immunio 0.15.4 → 0.16.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: f7e8d810e6100c0e9264d9c8527a9afd7a8cf024
-  data.tar.gz: e72b700204840a28c6c226b788c8bc2be6c4ce98
+  metadata.gz: 1b4a53aa8b32d4b0cb59aec0c9fefd32897f0694
+  data.tar.gz: b0f537f84a9940cb84301048fdb1479ac2e4c740
 SHA512:
-  metadata.gz: a5d26c3a038a7d761733a78aed1f0930b4aee57c4ea5b2468f0bd1b2d629a474231778c8eeba761f6e4d236d0762d242ac106f059885c8a40095ad4f3edc9cf3
-  data.tar.gz: ae779440e8c573cc90004e8ac39f3d92d2f93f0a7db72e8c751b9c68731e5bf2a736b56f107558ba6f40a3f46e4a380fb30786378b4d3cb1f2de6d39eb32f55d
+  metadata.gz: 8a476c6b0d8b01bc303bc4552556d6cebdc301bf162f0af4157c8682060ee96564f3b0a7c8c86ed645f4eaf206f9a1ecc6f3841e04cb00f81b1242b5ef61ef2c
+  data.tar.gz: 061e35c335afab789ac28c571d3c655a9b9142def0333ebe3b5a81f740af717699f67b907f8d2bd420a738922ed23322b5160e23ced38ec4ca1d7986570ba1bb

data/LICENSE

@@ -144,33 +144,6 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 
-This product includes content covered by the following license:
-Copyright (c) 2012, Daniel Lindsley
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-* Redistributions of source code must retain the above copyright notice, this
-  list of conditions and the following disclaimer.
-* Redistributions in binary form must reproduce the above copyright notice,
-  this list of conditions and the following disclaimer in the documentation
-  and/or other materials provided with the distribution.
-* Neither the name of the base64 nor the names of its contributors may be
-  used to endorse or promote products derived from this software without
-  specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
 This product includes content covered by the following license:
 Copyright (c) 2012 codingow.com
 

data/ext/immunio/Rakefile

@@ -0,0 +1,9 @@
+LIB_DIR = File.expand_path("../../../lib/immunio", __FILE__)
+LUA_HOOKS_DIR = File.expand_path("../../../lua-hooks", __FILE__)
+
+task :default do
+  cd LUA_HOOKS_DIR do
+    sh "make libimmunio.so"
+    cp "libimmunio.so", LIB_DIR
+  end
+end

data/lib/immunio/plugins/active_record.rb

@@ -393,7 +393,7 @@ module Immunio
             "#{ObjectSpace._id2ref(relation_id).name} Class"
           else
             "#{ObjectSpace._id2ref(relation_id).class.name} Instance"
-          end # rubocop:disable Lint/EndAlignment
+          end
           Immunio.logger.warn {"Creating relation data for non-relation: #{name}"}
           Immunio.logger.debug {"Call stack:\n#{caller.join "\n"}"}
         end

data/lib/immunio/plugins/active_record_relation.rb

@@ -144,7 +144,7 @@ module Immunio
             QueryTracker.instance.last_spawned_relation connection
           else
             self
-          end # rubocop:disable Lint/EndAlignment
+          end
 
           # Push the current relation onto the stack of relations for the
           # connection. The top relation on the stack at query execution time is

data/lib/immunio/plugins/environment_reporter.rb

@@ -2,6 +2,7 @@
 #
 # XXX: Completely untested outside of MRI (official Ruby runtime) 1.9.3 and up!
 
+require 'socket'
 module Immunio
   class EnvironmentReporter
     def initialize(app)
@@ -41,6 +42,20 @@ module Immunio
       end
     end
 
+    def ips
+      ips = Socket.ip_address_list.map(&:ip_address)
+      ips.reject { |ip| ['::1', '127.0.0.1'].include?(ip) }
+    end
+
+    def hostname
+      Socket.gethostname rescue SocketError
+    end
+
+    def hostname_ip
+      # SocketError is raised if we can't fetch the hostname with `Socket.gethostname`.
+      Addrinfo.getaddrinfo(hostname, nil).first.ip_address rescue SocketError
+    end
+
     def report
       @reported = true
 
@@ -56,6 +71,11 @@ module Immunio
         platform: {
           description: RUBY_PLATFORM
         },
+        host: {
+          hostname: hostname,
+          hostname_ip: hostname_ip,
+          ips: ips
+        },
         dependencies: {}
       }
 

data/lib/immunio/rufus_lua_ext/ref.rb

@@ -10,10 +10,8 @@ module Rufus::Lua
     alias_method :initialize, :initialize_with_finalizer
 
     def self.finalize(pointer, ref)
-      # Hack to test if the Lua state was closed and de-refed.
-      original_pointer_address = pointer.read_pointer
       proc do
-        Lib.luaL_unref(pointer, LUA_REGISTRYINDEX, ref) if original_pointer_address == pointer.read_pointer
+        Lib.luaL_unref(pointer, LUA_REGISTRYINDEX, ref)
       end
     end
 

data/lib/immunio/version.rb

@@ -1,5 +1,5 @@
 module Immunio
   AGENT_TYPE = "agent-ruby"
-  VERSION = "0.15.4"
+  VERSION = "0.16.0"
   VM_VERSION = "2.2.0"
 end

data/lib/immunio/vm.rb

@@ -1,8 +1,7 @@
 require_relative "errors"
 
 # Use our custom Lua lib.
-ext = RbConfig::CONFIG['DLEXT']
-ENV['LUA_LIB'] = "#{Immunio::DIR}/immunio/lua-hooks.#{ext}"
+ENV['LUA_LIB'] = "#{Immunio::DIR}/immunio/libimmunio.so"
 
 require 'rufus-lua'
 

data/lua-hooks/Makefile

@@ -0,0 +1,97 @@
+CC = gcc
+
+# Source of extensions compiled w/ Lua's source.
+# Only include .c files that can't be directly included in ext/all.c.
+SRC = \
+	ext/all.c \
+	ext/libinjection/libinjection_html5.c \
+	ext/libinjection/libinjection_xss.c \
+	ext/libinjection/libinjection_sqli.c \
+	ext/lpeg/lpcap.c \
+	ext/lpeg/lpcode.c \
+	ext/lpeg/lpprint.c \
+	ext/lpeg/lpvm.c
+
+OBJ = ${SRC:.c=.o}
+
+# Library archive. Used for compiling along agent bindings.
+SO_OUT = libimmunio.so
+
+# CLI for running tests
+CLI = lua
+CLI_SRC = ext/luajit/src/luajit.c ${SRC}
+
+CFLAGS = -DLUA_USE_APICHECK -DLUAJIT -Dlua_assert=assert -O3 -fPIC
+INCS = -Iext -Iext/luajit/src
+LIBS = -lm -ldl
+
+INIT_HOOK = hooks/__init__.lua
+HOOK_SRCS := $(wildcard hooks/*.lua) hooks/__init__.lua
+MIN_SRCS = $(HOOK_SRCS:hooks/%.lua=build/%.lua)
+HOOKS_TARBALL = hooks.tgz
+HOOKS_SRCS_TARBALL = hooks_srcs.tgz
+
+LUAJIT_OBJ = ext/luajit/src/libluajit.a
+LUAJIT_XCFLAGS = -fPIC
+
+ifeq (${shell uname}, Darwin)
+	# Disable the JIT on OS X
+	LUAJIT_XCFLAGS += -DLUAJIT_ENABLE_GC64
+endif
+
+# Build lua, run tests, and create hooks archive
+all: ${CLI} ${INIT_HOOK} ${HOOKS_TARBALL} ${HOOKS_SRCS_TARBALL}
+
+.c.o:
+	${CC} ${CFLAGS} -c ${INCS} -o $@ $<
+
+${SO_OUT}: ${OBJ} ${LUAJIT_OBJ}
+	${CC} -shared ${CFLAGS} ${LIBS} -o $@ -lc $^
+
+${LUAJIT_OBJ}:
+	cd ext/luajit && make XCFLAGS="${LUAJIT_XCFLAGS}"
+
+# Build lua executable for testing and compilation
+# Seperate compilation as we need the LUA_UNSAFE_MODE flag set...
+${CLI}: ${CLI_SRC} ${LUAJIT_OBJ}
+	${CC} ${CFLAGS} -DLUA_UNSAFE_MODE ${INCS} -o $@ $^ ${LIBS}
+
+# Concatenate init hooks into one __init__.lua hook with two newlines in between
+${INIT_HOOK}: hooks/init/*.lua hooks/init/__header__
+	rm -f hooks/__init__.lua
+	cat hooks/init/__header__ >> hooks/__init__.lua
+	for file in hooks/init/*.lua; do cat "$$file" >> hooks/__init__.lua; printf "\n\n" >> hooks/__init__.lua; done
+	echo "return utils" >> hooks/__init__.lua
+
+build/%.lua: hooks/%.lua ${CLI}
+	@mkdir -p build
+	@echo Minifying $<
+	@cd LuaMinify; ../lua CommandLineMinify.lua ../$< ../$@ >/dev/null
+
+# Create tarball of hooks to publish
+${HOOKS_TARBALL}: ${MIN_SRCS}
+	tar -czf $@ -C build .
+
+${HOOKS_SRCS_TARBALL}: ${HOOK_SRCS}
+	tar -czf $@ -C hooks . --exclude="init"
+
+clean:
+	rm -f ${CLI} ${OBJ} ${SO_OUT}
+	cd ext/luajit && make clean
+	rm -f ${INIT_HOOK}
+	rm -f test_failed
+	rm -rf build
+	find . -name \*.o -delete
+
+test: ${CLI} ${INIT_HOOK} lint ${MIN_SRCS}
+	@rm -f test_failed
+	@for file in test/*_test.lua; do printf "\nRunning $$file\n"; TEST_BUILT_HOOKS=1 ./${CLI} $$file || touch test_failed; done
+	@test ! -f test_failed
+
+lint: ${INIT_HOOK}
+	@# Scan all lua files for lines with trailing spaces
+	@# The leading `!` negates the logic, so this target fails if trailing
+	@# spaces are found in any Lua file.
+	@! find . -path ./LuaMinify -prune -o -name "*.lua" -exec grep -E -n "[[:space:]]+$$" {} +
+
+.PHONY: all test clean lint

data/lua-hooks/ext/all.c

@@ -4,75 +4,64 @@
 
 #define luaall_c
 
-#define LUA_USE_POSIX
+#include "lua.h"
+#include "lauxlib.h"
+#include "lualib.h"
 
-#include "lua/lapi.c"
-#include "lua/lcode.c"
-#include "lua/ldebug.c"
-#include "lua/ldo.c"
-#include "lua/ldump.c"
-#include "lua/lfunc.c"
-#include "lua/lgc.c"
-#include "lua/llex.c"
-#include "lua/lmem.c"
-#include "lua/lobject.c"
-#include "lua/lopcodes.c"
-#include "lua/lparser.c"
-#include "lua/lstate.c"
-#include "lua/lstring.c"
-#include "lua/ltable.c"
-#include "lua/ltm.c"
-#include "lua/lundump.c"
-#include "lua/lvm.c"
-#include "lua/lzio.c"
-
-#include "lua/lauxlib.c"
-#include "lua/lbaselib.c"
-#include "lua/ldblib.c"
-#include "lua/liolib.c"
-#include "lua/lmathlib.c"
-#include "lua/loadlib.c"
-#include "lua/loslib.c"
-#include "lua/lstrlib.c"
-#include "lua/ltablib.c"
 
 // Include our custom modules
-#include "bitop/bit.c"
 #include "libinjection/lualib.c"
 #include "luautf8/lutf8lib.c"
 #include "lpeg/lptree.c"
 #include "lua-cmsgpack/lua_cmsgpack.c"
 #include "lua-snapshot/snapshot.c"
 
-// Activate the Lua modules we need and our custom ones.
-static const luaL_Reg lualibs[] = {
-  {"", luaopen_base},
-  {LUA_TABLIBNAME, luaopen_table},
-  {LUA_STRLIBNAME, luaopen_string},
-  {LUA_MATHLIBNAME, luaopen_math},
-
-  // Include unsafe libs in tests
-#if defined(LUA_UNSAFE_MODE)
-  {LUA_IOLIBNAME, luaopen_io},
-  {LUA_OSLIBNAME, luaopen_os},
-#endif
-
+static const luaL_Reg lj_lib_load[] = {
+  // Default Lua modules
+  //
   // SECURITY NOTE:
-  // The following modules are unsafe according to http://lua-users.org/wiki/SandBoxes.
+  // Some of the following modules are unsafe according to http://lua-users.org/wiki/SandBoxes.
   // They are loaded, but never exposed to the sandbox used to run the hook handlers.
   // See lib/boot.lua for more details.
-  {LUA_LOADLIBNAME, luaopen_package},
-  {LUA_DBLIBNAME, luaopen_debug},  
+  { "",               luaopen_base },
+  { LUA_LOADLIBNAME,  luaopen_package },
+  { LUA_TABLIBNAME,   luaopen_table },
+  #if defined(LUA_UNSAFE_MODE)
+    { LUA_IOLIBNAME,    luaopen_io },
+    { LUA_OSLIBNAME,    luaopen_os },
+  #endif
+  { LUA_STRLIBNAME,   luaopen_string },
+  { LUA_MATHLIBNAME,  luaopen_math },
+  { LUA_DBLIBNAME,    luaopen_debug },
+  { LUA_BITLIBNAME,   luaopen_bit },
+  { LUA_JITLIBNAME,   luaopen_jit },
 
   // Our custom modules
   {"libinjection", luaopen_libinjection},
   {"utf8", luaopen_utf8},
-  {"bit", luaopen_bit},
   {"lpeg", luaopen_lpeg},
   {LUACMSGPACK_NAME, luaopen_cmsgpack},
   {"snapshot", luaopen_snapshot},
-  {NULL, NULL}
+
+  { NULL,   NULL }
 };
-// The previous array replaces the one in linit.c.
-// If you update Lua, make sure to comment the lualibs declaration in the following file.
-#include "lua/linit.c"
+
+// In unsafe mode define these as NOPs when we build a .so
+#if !defined(LUA_UNSAFE_MODE)
+LUALIB_API int luaopen_io(lua_State *L) {
+  return 0;
+}
+LUALIB_API int luaopen_os(lua_State *L) {
+  return 0;
+}
+#endif
+
+LUALIB_API void luaL_openlibs(lua_State *L) {
+  const luaL_Reg *lib;
+  for (lib = lj_lib_load; lib->func; lib++) {
+    lua_pushcfunction(L, lib->func);
+    lua_pushstring(L, lib->name);
+    lua_call(L, 1, 0);
+  }
+}
+

data/lua-hooks/ext/libinjection/lualib.c

@@ -1,6 +1,6 @@
 #define LUA_LIB
-#include "lua/lua.h"
-#include "lua/lauxlib.h"
+#include "lua.h"
+#include "lauxlib.h"
 
 #include "libinjection.h"
 #include "libinjection_sqli.h"

data/lua-hooks/ext/lpeg/lpcap.c

@@ -3,8 +3,8 @@
 ** Copyright 2007, Lua.org & PUC-Rio  (see 'lpeg.html' for license)
 */
 
-#include "../lua/lua.h"
-#include "../lua/lauxlib.h"
+#include "lua.h"
+#include "lauxlib.h"
 
 #include "lpcap.h"
 #include "lptypes.h"

data/lua-hooks/ext/lpeg/lpcode.c

@@ -6,8 +6,8 @@
 #include <limits.h>
 
 
-#include "../lua/lua.h"
-#include "../lua/lauxlib.h"
+#include "lua.h"
+#include "lauxlib.h"
 
 #include "lptypes.h"
 #include "lpcode.h"

data/lua-hooks/ext/lpeg/lpcode.h

@@ -5,7 +5,7 @@
 #if !defined(lpcode_h)
 #define lpcode_h
 
-#include "../lua/lua.h"
+#include "lua.h"
 
 #include "lptypes.h"
 #include "lptree.h"

data/lua-hooks/ext/lpeg/lptree.c

@@ -8,8 +8,8 @@
 #include <string.h>
 
 
-#include "../lua/lua.h"
-#include "../lua/lauxlib.h"
+#include "lua.h"
+#include "lauxlib.h"
 
 #include "lptypes.h"
 #include "lpcap.h"

data/lua-hooks/ext/lpeg/lptypes.h

@@ -16,7 +16,7 @@
 #include <assert.h>
 #include <limits.h>
 
-#include "../lua/lua.h"
+#include "lua.h"
 
 
 #define VERSION         "0.12.1"

data/lua-hooks/ext/lpeg/lpvm.c

@@ -7,8 +7,8 @@
 #include <string.h>
 
 
-#include "../lua/lua.h"
-#include "../lua/lauxlib.h"
+#include "lua.h"
+#include "lauxlib.h"
 
 #include "lpcap.h"
 #include "lptypes.h"