contrast-agent 3.12.2 → 3.13.0

data/lib/contrast/api/communication/service_lifecycle.rb

@@ -0,0 +1,61 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Api
+    module Communication
+      # Handles local service startup
+      module ServiceLifecycle
+        include Contrast::Components::Interface
+        access_component :logging, :contrast_service
+
+        def attempt_local_service_startup
+          zombie_check
+          service_starter_thread.join(5)
+          is_service_started = Contrast::Utils::OS.running?
+          if is_service_started
+            logger.info('The bundled service was successfully started.')
+          else
+            logger.error('The bundled service could not be started. The agent will not function properly.')
+          end
+          is_service_started
+        end
+
+        # check if there's a zombie service that exists, and wait on it if so.
+        # currently, this only happens when trying to initialize speedracer
+        def zombie_check
+          zombie_pid_list = Contrast::Utils::OS.zombie_pids
+          zombie_pid_list.each do |pid|
+            Process.wait(pid.to_i)
+          end
+        end
+
+        def determine_startup_options
+          return { out: :out, err: :out } if CONTRAST_SERVICE.logger_path == 'STDOUT'
+          return { out: :err, err: :err } if CONTRAST_SERVICE.logger_path == 'STDERR'
+
+          { out: File::NULL, err: File::NULL }
+        end
+
+        # This is a separate method so we can overwrite it globally in specs
+        def spawn_service
+          options = determine_startup_options
+          logger.debug('Spawning service')
+          spawn 'contrast_service', options
+        end
+
+        def service_starter_thread
+          Contrast::Agent::Thread.new do
+            # Always check to see if it already started
+            unless Contrast::Utils::OS.running?
+              # Spawn the service process
+              spawn_service
+              # Block until service is running
+              sleep(0.1) until Contrast::Utils::OS.running?
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/api/communication/socket.rb

@@ -0,0 +1,45 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Api
+    module Communication
+      # Behavior common to all sockets used
+      # to communicate with the Contrast Service.
+      module Socket
+        SOCKET_MONITOR = Monitor.new
+
+        # Send a message across the socket and read back the response.
+        # @param marshaled [String] some marshaled form of data to be sent across
+        #   the socket. Typically an encoded form of Contrast::Api::Dtm::Message.
+        # @return [String] some marshalled form of data returned by the socket.
+        #   Typically an encoded form of Contrast::Api::Settings::AgentSettings.
+        def send_marshaled marshaled
+          SOCKET_MONITOR.synchronize do
+            socket = new_socket
+
+            # write message length
+            len = marshaled.length
+            socket.write([len].pack(Contrast::Api::ENCODING_STRING))
+
+            # write the entire message
+            socket.write(marshaled)
+            socket.close_write
+
+            # read the response length
+            len = socket.read(4).unpack1(Contrast::Api::ENCODING_STRING)
+
+            # read expected response to end
+            socket.read(len)
+          end
+        end
+
+        # Override this method to return a socket.
+        # Should be interface compatible with TCPSocket, UNIXSocket, etc.
+        def new_socket
+          raise NoMethodError, 'This is abstract, override it.'
+        end
+      end
+    end
+  end
+end

data/lib/contrast/api/communication/socket_client.rb

@@ -0,0 +1,76 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'socket'
+cs__scoped_require 'uri'
+
+cs__scoped_require 'contrast/api/communication/tcp_socket'
+cs__scoped_require 'contrast/api/communication/unix_socket'
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Api
+    module Communication
+      # SocketClient acts as a interface between the agent and the service. It instantiates a
+      # service proxy and tracks the state of that proxy.
+      class SocketClient
+        include Contrast::Components::Interface
+        access_component :contrast_service, :logging
+
+        def initialize
+          @socket = init_connection
+        end
+
+        # Wrap the given DTM in a Contrast::Api::Dtm::Message and send it to the
+        # Service for processing
+        #
+        # @param event [Contrast::Api::Dtm] One of the DTMs valid for the event field of
+        #   Contrast::Api::Dtm::Message
+        def send_one event
+          msg = Contrast::Api::Dtm::Message.build(event)
+          send_message(msg)
+        end
+
+        private
+
+        def init_connection
+          if CONTRAST_SERVICE.use_tcp?
+            Contrast::Api::Communication::TcpSocket.new(CONTRAST_SERVICE.host, CONTRAST_SERVICE.port)
+          else
+            Contrast::Api::Communication::UnixSocket.new(CONTRAST_SERVICE.socket_path)
+          end
+        end
+
+        def send_message msg
+          return unless msg
+
+          logger.debug('Sending message.',
+                       msg_id: msg.__id__,
+                       p_id: msg.pid,
+                       msg_count: msg.message_count)
+          to_service = Contrast::Api::Dtm::Message.encode(msg)
+          from_service = send_marshaled(to_service)
+          response = Contrast::Api::Settings::AgentSettings.decode(from_service)
+          logger.debug('Received response.',
+                       msg_id: msg.__id__,
+                       p_id: msg.pid,
+                       msg_count: msg.message_count,
+                       response_id: response&.__id__)
+          response
+        rescue StandardError => e
+          logger.error('Sending failed for message.',
+                       e,
+                       msg_id: msg.__id__,
+                       p_id: msg.pid,
+                       msg_count: msg.message_count,
+                       response_id: response&.__id__)
+          raise e # reraise to let Speedracer manage the connection
+        end
+
+        def send_marshaled marshaled
+          @socket.send_marshaled(marshaled)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/api/communication/speedracer.rb

@@ -0,0 +1,111 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Api
+    module Communication
+      # Wraps all connection data to speedracer
+      class Speedracer
+        include Contrast::Api::Communication::ServiceLifecycle
+        include Contrast::Components::Interface
+        access_component :contrast_service, :logging, :app_context
+
+        attr_reader :status, :response_processor, :socket_client, :ensure_running
+
+        def initialize
+          @status = Contrast::Api::Communication::ConnectionStatus.new
+          @socket_client = Contrast::Api::Communication::SocketClient.new
+          @response_processor = Contrast::Api::Communication::ResponseProcessor.new
+          @ensure_running = Mutex.new
+        end
+
+        def ensure_startup!
+          return if status.connected?
+
+          ensure_running.synchronize do
+            if CONTRAST_SERVICE.use_bundled_service?
+              logger.info('Attempting to start local service')
+              unless attempt_local_service_startup
+                logger.error('Failed to start local service')
+                return
+              end
+            end
+            unless status.startup_messages_sent?
+              startup_responses = send_initialization_messages
+              return false unless startup_responses
+
+              startup_responses.each { |response| response_processor.process(response) }
+            end
+          end
+        end
+
+        def return_response event
+          send_to_speedracer(event) do |response|
+            return response
+          end
+        end
+
+        def process_internally event
+          send_to_speedracer(event) do |response|
+            response_processor.process(response)
+          end
+        end
+
+        private
+
+        def send_to_speedracer event
+          ensure_startup!
+
+          logger.debug_with_time(event.cs__class.name) do
+            response = socket_client.send_one event
+            status.success!
+            yield response
+          end
+        rescue StandardError => e
+          status.failure!
+          logger.error('Unable to send message.', e,
+                       event_id: event.__id__,
+                       event_type: event.cs__class.name)
+          nil
+        end
+
+        def send_initialization_messages
+          agent_startup_msg = APP_CONTEXT.build_agent_startup_message
+          app_startup_msg = APP_CONTEXT.build_app_startup_message
+
+          logger.debug('Preparing to send startup messages')
+          # 1 initial attempt, + 3 potential retries.
+          # The agent-service-api REQUIREMENTS.md spec mandates this #.
+          4.times do
+            log_send_event(agent_startup_msg)
+            next unless (agent_response = socket_client.send_one(agent_startup_msg))
+
+            # Connection was successful
+            log_send_event(app_startup_msg)
+            app_response = socket_client.send_one(app_startup_msg)
+
+            status.success!
+            logger.debug('Successfully sent startup messages to service.')
+            return [agent_response, app_response]
+          end
+
+          status.failure!
+          logger.error('Could not send agent startup message context')
+          nil
+        rescue StandardError => e
+          logger.error('Could not build service context', e)
+          status.failure!
+          nil
+        end
+
+        def log_send_event event
+          logger.debug('Immediately sending event.',
+                       event_id: event.__id__,
+                       event_type: event.cs__class.name)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/api/communication/tcp_socket.rb

@@ -0,0 +1,31 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/api/communication/socket'
+
+module Contrast
+  module Api
+    module Communication
+      # This class allows us to create a TCP Socket to communicate to the Service
+      # (Speed Racer). Either it or the Unix Socket will be used, as determined
+      # by the configuration options set for Service communication.
+      class TcpSocket
+        include Contrast::Api::Communication::Socket
+
+        attr_reader :host, :port
+
+        # Create the socket
+        # @param host [String] socket target hostname or IP address
+        # @param port [String,Integer] socket target port
+        def initialize host, port
+          @host = host.to_s
+          @port = port.to_i
+        end
+
+        def new_socket
+          ::TCPSocket.new(host, port)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/api/communication/unix_socket.rb

@@ -0,0 +1,27 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/api/communication/socket'
+
+module Contrast
+  module Api
+    module Communication
+      # Implements a UNIX domain socket to connect to the Contrast Service.
+      class UnixSocket
+        include Contrast::Api::Communication::Socket
+
+        attr_reader :path
+
+        # Create the socket
+        # @param path [String] file path to a UNIX domain socket
+        def initialize path
+          @path = path
+        end
+
+        def new_socket
+          ::UNIXSocket.new(path)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/api/decorators.rb

@@ -8,7 +8,17 @@ module Contrast
     end
   end
 end
+cs__scoped_require 'contrast/api/decorators/message'
 cs__scoped_require 'contrast/api/decorators/application_update'
 cs__scoped_require 'contrast/api/decorators/input_analysis'
 cs__scoped_require 'contrast/api/decorators/application_settings'
 cs__scoped_require 'contrast/api/decorators/server_features'
+cs__scoped_require 'contrast/api/decorators/route_coverage'
+cs__scoped_require 'contrast/api/decorators/trace_event_object'
+cs__scoped_require 'contrast/api/decorators/trace_event_signature'
+cs__scoped_require 'contrast/api/decorators/trace_taint_range'
+cs__scoped_require 'contrast/api/decorators/trace_event'
+cs__scoped_require 'contrast/api/decorators/rasp_rule_sample'
+cs__scoped_require 'contrast/api/decorators/user_input'
+cs__scoped_require 'contrast/api/decorators/address'
+cs__scoped_require 'contrast/api/decorators/http_request'

data/lib/contrast/api/decorators/address.rb

@@ -0,0 +1,60 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/api/dtm.pb'
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/string_utils'
+cs__scoped_require 'contrast/utils/timer'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the Address protobuf model so it can own some of the
+      # data massaging required for Request dtm
+      module Address
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
+        module ClassMethods
+          include Contrast::Components::Interface
+          access_component :logging
+
+          # receiver is memoized because it is the address/host/port of the server, once we
+          # resolve this for the first time, it shouldn't change
+          #
+          # @return [Contrast::Api::Dtm::Address] the address of this server
+          def build_receiver
+            @_build_receiver ||= begin
+                             address = new
+                             address.host = 'localhost'
+                             address.ip = '127.0.0.1'
+                             begin
+                               Timeout.timeout(1) do
+                                 address.host = Contrast::Utils::StringUtils.force_utf8(Socket.gethostname)
+                                 address.ip = Contrast::Utils::StringUtils.force_utf8(Resolv.getaddress(address.host))
+                               end
+                             rescue StandardError => e
+                               logger.warn('Unable to resolve host or ip', e, address: address)
+                             end
+                             address
+                           end
+          end
+
+          # Parse out the sender of the Request and return it as an Address
+          #
+          # @return [Contrast::Api::Dtm::Address] the address from which the
+          #   request originated
+          def build_sender request
+            sender = new
+            sender.ip = Contrast::Utils::StringUtils.force_utf8(request.ip)
+            sender
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::Address.include(Contrast::Api::Decorators::Address)

data/lib/contrast/api/decorators/application_settings.rb

@@ -8,7 +8,12 @@ module Contrast
     module Decorators
       # Used to decorate the ApplicationSettings protobuf model to handle setting translation
       module ApplicationSettings
-        MODE_ALLOWLIST = %i[NO_ACTION BLOCK_AT_PERIMETER MONITOR BLOCK].cs__freeze
+        MODE_ALLOWLIST = [
+          Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION,
+          Contrast::Api::Settings::ProtectionRule::Mode::BLOCK,
+          Contrast::Api::Settings::ProtectionRule::Mode::MONITOR,
+          Contrast::Api::Settings::ProtectionRule::Mode::BLOCK_AT_PERIMETER
+        ].cs__freeze
         # Convert protobuf exlcusions into Agent exclusions
         def translated_exclusions
           exclusions.map { |exc| Contrast::Agent::ExclusionMatcher.new(exc) }
@@ -25,8 +30,7 @@ module Contrast
           {
               modes_by_id: translated_protection_mode_by_id,
               exclusion_matchers: translated_exclusions,
-              disabled_assess_rules: disabled_assess_rules,
-              session_id: Contrast::Utils::StringUtils.force_utf8(session_id)
+              disabled_assess_rules: disabled_assess_rules
           }
         end
       end