contrast
           app_update_msg = Contrast::Api::Dtm::ApplicationUpdate.build
 
           Contrast::Utils::InventoryUtil.append_db_config(app_update_msg)
-          Contrast::Utils::ServiceSenderUtil.push_to_ready_queue(app_update_msg)
+          Contrast::Agent.messaging_queue.send_event_eventually(app_update_msg)
         end
       end
     end

data/lib/contrast/agent/thread_watcher.rb

@@ -0,0 +1,49 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/agent/service_heartbeat'
+
+module Contrast
+  module Agent
+    # This class used to ensure that our worker threads are running in multi-process environments
+    class ThreadWatcher
+      include Contrast::Components::Interface
+      access_component :logging
+
+      attr_reader :heartbeat
+
+      def initialize
+        @pids = {}
+        @heartbeat = Contrast::Agent::ServiceHeartbeat.new
+      end
+
+      def startup!
+        unless heartbeat.running?
+          logger.debug('Attempting to start heartbeat thread')
+          heartbeat.start_thread!
+        end
+        heartbeat_result = heartbeat.running?
+        logger.debug('Heartbeat thread status', alive: heartbeat_result)
+
+        unless Contrast::Agent.messaging_queue.running?
+          logger.debug('Attempting to start messaging queue thread')
+          Contrast::Agent.messaging_queue.start_thread!
+        end
+        messaging_result = Contrast::Agent.messaging_queue.running?
+        logger.debug('Messaging thread status', alive: messaging_result)
+
+        logger.debug('ThreadWatcher started threads')
+
+        @pids[Process.pid] = messaging_result && heartbeat_result
+      end
+
+      def ensure_running?
+        return if @pids[Process.pid] == true
+
+        logger.debug('ThreadWatcher - threads not running')
+        startup!
+      end
+    end
+  end
+end

data/lib/contrast/agent/version.rb

@@ -3,6 +3,6 @@
 
 module Contrast
   module Agent
-    VERSION = '3.12.2'
+    VERSION = '3.13.0'
   end
 end

data/lib/contrast/agent/worker_thread.rb

@@ -0,0 +1,24 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    # Base class for threads that do async processing
+    class WorkerThread
+      def initialize
+        @_thread = nil
+      end
+
+      def running?
+        !!@_thread&.alive?
+      end
+
+      def stop!
+        return unless running?
+
+        Thread.kill(@_thread)
+        @_thread = nil
+      end
+    end
+  end
+end

data/lib/contrast/api.rb

@@ -10,9 +10,7 @@ module Contrast
   end
 end
 
-cs__scoped_require 'contrast/api/dtm_pb'
-cs__scoped_require 'contrast/api/settings_pb'
+cs__scoped_require 'contrast/api/dtm.pb'
+cs__scoped_require 'contrast/api/settings.pb'
 cs__scoped_require 'contrast/api/decorators'
-cs__scoped_require 'contrast/api/unix_socket'
-cs__scoped_require 'contrast/api/tcp_socket'
-cs__scoped_require 'contrast/api/speedracer'
+cs__scoped_require 'contrast/api/communication'

data/lib/contrast/api/communication.rb

@@ -0,0 +1,20 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Api
+    # Used to contain all modules that handle communication with speedracer
+    module Communication
+    end
+  end
+end
+
+cs__scoped_require 'contrast/api/communication/service_lifecycle'
+cs__scoped_require 'contrast/api/communication/connection_status'
+cs__scoped_require 'contrast/api/communication/socket'
+cs__scoped_require 'contrast/api/communication/tcp_socket'
+cs__scoped_require 'contrast/api/communication/unix_socket'
+cs__scoped_require 'contrast/api/communication/socket_client'
+cs__scoped_require 'contrast/api/communication/messaging_queue'
+cs__scoped_require 'contrast/api/communication/response_processor'
+cs__scoped_require 'contrast/api/communication/speedracer'

data/lib/contrast/api/communication/connection_status.rb

@@ -0,0 +1,41 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Api
+    module Communication
+      # Keeps track of the state of connections to the service.
+      class ConnectionStatus
+        def initialize
+          @last_success = nil
+          @last_failure = nil
+          @startup_messages_sent = false
+        end
+
+        # Whether we have sent startup message to the service. True after successfully
+        # sending startup messages to service and reset to false if we lose connection
+        # to the service.
+        def startup_messages_sent?
+          @startup_messages_sent
+        end
+
+        # The last message sent was successful
+        def connected?
+          @last_success && (@last_failure.nil? || @last_success > @last_failure)
+        end
+
+        # The current state of the service is active with a successful message sent
+        def success!
+          @startup_messages_sent = true
+          @last_success = Time.now.to_f
+        end
+
+        # The service may be in some sort of error state
+        def failure!
+          @startup_messages_sent = false
+          @last_failure = Time.now.to_f
+        end
+      end
+    end
+  end
+end

data/lib/contrast/api/communication/messaging_queue.rb

@@ -0,0 +1,79 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/agent/worker_thread'
+
+module Contrast
+  module Api
+    module Communication
+      # Top level gateway to messaging with speedracer
+      class MessagingQueue < Contrast::Agent::WorkerThread
+        include Contrast::Components::Interface
+        access_component :analysis, :logging, :settings
+
+        attr_reader :queue, :speedracer
+
+        def initialize
+          @queue = Queue.new
+          @speedracer = Contrast::Api::Communication::Speedracer.new
+          super
+        end
+
+        # Use this to bypass the messaging queue and leave response processing to the caller
+        def send_event_immediately event
+          send_event(event, true)
+        end
+
+        # Use this to add a message to the queue and process the response internally
+        def send_event_eventually event
+          logger.debug('Enqueued event for sending', event_type: event.cs__class)
+          queue << event if event
+        end
+
+        def start_thread!
+          speedracer.ensure_startup!
+          return if running?
+
+          @_thread = Contrast::Agent::Thread.new do
+            loop do
+              event = queue.pop
+
+              begin
+                logger.debug('Dequeued event for sending', event_type: event.cs__class)
+                send_event(event)
+              rescue StandardError => e
+                logger.error('Could not send message to service from messaging queue thread.', e)
+              end
+            end
+          end
+          logger.debug('Started background sending thread.')
+        end
+
+        private
+
+        # return_response is used to determine if we want to return the response to the caller or process it internally
+        def send_event event, return_response = false
+          preprocess_event(event)
+          if return_response
+            speedracer.return_response(event)
+          else
+            speedracer.process_internally(event)
+          end
+        end
+
+        # For now this only handles appending assess tags
+        # eventually we could break out preprocessors for every event type
+        def preprocess_event event
+          return unless event.is_a?(Contrast::Api::Dtm::Activity)
+
+          # So set their tags
+          event.finding_tags = Contrast::Utils::StringUtils.force_utf8(ASSESS.tags)
+
+          # and see if they're even enabled
+          event.findings.delete_if { |finding| ASSESS.rule_disabled?(finding.rule_id) }
+        end
+      end
+    end
+  end
+end

data/lib/contrast/{utils/service_response_util.rb → api/communication/response_processor.rb}

@@ -1,27 +1,18 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/logger/log'
 cs__scoped_require 'contrast/agent/reaction_processor'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/assess/sampling_util'
 
 module Contrast
-  module Utils
-    # Utility class for processing responses from the Contrast Service. Specifically, this class
-    # processes Server and Application settings and updates the Settings component.
-    module ServiceResponseUtil
-      include Contrast::Components::Interface
-      access_component :agent, :analysis, :logging, :settings
-
-      class << self
-        # Return true if the agent has processed a response from the service
-        def update_received?
-          @_last_update.nil?
-        end
-
-        def process_response response
-          @_last_update = response&.sent_ms
+  module Api
+    module Communication
+      # Handles processing deferred messages
+      class ResponseProcessor
+        include Contrast::Components::Interface
+        access_component :agent, :analysis, :logging, :settings
+
+        def process response
+          logger.debug('Received a response', sent_ms: response&.sent_ms)
 
           server_features = process_server_response(response)
           app_settings = process_application_response(response)