sqreen 1.19.1 → 1.20.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +22 -0
- data/lib/sqreen/agent_message.rb +20 -0
- data/lib/sqreen/aggregated_metric.rb +25 -0
- data/lib/sqreen/attack_detected.html +1 -2
- data/lib/sqreen/ca.crt +24 -0
- data/lib/sqreen/configuration.rb +10 -4
- data/lib/sqreen/deferred_logger.rb +4 -0
- data/lib/sqreen/deliveries/batch.rb +4 -1
- data/lib/sqreen/deliveries/simple.rb +4 -0
- data/lib/sqreen/endpoint_testing.rb +184 -0
- data/lib/sqreen/event.rb +7 -5
- data/lib/sqreen/events/attack.rb +23 -18
- data/lib/sqreen/events/remote_exception.rb +0 -22
- data/lib/sqreen/events/request_record.rb +15 -70
- data/lib/sqreen/frameworks/request_recorder.rb +13 -2
- data/lib/sqreen/graft/call.rb +32 -19
- data/lib/sqreen/graft/callback.rb +1 -1
- data/lib/sqreen/graft/hook.rb +97 -116
- data/lib/sqreen/graft/hook_point.rb +1 -1
- data/lib/sqreen/kit/signals/specialized/aggregated_metric.rb +72 -0
- data/lib/sqreen/kit/signals/specialized/attack.rb +57 -0
- data/lib/sqreen/kit/signals/specialized/binning_metric.rb +76 -0
- data/lib/sqreen/kit/signals/specialized/http_trace.rb +26 -0
- data/lib/sqreen/kit/signals/specialized/sdk_track_call.rb +50 -0
- data/lib/sqreen/kit/signals/specialized/sqreen_exception.rb +57 -0
- data/lib/sqreen/legacy/instrumentation.rb +10 -10
- data/lib/sqreen/legacy/old_event_submission_strategy.rb +221 -0
- data/lib/sqreen/legacy/waf_redactions.rb +49 -0
- data/lib/sqreen/log/loggable.rb +2 -1
- data/lib/sqreen/logger.rb +4 -0
- data/lib/sqreen/metrics/base.rb +3 -0
- data/lib/sqreen/metrics_store.rb +22 -12
- data/lib/sqreen/performance_notifications/binned_metrics.rb +8 -2
- data/lib/sqreen/rules.rb +4 -2
- data/lib/sqreen/rules/not_found_cb.rb +2 -0
- data/lib/sqreen/rules/rule_cb.rb +2 -0
- data/lib/sqreen/rules/waf_cb.rb +13 -10
- data/lib/sqreen/runner.rb +75 -8
- data/lib/sqreen/sensitive_data_redactor.rb +19 -31
- data/lib/sqreen/session.rb +51 -43
- data/lib/sqreen/signals/conversions.rb +283 -0
- data/lib/sqreen/signals/http_trace_redaction.rb +111 -0
- data/lib/sqreen/signals/signals_submission_strategy.rb +78 -0
- data/lib/sqreen/version.rb +1 -1
- data/lib/sqreen/weave/legacy/instrumentation.rb +56 -53
- metadata +45 -7
- data/lib/sqreen/backport.rb +0 -9
- data/lib/sqreen/backport/clock_gettime.rb +0 -74
- data/lib/sqreen/backport/original_name.rb +0 -88
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 20f83c83a19022c3bfba53af705716e2d4b4d791912bf32c6e7e2853496a4b05
|
|
4
|
+
data.tar.gz: 6592f5a6c88895016924c4a342d6c1f48f885527c18fc0b182495d2905cef926
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 349fecb7524cb1740965162e596708fede99c5ab12bd5ed0a009c324e360585a15f2237c78614b666e77d5bbbf5b044a9a1ee7be8d3ce791b377cbc1ecbe15aa
|
|
7
|
+
data.tar.gz: ad4b8725a6531e80a4e47aac8c820f88284391a8f674ae59e8908846714c8b1c76be7fd95034cdf4885588f39e413308f39cc5688f6ed207558b48d0b14def5f
|
data/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,25 @@
|
|
|
1
|
+
## 1.20.2
|
|
2
|
+
|
|
3
|
+
* Fix performance regression in instrumentation engine
|
|
4
|
+
|
|
5
|
+
## 1.20.1
|
|
6
|
+
|
|
7
|
+
* Add fallback mechanisms when connecting to new Sqreen backend API domains
|
|
8
|
+
|
|
9
|
+
## 1.20.0
|
|
10
|
+
|
|
11
|
+
* Enable new instrumentation engine by default
|
|
12
|
+
* Add signal-based backend communication
|
|
13
|
+
|
|
14
|
+
## 1.19.3
|
|
15
|
+
|
|
16
|
+
* Improve WAF PII protection
|
|
17
|
+
|
|
18
|
+
## 1.19.2
|
|
19
|
+
|
|
20
|
+
* Handle unexpected rule callback return values more gracefully
|
|
21
|
+
* Fix incorrect return value for 404 native callback
|
|
22
|
+
|
|
1
23
|
## 1.19.1
|
|
2
24
|
|
|
3
25
|
* Fix LocalJumpError when reaching a Rack app nested in a Rails app
|
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
require 'digest'
|
|
2
|
+
|
|
3
|
+
module Sqreen
|
|
4
|
+
class AgentMessage
|
|
5
|
+
def initialize(kind, message, id = nil)
|
|
6
|
+
id ||= message + "\x00" + kind
|
|
7
|
+
@hash_hex = Digest::SHA1.hexdigest(id)
|
|
8
|
+
@kind = kind
|
|
9
|
+
@message = message
|
|
10
|
+
end
|
|
11
|
+
|
|
12
|
+
def to_h
|
|
13
|
+
{
|
|
14
|
+
id: @hash_hex,
|
|
15
|
+
kind: @kind,
|
|
16
|
+
message: @message,
|
|
17
|
+
}
|
|
18
|
+
end
|
|
19
|
+
end
|
|
20
|
+
end
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
require 'sqreen/rules/rule_cb'
|
|
2
|
+
require 'sqreen/metrics/base'
|
|
3
|
+
|
|
4
|
+
module Sqreen
|
|
5
|
+
class AggregatedMetric
|
|
6
|
+
def initialize(values = {})
|
|
7
|
+
values.each do |k, v|
|
|
8
|
+
public_send "#{k}=", v
|
|
9
|
+
end
|
|
10
|
+
end
|
|
11
|
+
|
|
12
|
+
# @return [Sqreen::Rules::RuleCB]
|
|
13
|
+
attr_accessor :rule # optional
|
|
14
|
+
|
|
15
|
+
# @return [Sqreen::Metric::Base]
|
|
16
|
+
attr_accessor :metric
|
|
17
|
+
|
|
18
|
+
attr_accessor :start, :finish
|
|
19
|
+
attr_accessor :data
|
|
20
|
+
|
|
21
|
+
def name
|
|
22
|
+
metric.name
|
|
23
|
+
end
|
|
24
|
+
end
|
|
25
|
+
end
|
|
@@ -1,2 +1 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
1
|
+
<!-- Sorry, you’ve been blocked --><!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>You've been blocked</title><style>a,body,div,h1,html,span{margin:0;padding:0;border:0;font-size:100%;font:inherit;vertical-align:baseline}body{background:-webkit-radial-gradient(26% 19%,circle,#fff,#f4f7f9);background:radial-gradient(circle at 26% 19%,#fff,#f4f7f9);display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-ms-flex-line-pack:center;align-content:center;width:100%;min-height:100vh;line-height:1;flex-direction:column}h1,p,svg{display:block}svg{margin:0 auto 4vh}main{text-align:center;flex:1;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-ms-flex-line-pack:center;align-content:center;flex-direction:column}h1{font-family:sans-serif;font-weight:600;font-size:34px;color:#1e0936;line-height:1.2}p{font-size:18px;line-height:normal;color:#646464;font-family:sans-serif;font-weight:400}a{color:#4842b7}footer{width:100%;text-align:center}footer p{font-size:16px}</style></head><body><main><svg width="170px" height="193px" viewBox="0 0 170 193" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true"><g id="exports" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"><g id="Artboard" transform="translate(-186.000000, -189.000000)"><g id="logo-cmyk-indigo" transform="translate(186.000000, 189.000000)"><g id="nest-cmyk-indigo"><ellipse id="sqreen" fill="#B0ACFF" cx="85" cy="96.5" rx="45.7692308" ry="45.7966102"></ellipse><path d="M78.4615385,175.749389 L78.4615385,102.2092 L13.1398162,64.4731256 L13.1398162,129.181112 L36.352167,115.771438 C37.9764468,119.873152 40.1038639,123.720553 42.6582364,127.237412 L18.5723996,141.151695 L78.4615385,175.749389 Z M91.5384615,175.749389 L151.4276,141.151695 L127.341764,127.237412 C129.896136,123.720553 132.023553,119.873152 133.647833,115.771438 L156.860184,129.181112 L156.860184,64.4731256 L91.5384615,102.2092 L91.5384615,175.749389 Z M18.0061522,52.1754237 L85,90.8774777 L151.993848,52.1754237 L91.5384615,17.2506105 L91.5384615,44.565949 C89.3964992,44.2986903 87.2143177,44.1610169 85,44.1610169 C82.7856823,44.1610169 80.6035008,44.2986903 78.4615385,44.565949 L78.4615385,17.2506105 L18.0061522,52.1754237 Z M90.8846156,1.76392358 L164.052491,44.0326866 C167.693904,46.1363149 169.937107,50.0239804 169.937107,54.231237 L169.937107,138.768763 C169.937107,142.97602 167.693904,146.863685 164.052491,148.967313 L90.8846156,191.236076 C87.2432028,193.339705 82.7567972,193.339705 79.1153844,191.236076 L5.94750871,148.967313 C2.30609589,146.863685 0.0628930904,142.97602 0.0628930904,138.768763 L0.0628930904,54.231237 C0.0628930904,50.0239804 2.30609589,46.1363149 5.94750871,44.0326866 L79.1153844,1.76392358 C82.7567972,-0.339704735 87.2432028,-0.339704735 90.8846156,1.76392358 Z" id="app" fill="#4842B7"></path></g></g></g></g></svg><h1>Sorry, you've been blocked</h1><p>Contact the website owner</p></main><footer><p>Security provided by <a href="https://www.sqreen.com/?utm_medium=block_page" target="_blank">Sqreen</a></p></footer></body></html>
|
data/lib/sqreen/ca.crt
CHANGED
|
@@ -70,3 +70,27 @@ WE9gyn6CagsCqiUXObXbf+eEZSqVir2G3l6BFoMtEMze/aiCKm0oHw0LxOXnGiYZ
|
|
|
70
70
|
4fQRbxC1lfznQgUy286dUV4otp6F01vvpX1FQHKOtw5rDgb7MzVIcbidJ4vEZV8N
|
|
71
71
|
hnacRHr2lVz2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq
|
|
72
72
|
-----END CERTIFICATE-----
|
|
73
|
+
-----BEGIN CERTIFICATE-----
|
|
74
|
+
MIID7zCCAtegAwIBAgIBADANBgkqhkiG9w0BAQsFADCBmDELMAkGA1UEBhMCVVMx
|
|
75
|
+
EDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBgNVBAoT
|
|
76
|
+
HFN0YXJmaWVsZCBUZWNobm9sb2dpZXMsIEluYy4xOzA5BgNVBAMTMlN0YXJmaWVs
|
|
77
|
+
ZCBTZXJ2aWNlcyBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAtIEcyMB4XDTA5
|
|
78
|
+
MDkwMTAwMDAwMFoXDTM3MTIzMTIzNTk1OVowgZgxCzAJBgNVBAYTAlVTMRAwDgYD
|
|
79
|
+
VQQIEwdBcml6b25hMRMwEQYDVQQHEwpTY290dHNkYWxlMSUwIwYDVQQKExxTdGFy
|
|
80
|
+
ZmllbGQgVGVjaG5vbG9naWVzLCBJbmMuMTswOQYDVQQDEzJTdGFyZmllbGQgU2Vy
|
|
81
|
+
dmljZXMgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgLSBHMjCCASIwDQYJKoZI
|
|
82
|
+
hvcNAQEBBQADggEPADCCAQoCggEBANUMOsQq+U7i9b4Zl1+OiFOxHz/Lz58gE20p
|
|
83
|
+
OsgPfTz3a3Y4Y9k2YKibXlwAgLIvWX/2h/klQ4bnaRtSmpDhcePYLQ1Ob/bISdm2
|
|
84
|
+
8xpWriu2dBTrz/sm4xq6HZYuajtYlIlHVv8loJNwU4PahHQUw2eeBGg6345AWh1K
|
|
85
|
+
Ts9DkTvnVtYAcMtS7nt9rjrnvDH5RfbCYM8TWQIrgMw0R9+53pBlbQLPLJGmpufe
|
|
86
|
+
hRhJfGZOozptqbXuNC66DQO4M99H67FrjSXZm86B0UVGMpZwh94CDklDhbZsc7tk
|
|
87
|
+
6mFBrMnUVN+HL8cisibMn1lUaJ/8viovxFUcdUBgF4UCVTmLfwUCAwEAAaNCMEAw
|
|
88
|
+
DwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFJxfAN+q
|
|
89
|
+
AdcwKziIorhtSpzyEZGDMA0GCSqGSIb3DQEBCwUAA4IBAQBLNqaEd2ndOxmfZyMI
|
|
90
|
+
bw5hyf2E3F/YNoHN2BtBLZ9g3ccaaNnRbobhiCPPE95Dz+I0swSdHynVv/heyNXB
|
|
91
|
+
ve6SbzJ08pGCL72CQnqtKrcgfU28elUSwhXqvfdqlS5sdJ/PHLTyxQGjhdByPq1z
|
|
92
|
+
qwubdQxtRbeOlKyWN7Wg0I8VRw7j6IPdj/3vQQF3zCepYoUz8jcI73HPdwbeyBkd
|
|
93
|
+
iEDPfUYd/x7H4c7/I9vG+o1VTqkC50cRRj70/b17KSa7qWFiNyi2LSr2EIZkyXCn
|
|
94
|
+
0q23KXB56jzaYyWf/Wi3MOxw+3WKt21gZ7IeyLnp2KhvAotnDU0mV3HaIPzBSlCN
|
|
95
|
+
sSi6
|
|
96
|
+
-----END CERTIFICATE-----
|
data/lib/sqreen/configuration.rb
CHANGED
|
@@ -39,11 +39,15 @@ module Sqreen
|
|
|
39
39
|
{ :env => :SQREEN_LIBSQREEN, :name => :libsqreen,
|
|
40
40
|
:default => true, :convert => :to_bool },
|
|
41
41
|
{ :env => :SQREEN_WEAVE, :name => :weave,
|
|
42
|
-
:default =>
|
|
42
|
+
:default => true, :convert => :to_bool },
|
|
43
43
|
{ :env => :SQREEN_WEAVE_STRATEGY, :name => :weave_strategy,
|
|
44
|
-
:default => :
|
|
45
|
-
{ :env => :SQREEN_URL,
|
|
46
|
-
:default =>
|
|
44
|
+
:default => :prepend, :convert => :to_sym },
|
|
45
|
+
{ :env => :SQREEN_URL, :name => :url,
|
|
46
|
+
:default => nil },
|
|
47
|
+
{ :env => :SQREEN_INGESTION_URL, :name => :ingestion_url,
|
|
48
|
+
:default => nil },
|
|
49
|
+
{ :env => :SQREEN_PROXY_URL, :name => :proxy_url,
|
|
50
|
+
:default => nil },
|
|
47
51
|
{ :env => :SQREEN_TOKEN, :name => :token,
|
|
48
52
|
:default => nil },
|
|
49
53
|
{ :env => :SQREEN_APP_NAME, :name => :app_name,
|
|
@@ -74,6 +78,8 @@ module Sqreen
|
|
|
74
78
|
:default => nil },
|
|
75
79
|
{ :env => :SQREEN_STRIP_SENSITIVE_REGEX, :name => :strip_sensitive_regex,
|
|
76
80
|
:default => nil },
|
|
81
|
+
{ :env => :SQREEN_NO_SNIFF_DOMAINS, :name => :no_sniff_domains,
|
|
82
|
+
:default => false },
|
|
77
83
|
|
|
78
84
|
].freeze
|
|
79
85
|
|
|
@@ -8,6 +8,7 @@
|
|
|
8
8
|
# TODO: Sqreen::RequestRecord => sqreen/events
|
|
9
9
|
# TODO: Sqreen.time
|
|
10
10
|
|
|
11
|
+
require 'sqreen/aggregated_metric'
|
|
11
12
|
require 'sqreen/events/attack'
|
|
12
13
|
require 'sqreen/events/remote_exception'
|
|
13
14
|
require 'sqreen/mono_time'
|
|
@@ -91,9 +92,11 @@ module Sqreen
|
|
|
91
92
|
def event_key(event)
|
|
92
93
|
case event
|
|
93
94
|
when Sqreen::Attack
|
|
94
|
-
"att-#{event.
|
|
95
|
+
"att-#{event.rule_name}"
|
|
95
96
|
when Sqreen::RemoteException
|
|
96
97
|
"rex-#{event.klass}"
|
|
98
|
+
when Sqreen::AggregatedMetric
|
|
99
|
+
"agg-metric"
|
|
97
100
|
end
|
|
98
101
|
end
|
|
99
102
|
end
|
|
@@ -7,6 +7,7 @@
|
|
|
7
7
|
# TODO: Sqreen::RemoteException => sqreen/events
|
|
8
8
|
# TODO: Sqreen::RequestRecord => sqreen/events
|
|
9
9
|
|
|
10
|
+
require 'sqreen/log/loggable'
|
|
10
11
|
require 'sqreen/events/attack'
|
|
11
12
|
require 'sqreen/events/remote_exception'
|
|
12
13
|
require 'sqreen/events/request_record'
|
|
@@ -15,6 +16,7 @@ module Sqreen
|
|
|
15
16
|
module Deliveries
|
|
16
17
|
# Simple delivery method that directly call session on event
|
|
17
18
|
class Simple
|
|
19
|
+
include Log::Loggable
|
|
18
20
|
attr_accessor :session
|
|
19
21
|
|
|
20
22
|
def initialize(session)
|
|
@@ -29,6 +31,8 @@ module Sqreen
|
|
|
29
31
|
session.post_sqreen_exception(event)
|
|
30
32
|
when Sqreen::RequestRecord
|
|
31
33
|
session.post_request_record(event)
|
|
34
|
+
when Sqreen::AggregatedMetric
|
|
35
|
+
logger.warn 'Delivery of metrics using signals is not supported with simple delivery'
|
|
32
36
|
else
|
|
33
37
|
session.post_event(event)
|
|
34
38
|
end
|
|
@@ -0,0 +1,184 @@
|
|
|
1
|
+
require 'net/https'
|
|
2
|
+
require 'sqreen/agent_message'
|
|
3
|
+
require 'sqreen/log/loggable'
|
|
4
|
+
|
|
5
|
+
module Sqreen
|
|
6
|
+
class EndpointTesting
|
|
7
|
+
Endpoint = Struct.new(:url, :ca_store)
|
|
8
|
+
class ChosenEndpoints
|
|
9
|
+
def initialize
|
|
10
|
+
@messages = []
|
|
11
|
+
end
|
|
12
|
+
|
|
13
|
+
# @return [Sqreen::EndpointTesting::Endpoint]
|
|
14
|
+
attr_accessor :control
|
|
15
|
+
|
|
16
|
+
# @return [Sqreen::EndpointTesting::Endpoint]
|
|
17
|
+
attr_accessor :ingestion
|
|
18
|
+
|
|
19
|
+
# @return [Array<Sqreen::AgentMessage>]
|
|
20
|
+
attr_reader :messages
|
|
21
|
+
|
|
22
|
+
# @param [Sqreen::AgentMessage] message
|
|
23
|
+
def add_message(message)
|
|
24
|
+
@messages << message
|
|
25
|
+
end
|
|
26
|
+
end
|
|
27
|
+
|
|
28
|
+
MAIN_CONTROL_HOST = 'back.sqreen.com'.freeze
|
|
29
|
+
MAIN_INJECTION_HOST = 'ingestion.sqreen.com'.freeze
|
|
30
|
+
FALLBACK_ENDPOINT_URL = 'https://back.sqreen.io/'.freeze
|
|
31
|
+
GLOBAL_TIMEOUT = 30
|
|
32
|
+
|
|
33
|
+
CONTROL_ERROR_KIND = 'back_sqreen_com_unavailable'.freeze
|
|
34
|
+
INGESTION_ERROR_KIND = 'ingestion_sqreen_com_unavailable'.freeze
|
|
35
|
+
|
|
36
|
+
class << self
|
|
37
|
+
include Log::Loggable
|
|
38
|
+
|
|
39
|
+
# reproduces behaviour before endpoint testing was introduced
|
|
40
|
+
def no_test_endpoints(config_url, config_ingestion_url)
|
|
41
|
+
endpoints = ChosenEndpoints.new
|
|
42
|
+
|
|
43
|
+
endpoints.control = Endpoint.new(
|
|
44
|
+
config_url || "https://#{MAIN_CONTROL_HOST}/", cert_store
|
|
45
|
+
)
|
|
46
|
+
endpoints.ingestion = Endpoint.new(
|
|
47
|
+
config_ingestion_url || "https://#{MAIN_INJECTION_HOST}/", nil
|
|
48
|
+
)
|
|
49
|
+
|
|
50
|
+
endpoints
|
|
51
|
+
end
|
|
52
|
+
|
|
53
|
+
def test_endpoints(proxy_url, config_url, config_ingestion_url)
|
|
54
|
+
proxy_params = create_proxy_params(proxy_url)
|
|
55
|
+
|
|
56
|
+
# execute the tests in separate threads and wait for them
|
|
57
|
+
thread_control = Thread.new do
|
|
58
|
+
thread_main(config_url, proxy_params, MAIN_CONTROL_HOST)
|
|
59
|
+
end
|
|
60
|
+
thread_injection = Thread.new do
|
|
61
|
+
thread_main(config_ingestion_url, proxy_params, MAIN_INJECTION_HOST)
|
|
62
|
+
end
|
|
63
|
+
|
|
64
|
+
wait_for_threads(thread_control, thread_injection)
|
|
65
|
+
|
|
66
|
+
# build and return result
|
|
67
|
+
fallback = Endpoint.new(FALLBACK_ENDPOINT_URL, cert_store)
|
|
68
|
+
endpoints = ChosenEndpoints.new
|
|
69
|
+
endpoints.control = thread_control[:endpoint] || fallback
|
|
70
|
+
endpoints.ingestion = thread_injection[:endpoint] || fallback
|
|
71
|
+
|
|
72
|
+
if thread_control[:endpoint_error]
|
|
73
|
+
msg = AgentMessage.new(CONTROL_ERROR_KIND, thread_control[:endpoint_error])
|
|
74
|
+
endpoints.add_message msg
|
|
75
|
+
end
|
|
76
|
+
if thread_injection[:endpoint_error]
|
|
77
|
+
msg = AgentMessage.new(INGESTION_ERROR_KIND, thread_injection[:endpoint_error])
|
|
78
|
+
endpoints.add_message msg
|
|
79
|
+
end
|
|
80
|
+
|
|
81
|
+
endpoints
|
|
82
|
+
end
|
|
83
|
+
|
|
84
|
+
private
|
|
85
|
+
|
|
86
|
+
def thread_main(configured_url, proxy_params, host)
|
|
87
|
+
res = if configured_url
|
|
88
|
+
Endpoint.new(configured_url, nil)
|
|
89
|
+
else
|
|
90
|
+
EndpointTesting.send(:test_with_store_variants, proxy_params, host)
|
|
91
|
+
end
|
|
92
|
+
|
|
93
|
+
Thread.current[:endpoint] = res
|
|
94
|
+
rescue StandardError => e
|
|
95
|
+
Thread.current[:endpoint_error] = e.message
|
|
96
|
+
end
|
|
97
|
+
|
|
98
|
+
def create_proxy_params(proxy_url)
|
|
99
|
+
return [] unless proxy_url
|
|
100
|
+
|
|
101
|
+
proxy = URI.parse(proxy_url)
|
|
102
|
+
|
|
103
|
+
return [] unless proxy.scheme == 'http'
|
|
104
|
+
|
|
105
|
+
[proxy.host, proxy.port, proxy.user, proxy.password]
|
|
106
|
+
end
|
|
107
|
+
|
|
108
|
+
def test_with_store_variants(proxy_params, server_name)
|
|
109
|
+
# first without custom store
|
|
110
|
+
do_test(proxy_params, server_name, false)
|
|
111
|
+
rescue StandardError => _e
|
|
112
|
+
do_test(proxy_params, server_name, true)
|
|
113
|
+
end
|
|
114
|
+
|
|
115
|
+
# @param [Array] proxy_params
|
|
116
|
+
# @param [String] server_name
|
|
117
|
+
# @param [Boolean] custom_store
|
|
118
|
+
def do_test(proxy_params, server_name, custom_store)
|
|
119
|
+
http = Net::HTTP.new(server_name, 443, *proxy_params)
|
|
120
|
+
http.use_ssl = true
|
|
121
|
+
http.verify_mode = OpenSSL::SSL::VERIFY_NONE if ENV['SQREEN_SSL_NO_VERIFY']
|
|
122
|
+
http.verify_callback = lambda do |preverify_ok, ctx|
|
|
123
|
+
unless preverify_ok
|
|
124
|
+
logger.warn do
|
|
125
|
+
"Certificate validation failure for certificate issued to " \
|
|
126
|
+
"#{ctx.chain[0].subject}: #{ctx.error_string}"
|
|
127
|
+
end
|
|
128
|
+
end
|
|
129
|
+
|
|
130
|
+
preverify_ok
|
|
131
|
+
end
|
|
132
|
+
|
|
133
|
+
http.open_timeout = 13
|
|
134
|
+
http.ssl_timeout = 7
|
|
135
|
+
http.read_timeout = 7
|
|
136
|
+
http.close_on_empty_response = true
|
|
137
|
+
|
|
138
|
+
http.cert_store = cert_store if custom_store
|
|
139
|
+
|
|
140
|
+
resp = http.get('/ping')
|
|
141
|
+
|
|
142
|
+
logger.info do
|
|
143
|
+
"Got response from #{server_name}'s ping endpoint. " \
|
|
144
|
+
"Status code is #{resp.code} (custom CA store: #{custom_store})"
|
|
145
|
+
end
|
|
146
|
+
|
|
147
|
+
unless resp.code == '200'
|
|
148
|
+
raise "Response code for /ping is #{resp.code}, not 200"
|
|
149
|
+
end
|
|
150
|
+
|
|
151
|
+
Endpoint.new("https://#{server_name}/", http.cert_store)
|
|
152
|
+
rescue StandardError => e
|
|
153
|
+
logger.info do
|
|
154
|
+
"Error in request to #{server_name} " \
|
|
155
|
+
"(custom store: #{custom_store}): #{e.message}"
|
|
156
|
+
end
|
|
157
|
+
|
|
158
|
+
raise "Error in request to #{server_name}: #{e.message}"
|
|
159
|
+
end
|
|
160
|
+
|
|
161
|
+
def wait_for_threads(thread_control, thread_injection)
|
|
162
|
+
deadline = Time.now + GLOBAL_TIMEOUT
|
|
163
|
+
[thread_control, thread_injection].each do |thread|
|
|
164
|
+
rem = deadline - Time.now
|
|
165
|
+
rem = 0.1 if rem < 0.1
|
|
166
|
+
next if thread.join(rem)
|
|
167
|
+
logger.debug { "Timeout for thread #{thread}" }
|
|
168
|
+
thread.kill
|
|
169
|
+
thread[:endpoint_error] = "Timeout doing endpoint testing"
|
|
170
|
+
end
|
|
171
|
+
end
|
|
172
|
+
|
|
173
|
+
def cert_store
|
|
174
|
+
@cert_store ||= begin
|
|
175
|
+
cert_file = File.join(File.dirname(__FILE__), 'ca.crt')
|
|
176
|
+
cert_store = OpenSSL::X509::Store.new
|
|
177
|
+
cert_store.add_file cert_file
|
|
178
|
+
|
|
179
|
+
cert_store
|
|
180
|
+
end
|
|
181
|
+
end
|
|
182
|
+
end
|
|
183
|
+
end
|
|
184
|
+
end
|
data/lib/sqreen/event.rb
CHANGED
|
@@ -8,17 +8,19 @@
|
|
|
8
8
|
module Sqreen
|
|
9
9
|
# Master interface for point in time events (e.g. Attack, RemoteException)
|
|
10
10
|
class Event
|
|
11
|
+
# @return [Hash]
|
|
11
12
|
attr_reader :payload
|
|
13
|
+
|
|
14
|
+
# @return [Time]
|
|
15
|
+
attr_accessor :time # writer used only in tests
|
|
16
|
+
|
|
12
17
|
def initialize(payload)
|
|
13
18
|
@payload = payload
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
def to_hash
|
|
17
|
-
payload.to_hash
|
|
19
|
+
@time = Time.now.utc
|
|
18
20
|
end
|
|
19
21
|
|
|
20
22
|
def to_s
|
|
21
|
-
"<#{self.class.name}: #{to_hash}>"
|
|
23
|
+
"<#{self.class.name}: #{payload.to_hash}>"
|
|
22
24
|
end
|
|
23
25
|
end
|
|
24
26
|
end
|
data/lib/sqreen/events/attack.rb
CHANGED
|
@@ -11,6 +11,8 @@ module Sqreen
|
|
|
11
11
|
# Attack
|
|
12
12
|
# When creating a new attack, it gets automatically pushed to the event's
|
|
13
13
|
# queue.
|
|
14
|
+
# XXX: TURNS OUT THIS CLASS IS ACTUALLY NOT USED ANYMORE
|
|
15
|
+
# Framework.observe is used instead with unstructured attack details
|
|
14
16
|
class Attack < Event
|
|
15
17
|
def self.record(payload)
|
|
16
18
|
attack = Attack.new(payload)
|
|
@@ -26,11 +28,31 @@ module Sqreen
|
|
|
26
28
|
payload['rule']['rulespack_id']
|
|
27
29
|
end
|
|
28
30
|
|
|
29
|
-
def
|
|
31
|
+
def rule_name
|
|
30
32
|
return nil unless payload['rule']
|
|
31
33
|
payload['rule']['name']
|
|
32
34
|
end
|
|
33
35
|
|
|
36
|
+
def test?
|
|
37
|
+
return nil unless payload['rule']
|
|
38
|
+
payload['rule']['test'] ? true : false
|
|
39
|
+
end
|
|
40
|
+
|
|
41
|
+
def beta?
|
|
42
|
+
return nil unless payload['rule']
|
|
43
|
+
payload['rule']['beta'] ? true : false
|
|
44
|
+
end
|
|
45
|
+
|
|
46
|
+
def block?
|
|
47
|
+
return nil unless payload['rule']
|
|
48
|
+
payload['rule']['block'] ? true : false
|
|
49
|
+
end
|
|
50
|
+
|
|
51
|
+
def attack_type
|
|
52
|
+
return nil unless payload['rule']
|
|
53
|
+
payload['rule']['attack_type']
|
|
54
|
+
end
|
|
55
|
+
|
|
34
56
|
def time
|
|
35
57
|
return nil unless payload['local']
|
|
36
58
|
payload['local']['time']
|
|
@@ -44,22 +66,5 @@ module Sqreen
|
|
|
44
66
|
def enqueue
|
|
45
67
|
Sqreen.queue.push(self)
|
|
46
68
|
end
|
|
47
|
-
|
|
48
|
-
def to_hash
|
|
49
|
-
res = {}
|
|
50
|
-
rule_p = payload['rule']
|
|
51
|
-
request_p = payload['request']
|
|
52
|
-
res[:rule_name] = rule_p['name'] if rule_p && rule_p['name']
|
|
53
|
-
res[:rulespack_id] = rule_p['rulespack_id'] if rule_p && rule_p['rulespack_id']
|
|
54
|
-
res[:test] = rule_p['test'] if rule_p && rule_p['test']
|
|
55
|
-
res[:infos] = payload['infos'] if payload['infos']
|
|
56
|
-
res[:time] = time if time
|
|
57
|
-
res[:client_ip] = request_p[:addr] if request_p && request_p[:addr]
|
|
58
|
-
res[:request] = request_p if request_p
|
|
59
|
-
res[:params] = payload['params'] if payload['params']
|
|
60
|
-
res[:context] = payload['context'] if payload['context']
|
|
61
|
-
res[:headers] = payload['headers'] if payload['headers']
|
|
62
|
-
res
|
|
63
|
-
end
|
|
64
69
|
end
|
|
65
70
|
end
|