immunio 1.0.13 → 1.0.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: d5de4fe5e22b12a72cb97953b87a947c447f0803
-  data.tar.gz: 3c004b6a90391a8b23fe5d54b48bf770adbd4c01
+  metadata.gz: 4f381a24b73b7115c320e46e538564da3d4001f2
+  data.tar.gz: 12b66439e36175bddd908eca2f94ec5269c6ccb4
 SHA512:
-  metadata.gz: 5a94e59b6b6e0defbdb18aa08b955de7ce3700c053b2f8f247db61931dd67ff788379584c791503d844d47c220e394aa93e753d7f40953220683199e6a05be1c
-  data.tar.gz: 83ad5fc59f7bd320e2881f11bcbdad261c21a2734645921c4df4ab58e5849b167c0d6e2905d5eb242c6fee76711bb9d215b7ba1a2c37fd6ecfe4c65bb3b00868
+  metadata.gz: 75b54a277712434f4cfc18dd8f1a7e2bbe0c061dd7f4053f9e98048a9608107c1dc22e2c4b92334191970b68560ac83632661aae561efc332a28eb8c0c0830a1
+  data.tar.gz: d37adcced6010eb26a12990217d59d93f8520122b583d0489d0a7df85c795f2fea3102d02767d12285eaed411149fce6903e0c4bdb999f4d27141aae5bb211c0

data/lib/immunio/plugins/action_view.rb

@@ -256,7 +256,35 @@ module Immunio
       end
     end
 
+    ENCODED_IMMUNIO_TOKENS_RE = Regexp.compile(/(?:{|%7b)immunio-(var|fragment)(?::|%3a)(\d+)(?::|%3a)([0-9a-f]{1,4})(?:}|%7d)(.*?)(?:{|%7b)(?:\/|%2f)immunio-\1(?::|%3a)\2(?::|%3a)\3(?:}|%7d)/i)
+    def self.decode_immunio_tokens(rendered)
+      # Look for URI or JS encoded immunio tokens in the rendering and decode them
+      if rendered.respond_to? :to_str
+        was_html_safe = rendered.html_safe?
+        was_frozen = rendered.frozen?
+
+        if was_frozen
+          # This is not an airtight solution. Object#dup does not copy methods
+          # defined on the instance, and may be overridden by subclasses to do
+          # things that would cause problems for us. But most likely there is no
+          # problem with using dup. We can't use Object#clone because the clone
+          # retains the frozen status of the original, preventing us from
+          # modifying the string contents.
+          rendered = rendered.dup
+        end
+
+        rendered.gsub! ENCODED_IMMUNIO_TOKENS_RE, "{immunio-\\1:\\2:\\3}\\4{/immunio-\\1:\\2:\\3}"
+
+        rendered.instance_variable_set(:@html_safe, true) if was_html_safe
+        rendered.freeze if was_frozen
+      end
+
+      rendered
+    end
+
     def self.render_var(code, rendered, template_id, template_sha, file, line, escape, is_text, handler)
+      rendered = decode_immunio_tokens rendered
+
       if rendered.instance_variable_get("@__immunio_processed") then
         # Ignore buffers marked as __immunio_processed in render as these are full templates or partials
         return rendered
@@ -289,23 +317,23 @@ module Immunio
       rendering_stack.first.mark_and_defer_fragment_write(*args)
     end
 
-    private
-      # Stack of the templates currently being rendered.
-      def self.rendering_stack
-        Thread.current["immunio.rendering_stack"] ||= []
-      end
+    # Stack of the templates currently being rendered.
+    def self.rendering_stack
+      Thread.current["immunio.rendering_stack"] ||= []
+    end
 
-      def self.wrap_code(code, handler, options = {})
-        case
-        when handler == 'ActionView::Template::Handlers::ERB'
-          modifier = options[:escape] ? '=' : '=='
-          "<%#{modifier} #{code} %>"
-        when handler == 'Haml::Plugin'
-          modifier = options[:escape] ? '=' : '!='
-          "#{modifier} #{code}"
-        end
+    def self.wrap_code(code, handler, options = {})
+      case
+      when handler == 'ActionView::Template::Handlers::ERB'
+        modifier = options[:escape] ? '=' : '=='
+        "<%#{modifier} #{code} %>"
+      when handler == 'Haml::Plugin'
+        modifier = options[:escape] ? '=' : '!='
+        "#{modifier} #{code}"
       end
+    end
 
+    private
       def rendering_stack
         self.class.rendering_stack
       end

data/lib/immunio/processor.rb

@@ -110,17 +110,20 @@ module Immunio
       Request.current = nil
     end
 
-    def make_safe_meta(meta)
-      # Some versions of rails, like 4.2.0, fail to JSONify some objects properly.
-      safe_meta = {}
-      meta.each do |key, value|
-        if value.is_a?(Numeric) || value.is_a?(String) || value.is_a?(TrueClass) || value.is_a?(FalseClass)
-          safe_meta[key] = value
-        else
-          safe_meta[key] = value.inspect
-        end
+    # Some versions of rails, like 4.2.0, fail to make JSONifiable model
+    # instances because they have bugs where superfluous sub-objects of
+    # unserializable classes, like IO, are added. Filter non-array, non-hash,
+    # non-primitive values from data to be JSONified.
+    def make_safe_data(data)
+      if data.is_a?(Hash)
+        data.each_with_object({}) { |(key, value), obj| obj[key] = make_safe_data(value) }
+      elsif data.is_a?(Array)
+        data.map(&method(:make_safe_data))
+      elsif [Numeric, String, TrueClass, FalseClass].any? { |c| data.is_a? c }
+        data
+      else
+        data.inspect
       end
-      safe_meta
     end
 
     # Run the `hook` and return a hash eg.: `{ "allow": true }`.
@@ -193,7 +196,7 @@ module Immunio
             timestamp: timestamp,
             plugin: plugin,
             hook: hook,
-            meta: make_safe_meta(meta),
+            meta: make_safe_data(meta),
             vmcode_version: request.vm.code_version,
             vmdata_version: request.vm.data_version
           }
@@ -211,7 +214,7 @@ module Immunio
                          timestamp: timestamp,
                          plugin: plugin,
                          hook: hook,
-                         meta: make_safe_meta(meta),
+                         meta: make_safe_data(meta),
                          vmcode_version: request.vm.code_version,
                          vmdata_version: request.vm.data_version
 

data/lib/immunio/version.rb

@@ -1,5 +1,5 @@
 module Immunio
   AGENT_TYPE = "agent-ruby"
-  VERSION = "1.0.13"
+  VERSION = "1.0.14"
   VM_VERSION = "2.2.0"
 end

data/lua-hooks/Makefile

@@ -27,7 +27,9 @@ LUA_SRC = \
 	lib/lexgraph.lua \
 	lib/neturl.lua \
 	lib/paths.lua \
+	lib/perf.lua \
 	lib/permit.lua \
+	lib/real_ip.lua \
 	lib/sanitize_sql.lua \
 	lib/sanitize_command.lua \
 	lib/semver.lua \
@@ -103,7 +105,7 @@ endif
 all: ${CLI} ${INIT_HOOK} ${HOOKS_TARBALL} ${HOOKS_SRCS_TARBALL}
 
 %.o: %.c
-	MACOSX_DEPLOYMENT_TARGET="10.9" ${CC} ${CFLAGS} -c ${INCS} -o $@ $<
+	MACOSX_DEPLOYMENT_TARGET="10.8" ${CC} ${CFLAGS} -c ${INCS} -o $@ $<
 
 # There is a huge performance advantage compiling sha1.o with just -O
 # -O2 or -O3 *reduce* the speed of the algorithm 30%
@@ -123,7 +125,7 @@ ${LUAJIT_OUT}: ${LUAJIT_OBJ}
 	cp $^ $@
 
 ${LUAJIT_OBJ}:
-	cd ext/luajit && MACOSX_DEPLOYMENT_TARGET="10.9" make CROSS="${CROSS}" CC=cc HOST_CC=cc TARGET_SYS=${SYS} XCFLAGS="${LUAJIT_XCFLAGS}"
+	cd ext/luajit && MACOSX_DEPLOYMENT_TARGET="10.8" make CROSS="${CROSS}" CC=cc HOST_CC=cc TARGET_SYS=${SYS} XCFLAGS="${LUAJIT_XCFLAGS}"
 
 # Build lua executable for testing and compilation
 # Seperate compilation as we need the LUA_UNSAFE_MODE flag set...

data/lua-hooks/ext/all.c

@@ -17,6 +17,11 @@
 #include "lua-snapshot/snapshot.c"
 #include "sha1/luasha1.c"
 #include "sha2/luasha256.c"
+#include "perf/luacpu.c"
+#include "perf/lualoadavg.c"
+#include "perf/luameminfo.c"
+#include "perf/luaoslib.c"
+
 
 static const luaL_Reg lj_lib_load[] = {
   // Default Lua modules
@@ -46,6 +51,10 @@ static const luaL_Reg lj_lib_load[] = {
   {"snapshot", luaopen_snapshot},
   {"sha1", luaopen_sha1},
   {"sha2", luaopen_sha256},
+  {"perf", luaopen_cpuload},
+  {"perf", luaopen_loadavg},
+  {"perf", luaopen_meminfo},
+  {"perf", luaopen_luaos},
 
   { NULL,   NULL }
 };

data/lua-hooks/ext/perf/luacpu.c

@@ -0,0 +1,114 @@
+#include <stdio.h>
+#include <unistd.h>
+
+#define LUA_LIB
+#include "lua.h"
+#include "lauxlib.h"
+
+/* Show overall CPU utilization of the system 
+ * This is a part of the post http://phoxis.org/2013/09/05/finding-overall-and-per-core-cpu-utilization
+ */
+
+#define BUF_MAX 1024
+
+int 
+read_fields (FILE *fp, unsigned long long int *fields) {
+  int retval;
+  char buffer[BUF_MAX];
+  if (!fgets (buffer, BUF_MAX, fp)) {
+    perror ("Error");
+  }
+  retval = sscanf (buffer, "cpu %Lu %Lu %Lu %Lu %Lu %Lu %Lu %Lu %Lu %Lu", 
+  &fields[0], 
+  &fields[1], 
+  &fields[2], 
+  &fields[3], 
+  &fields[4], 
+  &fields[5], 
+  &fields[6], 
+  &fields[7], 
+  &fields[8], 
+  &fields[9]); 
+  if (retval < 4) {
+    fprintf (stderr, "Error reading /proc/stat cpu field\n");
+    return 0;
+  }
+  return 1;
+}
+
+/* Immunio Lua bindings */
+
+static int
+lua_cpuload(lua_State *L) {
+  FILE *fp;
+  unsigned long long int fields[10], total_tick, total_tick_old, idle, idle_old, del_total_tick, del_idle;
+  int i;
+  double percent_usage;
+  char str[100];
+
+  fp = fopen ("/proc/stat", "r");
+  if (fp == NULL) {
+    perror ("Error");
+  }
+
+  if (!read_fields (fp, fields)) {
+    return 0;
+  }
+
+  for (i=0, total_tick = 0; i<10; i++) {
+    total_tick += fields[i];
+  }
+  idle = fields[3]; /* idle ticks index */
+  sleep (1);
+  total_tick_old = total_tick;
+  idle_old = idle;
+  fseek (fp, 0, SEEK_SET);
+  fflush (fp);
+  if (!read_fields (fp, fields)) {
+    return 0;
+  }
+
+  for (i=0, total_tick = 0; i<10; i++) {
+    total_tick += fields[i];
+  } 
+  idle = fields[3];
+
+  del_total_tick = total_tick - total_tick_old;
+  del_idle = idle - idle_old;
+
+  percent_usage = ((del_total_tick - del_idle) / (double) del_total_tick) * 100; /* 3 is index of idle time */
+  sprintf(str,"%f",percent_usage);
+  lua_pushstring(L, str);
+  fclose(fp);
+  return 1;
+}
+
+static int
+lua_stat(lua_State *L) {
+  FILE *fp;
+  char buf[3000];
+  if ((fp=fopen("/proc/stat","r"))==NULL) {
+    printf("Error! opening file");
+  }
+  else {
+    fread(buf, 1, 3000, fp);
+    size_t fsize = ftell(fp);
+    buf[fsize] = '\0';
+    lua_pushstring(L, buf);
+  }
+  fclose(fp);
+  return 1;
+}
+
+static const luaL_Reg libcpuload[] = {
+  {"cpuload", lua_cpuload},
+  {"stat", lua_stat},
+  {NULL, NULL}
+};
+
+int
+luaopen_cpuload(lua_State *L) {
+  luaL_checkversion(L);
+  luaL_register(L, "perf", libcpuload);
+  return 1;
+}

data/lua-hooks/ext/perf/lualoadavg.c

@@ -0,0 +1,40 @@
+#include <stdio.h>
+#include <stdlib.h>
+
+#define LUA_LIB
+#include "lua.h"
+#include "lauxlib.h"
+
+
+/*https://www.centos.org/docs/5/html/5.1/Deployment_Guide/s2-proc-loadavg.html
+Gives load average in regard to both the CPU and IO over time, as well as additional
+data used by uptime and other commands. 
+*/
+
+/* Immunio Lua bindings */
+
+static int
+lua_loadavg(lua_State *L) {
+  char c[100];
+  FILE *fp;
+  if ((fp=fopen("/proc/loadavg","r"))==NULL) {
+    printf("Error! opening file");
+  }
+  if (fgets(c, 100, fp) != NULL) {
+    lua_pushstring(L, c);
+  }
+  fclose(fp);
+  return 1;
+}
+
+static const luaL_Reg libloadavg[] = {
+  {"loadavg", lua_loadavg},
+  {NULL, NULL}
+};
+
+int
+luaopen_loadavg(lua_State *L) {
+  luaL_checkversion(L);
+  luaL_register(L, "perf", libloadavg);
+  return 1;
+}

data/lua-hooks/ext/perf/luameminfo.c

@@ -0,0 +1,38 @@
+#include <stdio.h>
+
+#define LUA_LIB
+#include "lua.h"
+#include "lauxlib.h"
+
+/*https://www.centos.org/docs/5/html/5.1/Deployment_Guide/s2-proc-meminfo.html
+Gives information about RAM*/
+/* Immunio Lua bindings */
+
+static int
+lua_meminfo(lua_State *L) {
+  FILE *fp;
+  char buf[2000];
+  if ((fp=fopen("/proc/meminfo","r"))==NULL) {
+    printf("Error! opening file");
+  }
+  else {
+    fread(buf, 1, 2000, fp);
+    size_t fsize = ftell(fp);
+    buf[fsize] = '\0';
+    lua_pushstring(L,buf);
+  }
+  fclose(fp);
+  return 1;
+}
+
+static const luaL_Reg libmeminfo[] = {
+  {"meminfo", lua_meminfo},
+  {NULL, NULL}
+};
+
+int
+luaopen_meminfo(lua_State *L) {
+  luaL_checkversion(L);
+  luaL_register(L, "perf", libmeminfo);
+  return 1;
+}

data/lua-hooks/ext/perf/luaoslib.c

@@ -0,0 +1,80 @@
+#include <time.h>
+
+#define lib_os_c
+#define LUA_LIB
+
+#include "lua.h"
+#include "lauxlib.h"
+#include "lj_err.h"
+
+static int os_clock(lua_State *L) {
+  setnumV(L->top++, ((lua_Number)clock())*(1.0/(lua_Number)CLOCKS_PER_SEC));
+  return 1;
+}
+
+static int getboolfield(lua_State *L, const char *key) {
+  int res;
+  lua_getfield(L, -1, key);
+  res = lua_isnil(L, -1) ? -1 : lua_toboolean(L, -1);
+  lua_pop(L, 1);
+  return res;
+}
+
+static int getfield(lua_State *L, const char *key, int d) {
+  int res;
+  lua_getfield(L, -1, key);
+  if (lua_isnumber(L, -1)) {
+    res = (int)lua_tointeger(L, -1);
+  } else {
+    if (d < 0)
+      lj_err_callerv(L, LJ_ERR_OSDATEF, key);
+    res = d;
+  }
+  lua_pop(L, 1);
+  return res;
+}
+
+static int os_time(lua_State *L) {
+  time_t t;
+  if (lua_isnoneornil(L, 1)) {  /* called without args? */
+    t = time(NULL);  /* get current time */
+  } else {
+    struct tm ts;
+    luaL_checktype(L, 1, LUA_TTABLE);
+    lua_settop(L, 1);  /* make sure table is at the top */
+    ts.tm_sec = getfield(L, "sec", 0);
+    ts.tm_min = getfield(L, "min", 0);
+    ts.tm_hour = getfield(L, "hour", 12);
+    ts.tm_mday = getfield(L, "day", -1);
+    ts.tm_mon = getfield(L, "month", -1) - 1;
+    ts.tm_year = getfield(L, "year", -1) - 1900;
+    ts.tm_isdst = getboolfield(L, "isdst");
+    t = mktime(&ts);
+  }
+  if (t == (time_t)(-1))
+    lua_pushnil(L);
+  else
+    lua_pushnumber(L, (lua_Number)t);
+  return 1;
+}
+
+static int os_difftime(lua_State *L) {
+  lua_pushnumber(L, difftime((time_t)(luaL_checknumber(L, 1)),
+			     (time_t)(luaL_optnumber(L, 2, (lua_Number)0))));
+  return 1;
+}
+
+static const luaL_Reg libluaos[] = {
+  {"clock", os_clock},
+  {"time", os_time},
+  {"difftime", os_difftime},
+
+  {NULL, NULL}
+};
+
+int
+luaopen_luaos(lua_State *L) {
+  luaL_checkversion(L);
+  luaL_register(L, "perf", libluaos);
+  return 1;
+}

metadata

@@ -1,41 +1,41 @@
 --- !ruby/object:Gem::Specification
 name: immunio
 version: !ruby/object:Gem::Version
-  version: 1.0.13
+  version: 1.0.14
 platform: ruby
 authors:
 - Immunio
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-02-17 00:00:00.000000000 Z
+date: 2016-03-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: '3.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: '3.2'
 - !ruby/object:Gem::Dependency
   name: thor
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: 0.14.6
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - '>='
       - !ruby/object:Gem::Version
         version: 0.14.6
 - !ruby/object:Gem::Dependency
@@ -56,56 +56,56 @@ dependencies:
   name: msgpack
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0.5'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0.5'
 - !ruby/object:Gem::Dependency
   name: faraday
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0.8'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0.8'
 - !ruby/object:Gem::Dependency
   name: faraday_middleware
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0.9'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0.9'
 - !ruby/object:Gem::Dependency
   name: binding_of_caller
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0.7'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0.7'
 description: |
@@ -124,9 +124,6 @@ extensions:
 - ext/immunio/Rakefile
 extra_rdoc_files: []
 files:
-- LICENSE
-- README.md
-- bin/immunio
 - ext/immunio/Rakefile
 - lib/immunio.rb
 - lib/immunio/agent.rb
@@ -415,11 +412,18 @@ files:
 - lua-hooks/ext/luautf8/README.md
 - lua-hooks/ext/luautf8/lutf8lib.c
 - lua-hooks/ext/luautf8/unidata.h
+- lua-hooks/ext/perf/luacpu.c
+- lua-hooks/ext/perf/lualoadavg.c
+- lua-hooks/ext/perf/luameminfo.c
+- lua-hooks/ext/perf/luaoslib.c
 - lua-hooks/ext/sha1/luasha1.c
 - lua-hooks/ext/sha1/sha1.c
 - lua-hooks/ext/sha2/luasha256.c
 - lua-hooks/ext/sha2/sha256.c
+- README.md
+- LICENSE
 - lua-hooks/lib/boot.lua
+- bin/immunio
 homepage: http://immun.io/
 licenses:
 - Immunio
@@ -431,19 +435,18 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - '>='
     - !ruby/object:Gem::Version
       version: 1.9.3
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5
+rubygems_version: 2.0.14
 signing_key: 
 specification_version: 4
 summary: Immunio Ruby agent
 test_files: []
-has_rdoc: