sqreen 1.18.5 → 1.19.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 321074d4cc69c79e906d6b4a865e49a36a22f786201a8def57d48d1164716282
-  data.tar.gz: 1edd7b85daa4ef20b624d0ff2ee16178b4cfe14d948c065cceba7374f1ad41d2
+  metadata.gz: 315d183f0c86adad0c106a7f3a9b31ae5049c387233b78e1df3d3ec5e93db21d
+  data.tar.gz: 75b7d65ba2dd9ac049f7a81f6d60c5c96b67d2a7fb453f8e3a181b07035542ab
 SHA512:
-  metadata.gz: '0085800cf5856cdab2003506d1fad265b1bb5744cf80063e4e380af44a5cc4d49a6bca7a2e6199882cea7d296511089ae1c8c2155c4e04840795afb5bbcd6817'
-  data.tar.gz: f1f2dc1680ec65f9cfd8cefde2c47fae7bbf0300f9c2d18811a21b0d1e6ac01abb0679027ce69b5faf322975ab5d17afd92c05a6bc85cf2459fc514f385e0bbc
+  metadata.gz: e2358bca4465a486e04b5454f44a03244e980f1b59e5118bc8aaa6ddb57030cdcf73507949a796cdbbd9d8bc91ca1cf6028e9a12a7a61faceb1250ffca062a73
+  data.tar.gz: d126dbefe095bd988e378dbacdee915e0e0de6c5cce4c0865b988816df20f71b2552b52087779792537071ff7c2757f868899c2aa93671813caf02e7795ed7cc

data/CHANGELOG.md

@@ -1,3 +1,25 @@
+## 1.19.2
+
+* Handle unexpected rule callback return values more gracefully
+* Fix incorrect return value for 404 native callback
+
+## 1.19.1
+
+* Fix LocalJumpError when reaching a Rack app nested in a Rails app
+
+## 1.19.0
+
+* Upgrade WAF features via libsqreen 0.6.1
+* Improve time defensiveness in WAF
+* Improve compatibility with APM agents via a new optional instrumentation engine
+* Fix action reloading not being entirely cleared on reload
+* Improve handling of hash symbol keys in some security rules
+* Fix constant resolution scope on agent boot
+
+## 1.18.6
+
+* Improve default WAF time budget handling logic
+
 ## 1.18.5
 
 * Fix type mismatch in WAF time budget handling

data/lib/sqreen/actions.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/actions/actions_index.rb

@@ -0,0 +1,16 @@
+# typed: true
+module Sqreen
+  module Actions
+    # documents the operations an actions index should implement
+    class ActionsIndex
+      # all actions matching, possibly already expired
+      def actions_matching(_key)
+        raise 'implement in subclasses'
+      end
+
+      def index(_params, _action)
+        raise 'implement in subclasses'
+      end
+    end
+  end
+end

data/lib/sqreen/actions/base.rb

@@ -1,8 +1,11 @@
+# typed: false
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 # TODO: remove class vars
 
+require 'sqreen/sdk'
 require 'sqreen/exception'
 
 module Sqreen
@@ -75,16 +78,7 @@ module Sqreen
           subclasses.keys
         end
 
-        # all actions matching, possibly already expired
-        def actions_matching(_key)
-          raise 'implement in singletons of subclasses'
-        end
-
-        def index(_params, _action)
-          raise 'implement in singletons of subclasses'
-        end
-
-        def clear
+        def new_index
           raise 'implement in singletons of subclasses'
         end
 

data/lib/sqreen/actions/block_ip.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/actions/block_user.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/actions/ip_range_indexed_action_class.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
@@ -6,30 +8,8 @@ require 'sqreen/actions/ip_ranges_index'
 module Sqreen
   module Actions
     module IpRangeIndexedActionClass
-      include IpRangesIndex
-
-      def actions_matching(client_ip)
-        matching_actions client_ip
-      end
-
-      def index(params, action)
-        ranges = parse_ip_ranges params
-
-        ranges.each do |r|
-          add_prefix r, action
-        end
-      end
-
-      private
-
-      # returns array of prefixes in string form
-      def parse_ip_ranges(params)
-        ranges = params['ip_cidr']
-        unless ranges && ranges.is_a?(Array) && !ranges.empty?
-          raise 'no non-empty ip_cidr array present'
-        end
-
-        ranges
+      def new_index
+        IpRangesIndex.new
       end
     end
   end

data/lib/sqreen/actions/ip_ranges_index.rb

@@ -1,22 +1,30 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 require 'ipaddr'
+require 'sqreen/actions/actions_index'
 require 'sqreen/trie'
 require 'sqreen/prefix'
 
 module Sqreen
   module Actions
-    module IpRangesIndex
-      def add_prefix(prefix_str, data)
-        @trie_v4 ||= Sqreen::Trie.new
-        @trie_v6 ||= Sqreen::Trie.new(nil, nil, Socket::AF_INET6)
-        prefix = Sqreen::Prefix.from_str(prefix_str, data)
-        trie = prefix.family == Socket::AF_INET6 ? @trie_v6 : @trie_v4
-        trie.insert prefix
+    class IpRangesIndex < ActionsIndex
+      def initialize
+        @trie_v4 = Sqreen::Trie.new
+        @trie_v6 = Sqreen::Trie.new(nil, nil, Socket::AF_INET6)
+      end
+
+      def index(params, action)
+        ranges = parse_ip_ranges params
+
+        ranges.each do |r|
+          add_prefix r, action
+        end
       end
 
-      def matching_actions(client_ip)
+      def actions_matching(client_ip)
         parsed_ip = IPAddr.new(client_ip.gsub(/%[^%\/]+/, ''))
         trie = parsed_ip.family == Socket::AF_INET6 ? @trie_v6 : @trie_v4
         return [] unless trie
@@ -27,9 +35,22 @@ module Sqreen
         found.map(&:data)
       end
 
-      def clear
-        @trie_v4 = Sqreen::Trie.new
-        @trie_v6 = Sqreen::Trie.new(nil, nil, Socket::AF_INET6)
+      private
+
+      # returns array of prefixes in string form
+      def parse_ip_ranges(params)
+        ranges = params['ip_cidr']
+        unless ranges && ranges.is_a?(Array) && !ranges.empty?
+          raise 'no non-empty ip_cidr array present'
+        end
+
+        ranges
+      end
+
+      def add_prefix(prefix_str, data)
+        prefix = Sqreen::Prefix.from_str(prefix_str, data)
+        trie = prefix.family == Socket::AF_INET6 ? @trie_v6 : @trie_v4
+        trie.insert prefix
       end
     end
   end

data/lib/sqreen/actions/redirect_ip.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/actions/redirect_user.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/actions/repository.rb

@@ -1,24 +1,43 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 module Sqreen
   module Actions
-    # Where the currently loaded actions are stored. Singleton
+    # Where the actions are stored
+    # The current ones are stored in Repository.current
     class Repository
-      include Singleton
+      def initialize
+        @indexes = Hash[Base.known_subclasses.map do |clazz|
+          [clazz.type_name, clazz.new_index]
+        end]
+      end
 
       def add(params, action)
-        action.class.index(params || {}, action)
+        @indexes[action.class.type_name].index(params || {}, action)
       end
 
-      def get(action_class, key)
-        action_class = Base.get_type_class(action_class) unless action_class.class == Class
-        action_class.actions_matching key
+      # type is either a class or a type name
+      def get(type, key)
+        type = type.type_name if type.class == Class
+        @indexes[type].actions_matching key
       end
 
-      def clear
-        Base.known_subclasses.each(&:clear)
+      singleton_class.class_eval do
+        attr_reader :current
+        def current=(new_inst)
+          raise 'nil is unacceptable' if new_inst.nil?
+          @current = new_inst
+        end
+
+        def clear
+          self.current = Repository.new
+        end
       end
+
+      # initialize current to empty repository
+      clear
     end
   end
 end

data/lib/sqreen/actions/unknown_action_type.rb

@@ -1,6 +1,10 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
+require 'sqreen/exception'
+
 module Sqreen
   # Implements actions (behavior taken in response to agent signals)
   module Actions

data/lib/sqreen/actions/user_action_class.rb

@@ -1,40 +1,15 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/exception'
+require 'sqreen/actions/users_index'
 
 module Sqreen
   module Actions
     module UserActionClass
-      def actions_matching(identity_params)
-        return [] unless @idx
-        key = stringify_keys(identity_params)
-        actions = @idx[key]
-        actions || []
-      end
-
-      def index(params, action)
-        @idx ||= {}
-        users = params['users']
-        raise ::Sqreen::Exception, 'nil "users" param for block_user action' if users.nil?
-        raise ::Sqreen::Exception, '"users" param must be an array' unless users.is_a? Array
-
-        users.each do |u|
-          @idx[u] ||= []
-          @idx[u] << action
-        end
-      end
-
-      def clear
-        @idx = {}
-      end
-
-      private
-
-      def stringify_keys(hash)
-        Hash[
-          hash.map { |k, v| [k.to_s, v] }
-        ]
+      def new_index
+        UsersIndex.new
       end
     end
   end

data/lib/sqreen/actions/users_index.rb

@@ -0,0 +1,35 @@
+# typed: true
+require 'sqreen/actions/actions_index'
+
+module Sqreen
+  module Actions
+    class UsersIndex < ActionsIndex
+      def actions_matching(identity_params)
+        return [] unless @idx
+        key = stringify_keys(identity_params)
+        actions = @idx[key]
+        actions || []
+      end
+
+      def index(params, action)
+        @idx ||= {}
+        users = params['users']
+        raise ::Sqreen::Exception, 'nil "users" param for block_user action' if users.nil?
+        raise ::Sqreen::Exception, '"users" param must be an array' unless users.is_a? Array
+
+        users.each do |u|
+          @idx[u] ||= []
+          @idx[u] << action
+        end
+      end
+
+      private
+
+      def stringify_keys(hash)
+        Hash[
+          hash.map { |k, v| [k.to_s, v] }
+        ]
+      end
+    end
+  end
+end

data/lib/sqreen/agent.rb

@@ -1,8 +1,9 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 require 'sqreen/version'
-require 'sqreen/instrumentation'
 require 'sqreen/session'
 require 'sqreen/runner'
 require 'sqreen/log'

data/lib/sqreen/attack_blocked.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/backport.rb

@@ -1,3 +1,5 @@
+# typed: strong
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/backport/clock_gettime.rb

@@ -0,0 +1,74 @@
+# typed: ignore
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
+require 'sqreen/backport'
+
+module Sqreen
+  module Backport
+    module ClockGettime
+      class << self
+        def supported?
+          Process.respond_to?(:clock_gettime)
+        end
+      end
+
+      unless supported?
+        require 'ffi'
+
+        class Timespec < FFI::Struct
+          layout :tv_sec => :time_t, :tv_nsec => :long
+        end
+
+        module LibC
+          extend FFI::Library
+          ffi_lib FFI::Library::LIBC
+
+          # TODO: FFI::NotFoundError
+
+          if RUBY_PLATFORM =~ /darwin/
+            attach_function :mach_absolute_time, [], :uint64
+          end
+
+          attach_function :clock_gettime, [:int, :pointer], :int
+        end
+
+        module Constants
+          case RUBY_PLATFORM
+          when /darwin/
+            CLOCK_REALTIME = 0
+            CLOCK_MONOTONIC = 6
+            CLOCK_PROCESS_CPUTIME_ID = 12
+            CLOCK_THERAD_CPUTIME_ID = 16
+          when /linux/
+            CLOCK_REALTIME = 0
+            CLOCK_MONOTONIC = 1
+            CLOCK_PROCESS_CPUTIME_ID = 2
+            CLOCK_THREAD_CPUTIME_ID = 3
+          end
+        end
+
+        def clock_gettime(clock_id, unit = :float_second)
+          unless unit == :float_second
+            raise "Process.clock_gettime: unsupported unit #{unit.inspect}"
+          end
+
+          t = Timespec.new
+          ret = LibC.clock_gettime(clock_id, t.pointer)
+
+          raise SystemCallError, "Errno #{FFI.errno}" if ret == -1
+
+          t[:tv_sec].to_f + t[:tv_nsec].to_f / 1_000_000_000
+        end
+      end
+    end
+  end
+end
+
+unless Sqreen::Backport::ClockGettime.supported?
+  Process.instance_eval do
+    extend Sqreen::Backport::ClockGettime
+    include Sqreen::Backport::ClockGettime::Constants
+  end
+end