contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/agent/reporting/report.rb

@@ -0,0 +1,32 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    # This is the base module for our reporting functionality. It is intended to
+    # facilitate all the needed report generating functionality and eventual
+    # report to RS.
+    # Any class under this namespace should be required here, providing a
+    # single point of require for this functionality.
+    module Reporting
+    end
+  end
+end
+
+require 'contrast/agent/reporting/reporter'
+require 'contrast/agent/reporting/reporting_utilities/audit'
+require 'contrast/agent/reporting/reporting_utilities/reporter_client'
+require 'contrast/agent/reporting/reporting_utilities/response_handler'
+require 'contrast/agent/reporting/reporting_utilities/response'
+# Events
+require 'contrast/agent/reporting/reporting_events/finding'
+require 'contrast/agent/reporting/reporting_events/preflight_message'
+require 'contrast/agent/reporting/reporting_events/preflight'
+require 'contrast/agent/reporting/reporting_events/observed_route'
+require 'contrast/agent/reporting/reporting_events/route_coverage'
+require 'contrast/agent/reporting/reporting_events/observed_library_usage'
+require 'contrast/agent/reporting/reporting_events/poll'
+require 'contrast/agent/reporting/reporting_events/server_settings'
+require 'contrast/agent/reporting/reporting_events/application_settings'
+# Sensitive data masking
+require 'contrast/agent/reporting/masker/masker'

data/lib/contrast/agent/reporting/reporter.rb

@@ -0,0 +1,163 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/thread/worker_thread'
+require 'contrast/agent/reporting/report'
+require 'contrast/components/logger'
+require 'contrast/agent/reporting/reporting_events/agent_startup'
+require 'contrast/agent/telemetry/exception'
+
+module Contrast
+  module Agent
+    # This module will hold everything essential to reporting to TeamServer
+    class Reporter < WorkerThread
+      include Contrast::Components::Logger::InstanceMethods
+      include Contrast::Utils::ObjectShare
+
+      MAX_QUEUE_SIZE = 1000
+
+      class << self
+        # check if we can report to TS
+        #
+        # @return[Boolean] true if bypass is enabled, or false if bypass disabled
+        def enabled?
+          @_enabled = ::Contrast::AGENT.enabled? if @_enabled.nil?
+          @_enabled
+        end
+      end
+
+      def client
+        @_client ||= Contrast::Agent::Reporting::ReporterClient.new
+      end
+
+      def connection
+        @_connection ||= client.initialize_connection
+      end
+
+      def start_thread!
+        return if running?
+
+        client.startup!(connection)
+        @_thread = Contrast::Agent::Thread.new do
+          logger.debug('[Reporter] Starting background Reporter thread.')
+          loop do
+            next unless connected?
+
+            process_event(queue.pop)
+          rescue StandardError => e
+            logger.debug('[Reporter] thread could not process because of:', e)
+          end
+        end
+      end
+
+      # Suspend the Reporter and try sending the event after the timeout.
+      # The timeout is either default 15 min or received via TS response.
+      #
+      # @param event [Contrast::Agent::Reporting::ReportingEvent] Freshly pop-ed event.
+      def handle_resend event
+        sleep(client.timeout) if client.sleep?
+        # Retry once than discard the event. This is trigger on too many events of
+        # same kind error.
+        client.send_event(event, connection) if client.mode.status == client.mode.resending
+        client.mode.reset_mode
+        client.wake_up
+      end
+
+      # @param event [Contrast::Agent::Reporting::ReportingEvent]
+      def send_event event
+        if ::Contrast::AGENT.disabled?
+          logger.warn('[Reporter] Attempted to queue event with Agent disabled', caller: caller, event: event)
+          return
+        end
+        return unless event
+
+        if queue.size >= MAX_QUEUE_SIZE
+          Contrast::Agent::Telemetry::Base.enabled? && Contrast::Agent.thread_watcher.telemetry_queue.
+              send_event(queue_limit_telemetry_event)
+
+          return
+        end
+        queue << event
+      end
+
+      # Use this to bypass the messaging queue and leave response processing to the caller.
+      # Do not use this in separate threads since this will create a race condition, when
+      # two threads need to use the same OpenSSL::SSL::SSLSocket raising frozen error.
+      #
+      # @param event [Contrast::Agent::Reporting::ReportingEvent]
+      # @return [Net::HTTPResponse, nil]
+      def send_event_immediately event
+        if ::Contrast::AGENT.disabled?
+          logger.warn('[Reporter] attempted to send event immediately with Agent disabled', caller: caller,
+                                                                                            event: event)
+          return
+        end
+        return unless event
+
+        client.send_event(event, connection)
+      rescue StandardError => e
+        logger.error('[Reporter] Could not send message to TeamServer from reporting queue.', e)
+      end
+
+      def delete_queue!
+        @_queue&.clear
+        @_queue&.close
+        @_queue = nil
+      end
+
+      def stop!
+        return unless running?
+
+        super
+        delete_queue!
+      end
+
+      private
+
+      def queue
+        @_queue ||= Queue.new
+      end
+
+      # TODO: RUBY-99999
+      # The client and connection are being used in multiple threads/ concurrently, and that's not okay. We need
+      # to figure out why that is and lock it so that it isn't.
+      #
+      # @return [Boolean]
+      def connected?
+        return true if client && connection
+
+        logger.debug('[Reporter] No client/connection; sleeping...', client: client, connection: connection)
+        sleep(5)
+        false
+      end
+
+      # @param event [Contrast::Agent::Reporting::ReportingEvent]
+      def process_event event
+        client.send_event(event, connection)
+        handle_resend(event) if client.mode.status == client.mode.resending
+      rescue StandardError => e
+        logger.error('[Reporter] Could not send message to TeamServer from reporting queue.', e)
+      end
+
+      # @return [Contrast::Agent::Telemetry::Exception::Event]
+      def queue_limit_telemetry_event
+        message_exception = Contrast::Agent::Telemetry::Exception::MessageException.build(
+            'String',
+            "[Reporter] Maximum queue size (#{ MAX_QUEUE_SIZE }) reached for reporting events", nil, stack_frame)
+        message = Contrast::Agent::Telemetry::Exception::Message.build({}, [message_exception])
+        Contrast::Agent::Telemetry::Exception::Event.new(message)
+      end
+
+      def stack_frame
+        stack_trace = caller_locations(20, 20)
+        stack_frame_type = if stack_trace.nil? || stack_trace[1].nil?
+                             'none'
+                           else
+                             stack_trace[1].path.delete_prefix(Dir.pwd)
+                           end
+        stack_frame_function = stack_trace.nil? || stack_trace[1].nil? ? 'none' : stack_trace[1].label
+        Contrast::Agent::Telemetry::Exception::StackFrame.build(stack_frame_function, stack_frame_type, nil)
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/agent_startup.rb

@@ -0,0 +1,34 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/reporting_events/server_reporting_event'
+require 'contrast/config'
+
+module Contrast
+  module Agent
+    module Reporting
+      #	AgentStartup Event which sends the agent data to TeamServer on the startup of a server or process,
+      # used to create a new Server entity there.
+      class AgentStartup < Contrast::Agent::Reporting::ServerReportingEvent
+        def initialize
+          @event_method = :PUT
+          @event_endpoint = Contrast::Agent::Reporting::Endpoints::NG_ENDPOINTS[:agent_startup]
+          @event_type = :agent_startup
+          super()
+        end
+
+        def file_name
+          'agent-startup'
+        end
+
+        def to_controlled_hash
+          {
+              environment: ::Contrast::CONFIG.server.environment,
+              tags: ::Contrast::CONFIG.server.tags,
+              version: Contrast::Agent::VERSION
+          }
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_activity.rb

@@ -0,0 +1,120 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/agent/reporting/reporting_events/application_reporting_event'
+require 'contrast/agent/reporting/reporting_events/application_defend_activity'
+require 'contrast/agent/reporting/reporting_events/application_inventory_activity'
+require 'contrast/agent/reporting/attack_result/response_type'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new ApplicationActivity class which will include all the needed information for the new reporting
+      # system to report
+      class ApplicationActivity < Contrast::Agent::Reporting::ApplicationReportingEvent
+        include Contrast::Agent::Reporting::ResponseType
+        include Contrast::Components::Logger::InstanceMethods
+
+        # @return [Integer]
+        attr_accessor :query_count
+        # @return [Array]
+        attr_accessor :routes
+        # @return [Contrast::Agent::Response]
+        attr_accessor :response
+
+        def initialize ia_request: nil
+          @routes = []
+          @query_count = 0
+          @event_method = :PUT
+          @event_type = :application_activity
+          @event_endpoint = Contrast::Agent::Reporting::Endpoints.application_activity
+          @_request = FindingRequest.convert(ia_request) if ia_request
+          super()
+        end
+
+        # @return [Contrast::Agent::Reporting::FindingRequest] Current context's request
+        def request
+          @_request ||= FindingRequest.convert(Contrast::Agent::REQUEST_TRACKER.current&.request)
+        end
+
+        # @return [Contrast::Agent::Reporting::ApplicationDefendActivity] main
+        # activity for all protect rules.
+        def defend
+          @_defend ||= Contrast::Agent::Reporting::ApplicationDefendActivity.new(ia_request: request)
+        end
+
+        # @return [Contrast::Agent::Reporting::ApplicationInventoryActivity] main
+        # activity for all inventory activity reporting.
+        def inventory
+          @_inventory ||= Contrast::Agent::Reporting::ApplicationInventoryActivity.new
+        end
+
+        # @return file_name [String] used for audit
+        def file_name
+          'activity-application'
+        end
+
+        def to_controlled_hash
+          hsh = { lastUpdate: since_last_update }
+          hsh[:defend] = defend&.to_controlled_hash
+          hsh[:inventory] = inventory&.to_controlled_hash
+          hsh
+        end
+
+        # Look for attack results and access to samples by
+        # searching with rule_id and response_type
+        #
+        # @param rule_id [String] name of the protect rule
+        # @param response_type[Symbol<Contrast::Agent::Reporting::ResponseType]
+        #  filter by response type
+        # @return [Array<Contrast::Agent::Reporting::ApplicationDefendAttackSampleActivity>, nil]
+        # return any matches.
+        def attack_results_for rule_id, response_type = nil
+          results = []
+          defend.attackers.each do |attacker|
+            next unless attacker.protection_rules[rule_id]
+
+            result = case response_type
+                     when BLOCKED, BLOCKED_AT_PERIMETER
+                       attacker.protection_rules[rule_id].blocked
+                     when EXPLOITED
+                       attacker.protection_rules[rule_id].exploited
+                     when PROBED
+                       attacker.protection_rules[rule_id].ineffective
+                     when SUSPICIOUS
+                       attacker.protection_rules[rule_id].suspicious
+                     else
+                       attacker.protection_rules[rule_id]
+                     end
+            results << result if result
+          end
+          results
+        end
+
+        # By reference. List of all results only by values, no rule_ids.
+        #
+        # @return [Array<[Contrast::Agent::Reporting::ApplicationDefendAttackerActivity]>]
+        def attack_results
+          defend.attackers.map { |a| a.protection_rules.values }
+        end
+
+        # This is primary used for attaching new data and merging existing
+        # samples per rule entry in attackers, and to make sure the attack
+        # time_map is updated correctly.
+        #
+        # @param attack_result [Contrast::Agent::Reporting::AttackResult]
+        def attach_defend attack_result
+          defend.attach_data(attack_result)
+        end
+
+        # This is primary used for attaching new inventory reporting
+        #
+        # @param architecture [Contrast::Agent::Reporting::ArchitectureComponent]
+        def attach_inventory architecture
+          inventory.attach_data(architecture)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_defend_activity.rb

@@ -0,0 +1,101 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/agent/reporting/reporting_events/application_defend_attacker_activity'
+require 'contrast/utils/duck_utils'
+require 'contrast/agent/reporting/reporting_events/reporting_event'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new ApplicationDefendActivity class which includes information about the defense of the application
+      # which was discovered during exercise of the application during this activity period.
+      class ApplicationDefendActivity < Contrast::Agent::Reporting::ReportingEvent
+        include Contrast::Components::Logger::InstanceMethods
+
+        # @return [Array<Contrast::Agent::Reporting::ApplicationDefendAttackerActivity>]
+        attr_reader :attackers
+
+        def initialize ia_request: nil
+          @attackers = []
+          @event_type = :application_defend_activity
+          @request = ia_request
+          super()
+        end
+
+        def to_controlled_hash
+          validate
+          {
+              attackers: attackers.map(&:to_controlled_hash)
+          }
+        end
+
+        def validate
+          return unless Contrast::Utils::DuckUtils.empty_duck?(attackers)
+
+          raise(ArgumentError, 'Attackers data must be populated')
+        end
+
+        # @param attack_result [Contrast::Agent::Reporting::AttackResult]
+        def attach_data attack_result
+          return unless attack_result&.cs__is_a?(Contrast::Agent::Reporting::AttackResult)
+
+          attacker_activity = Contrast::Agent::Reporting::ApplicationDefendAttackerActivity.new(ia_request: @request)
+          attacker_activity.attach_data(attack_result)
+
+          @existing_attacker_activity = true
+          if (existing_attacker_activity = find_existing_attacker_activity(attacker_activity))
+            attach_existing(existing_attacker_activity, attacker_activity, attack_result.rule_id)
+          else
+            attackers << attacker_activity
+          end
+        end
+
+        # Find an existing attacker if it matches on source details
+        # @param new_attacker_activity [Contrast::Agent::Reporting::ApplicationDefendAttackerActivity]
+        def find_existing_attacker_activity new_attacker_activity
+          attackers.find do |existing|
+            existing.source_forwarded_for == new_attacker_activity.source_forwarded_for &&
+                existing.source_ip == new_attacker_activity.source_ip
+          end
+        end
+
+        # @param existing_attacker_activity [Contrast::Agent::Reporting::ApplicationDefendAttackerActivity]
+        # @param attacker_activity [Contrast::Agent::Reporting::ApplicationDefendAttackerActivity]
+        # @param rule [String]
+        def attach_existing existing_attacker_activity, attacker_activity, rule
+          new_violation = attacker_activity.protection_rules[rule]
+          sample_activity = Contrast::Agent::Reporting::ApplicationDefendAttackSampleActivity
+          if (previously_violated = existing_attacker_activity.protection_rules[rule])
+            if (new_blocked = new_violation.blocked)
+              previously_violated.blocked ||= sample_activity.new
+              previously_violated.blocked.samples.concat(new_blocked.samples) if new_blocked.samples
+              previously_violated.blocked.merge_time_maps(new_blocked.time_map)
+            end
+
+            if (new_exploited = new_violation.exploited)
+              previously_violated.exploited ||= sample_activity.new
+              previously_violated.exploited.samples.concat(new_exploited.samples) if new_exploited.samples
+              previously_violated.exploited.merge_time_maps(new_exploited.time_map)
+            end
+
+            if (new_ineffective = new_violation.ineffective)
+              previously_violated.ineffective ||= sample_activity.new
+              previously_violated.ineffective.samples.concat(new_ineffective.samples) if new_ineffective.samples
+              previously_violated.ineffective.merge_time_maps(new_ineffective.time_map)
+            end
+
+            if (new_suspicious = new_violation.suspicious)
+              previously_violated.suspicious ||= sample_activity.new
+              previously_violated.suspicious.samples.concat(new_suspicious.samples) if new_suspicious.samples
+              previously_violated.suspicious.merge_time_maps(new_suspicious.time_map)
+            end
+          else
+            existing_attacker_activity.protection_rules[rule] = new_violation
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_defend_attack_activity.rb

@@ -0,0 +1,79 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/agent/reporting/reporting_events/application_defend_attack_sample_activity'
+require 'contrast/agent/reporting/reporting_events/reportable_hash'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new ApplicationDefendAttackActivity class which will include the attacks sent by the source.
+      class ApplicationDefendAttackActivity < Contrast::Agent::Reporting::ReportableHash
+        # @return [Contrast::Agent::Reporting::ApplicationDefendAttackSampleActivity]
+        attr_accessor :blocked
+        # @return [Contrast::Agent::Reporting::ApplicationDefendAttackSampleActivity]
+        attr_accessor :exploited
+        # @return [Contrast::Agent::Reporting::ApplicationDefendAttackSampleActivity]
+        attr_accessor :ineffective
+        # @return [Contrast::Agent::Reporting::ApplicationDefendAttackSampleActivity]
+        attr_accessor :suspicious
+        # Helper method to determine before hand the response type and iv needed for access
+        #
+        # @return [Contrast::Agent::Reporting::ResponseType]
+        attr_reader :response_type
+
+        def initialize
+          @start_time = start_time
+          super()
+        end
+
+        def to_controlled_hash
+          blocked_hash = blocked&.to_controlled_hash || Contrast::Utils::ObjectShare::EMPTY_HASH
+          exploited_hash = exploited&.to_controlled_hash || Contrast::Utils::ObjectShare::EMPTY_HASH
+          ineffective_hash = ineffective&.to_controlled_hash || Contrast::Utils::ObjectShare::EMPTY_HASH
+          suspicious_hash = suspicious&.to_controlled_hash || Contrast::Utils::ObjectShare::EMPTY_HASH
+          validate(blocked_hash, exploited_hash, ineffective_hash, suspicious_hash)
+          {
+              startTime: @start_time,
+              blocked: blocked_hash,
+              exploited: exploited_hash,
+              ineffective: ineffective_hash,
+              suspicious: suspicious_hash
+          }
+        end
+
+        def validate blocked_hash, exploited_hash, ineffective_hash, suspicious_hash
+          raise(ArgumentError, 'Start Time for is not presented') unless @start_time
+          return unless [blocked_hash, exploited_hash, ineffective_hash, suspicious_hash].all?(&:empty?)
+
+          raise(ArgumentError, 'At least one of the samples must be populated')
+        end
+
+        # @param attack_result [Contrast::Agent::Reporting::AttackResult]
+        # @return [Contrast::Agent::Reporting::Defend::AttackSampleActivity]
+        def attach_data attack_result
+          attack_sample_activity = Contrast::Agent::Reporting::ApplicationDefendAttackSampleActivity.new
+          attack_sample_activity.attach_data(attack_result)
+          @response_type = attack_result.response
+          case response_type
+          when ::Contrast::Agent::Reporting::ResponseType::BLOCKED,
+              ::Contrast::Agent::Reporting::ResponseType::BLOCKED_AT_PERIMETER
+
+            @blocked = attack_sample_activity
+          when ::Contrast::Agent::Reporting::ResponseType::MONITORED
+            @exploited = attack_sample_activity
+          when ::Contrast::Agent::Reporting::ResponseType::PROBED
+            @ineffective = attack_sample_activity
+          when ::Contrast::Agent::Reporting::ResponseType::SUSPICIOUS
+            @suspicious = attack_sample_activity
+          end
+        end
+
+        def start_time
+          Contrast::Agent::REQUEST_TRACKER.current&.timer&.start_ms || 0
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_defend_attack_sample.rb

@@ -0,0 +1,101 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/protect/rule/cmdi/cmd_injection'
+require 'contrast/agent/protect/rule/deserialization/deserialization'
+require 'contrast/agent/protect/rule/no_sqli/no_sqli'
+require 'contrast/agent/reporting/attack_result/user_input'
+require 'contrast/agent/reporting/attack_result/response_type'
+require 'contrast/components/logger'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new ApplicationDefendAttackSample class which includes a samples of an attack for the given rule of
+      # the given result observed in the activity period.
+      class ApplicationDefendAttackSample
+        include Contrast::Agent::Reporting::InputType
+
+        # @return [Contrast::Agent::Reporting::UserInput]
+        attr_accessor :user_input
+        # @return [Array<Contrast::Agent::Reporting::ApplicationDefendAttackSampleStack>]
+        attr_reader :stack
+        # Details are per rule specific and should be set when the sample is build
+        #
+        # @return [Contrast::Agent::Reporting::Details::ProtectRuleDetails, {}]
+        attr_accessor :details
+        # @return [Integer] time in ms
+        attr_accessor :time_stamp
+
+        class << self
+          # @param attack_result [Contrast::Agent::Reporting::AttackResult]
+          # @param attack_sample [Contrast::Agent::Reporting::ApplicationDefendAttackSample]
+          def convert attack_result, attack_sample
+            activity = new
+            activity.attach_data(attack_result, attack_sample)
+            activity
+          end
+        end
+
+        def initialize
+          @time_stamp = Contrast::Agent::REQUEST_TRACKER.current&.timer&.start_ms || 0 # in ms
+          @blocked = false
+          @event_type = :application_defend_attack_sample
+          @user_input = Contrast::Agent::Reporting::UserInput.new
+          @request = Contrast::Agent::REQUEST_TRACKER.current&.activity&.request
+          @stack = Contrast::Utils::StackTraceUtils.build_protect_report_stack_array
+          @details = {}
+        end
+
+        def to_controlled_hash
+          {
+              blocked: @blocked,
+              input: build_input(@user_input),
+              details: @details&.to_controlled_hash,
+              request: @request&.to_controlled_hash,
+              stack: @stack&.map(&:to_controlled_hash),
+              timestamp: build_time_stamp
+          }
+        end
+
+        # @param response_type [Contrast::Agent::Reporting::ResponseType]
+        # @return [Boolean] check if response type is blocked
+        def blocked? response_type
+          @blocked = response_type == Contrast::Agent::Reporting::ResponseType::BLOCKED
+        end
+
+        # @param user_input [Contrast::Agent::Reporting::UserInput]
+        def build_input user_input
+          {
+              documentPath: user_input.path,
+              documentType: user_input.document_type.to_s,
+              filters: user_input.matcher_ids,
+              name: user_input.key,
+              time: time_stamp,
+              type: user_input.input_type.to_s,
+              value: user_input.value
+          }
+        end
+
+        # @param attack_result [Contrast::Agent::Reporting::AttackResult]
+        # @param attack_sample [Contrast::Agent::Reporting::RaspRuleSample]
+        def attach_data attack_result, attack_sample
+          @blocked = attack_result.response == ::Contrast::Agent::Reporting::ResponseType::BLOCKED
+          @user_input = attack_sample.user_input
+          @details = attack_sample.details
+          @time_stamp = attack_sample.time_stamp
+          @request = FindingRequest.convert(Contrast::Agent::REQUEST_TRACKER.current&.request)
+          @stack = Contrast::Utils::StackTraceUtils.build_protect_report_stack_array
+        end
+
+        # @return [Hash]
+        def build_time_stamp
+          {
+              start: time_stamp,
+              elapsed: Contrast::Utils::Timer.now_ms - time_stamp
+          }
+        end
+      end
+    end
+  end
+end