sqreen 1.19.4 → 1.20.4.beta1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +22 -1
- data/lib/sqreen/actions/block_user.rb +1 -1
- data/lib/sqreen/actions/redirect_ip.rb +1 -1
- data/lib/sqreen/actions/redirect_user.rb +1 -1
- data/lib/sqreen/agent_message.rb +20 -0
- data/lib/sqreen/aggregated_metric.rb +25 -0
- data/lib/sqreen/attack_detected.html +1 -2
- data/lib/sqreen/ca.crt +24 -0
- data/lib/sqreen/configuration.rb +11 -5
- data/lib/sqreen/deferred_logger.rb +50 -14
- data/lib/sqreen/deliveries/batch.rb +4 -1
- data/lib/sqreen/deliveries/simple.rb +4 -0
- data/lib/sqreen/deprecation.rb +38 -0
- data/lib/sqreen/endpoint_testing.rb +184 -0
- data/lib/sqreen/event.rb +7 -5
- data/lib/sqreen/events/attack.rb +23 -18
- data/lib/sqreen/events/remote_exception.rb +0 -22
- data/lib/sqreen/events/request_record.rb +15 -70
- data/lib/sqreen/frameworks/generic.rb +9 -0
- data/lib/sqreen/frameworks/rails.rb +0 -7
- data/lib/sqreen/frameworks/request_recorder.rb +13 -2
- data/lib/sqreen/graft/call.rb +76 -18
- data/lib/sqreen/graft/callback.rb +1 -1
- data/lib/sqreen/graft/hook.rb +187 -85
- data/lib/sqreen/graft/hook_point.rb +1 -1
- data/lib/sqreen/kit/signals/specialized/aggregated_metric.rb +72 -0
- data/lib/sqreen/kit/signals/specialized/attack.rb +57 -0
- data/lib/sqreen/kit/signals/specialized/binning_metric.rb +76 -0
- data/lib/sqreen/kit/signals/specialized/http_trace.rb +26 -0
- data/lib/sqreen/kit/signals/specialized/sdk_track_call.rb +50 -0
- data/lib/sqreen/kit/signals/specialized/sqreen_exception.rb +57 -0
- data/lib/sqreen/legacy/instrumentation.rb +22 -10
- data/lib/sqreen/legacy/old_event_submission_strategy.rb +221 -0
- data/lib/sqreen/legacy/waf_redactions.rb +49 -0
- data/lib/sqreen/log.rb +3 -2
- data/lib/sqreen/log/loggable.rb +2 -1
- data/lib/sqreen/logger.rb +24 -0
- data/lib/sqreen/metrics/base.rb +3 -0
- data/lib/sqreen/metrics_store.rb +33 -12
- data/lib/sqreen/null_logger.rb +22 -0
- data/lib/sqreen/performance_notifications/binned_metrics.rb +8 -2
- data/lib/sqreen/remote_command.rb +1 -0
- data/lib/sqreen/rules.rb +5 -3
- data/lib/sqreen/rules/blacklist_ips_cb.rb +2 -2
- data/lib/sqreen/rules/rule_cb.rb +4 -0
- data/lib/sqreen/rules/waf_cb.rb +11 -8
- data/lib/sqreen/runner.rb +103 -10
- data/lib/sqreen/sensitive_data_redactor.rb +19 -31
- data/lib/sqreen/session.rb +51 -43
- data/lib/sqreen/signals/conversions.rb +283 -0
- data/lib/sqreen/signals/http_trace_redaction.rb +111 -0
- data/lib/sqreen/signals/signals_submission_strategy.rb +78 -0
- data/lib/sqreen/version.rb +1 -1
- data/lib/sqreen/weave/budget.rb +46 -0
- data/lib/sqreen/weave/legacy/instrumentation.rb +156 -94
- data/lib/sqreen/worker.rb +6 -2
- metadata +51 -8
- data/lib/sqreen/backport.rb +0 -9
- data/lib/sqreen/backport/clock_gettime.rb +0 -74
- data/lib/sqreen/backport/original_name.rb +0 -88
@@ -0,0 +1,49 @@
|
|
1
|
+
# typed: ignore
|
2
|
+
|
3
|
+
# Copyright (c) 2015 Sqreen. All Rights Reserved.
|
4
|
+
# Please refer to our terms for more information: https://www.sqreen.com/terms.html
|
5
|
+
|
6
|
+
module Sqreen
|
7
|
+
module Legacy
|
8
|
+
module WafRedactions
|
9
|
+
class << self
|
10
|
+
def redact_attacks!(attacks, values)
|
11
|
+
return attacks if values.empty?
|
12
|
+
|
13
|
+
values = values.map { |v| v.downcase if v.is_a?(String) }
|
14
|
+
|
15
|
+
attacks.each do |e|
|
16
|
+
next(e) unless e[:infos]
|
17
|
+
next(e) unless e[:infos][:waf_data]
|
18
|
+
|
19
|
+
parsed = JSON.parse(e[:infos][:waf_data])
|
20
|
+
redacted = parsed.each do |w|
|
21
|
+
next unless (filters = w['filter'])
|
22
|
+
|
23
|
+
filters.each do |f|
|
24
|
+
next unless (v = f['resolved_value'])
|
25
|
+
next unless values.include?(v.downcase)
|
26
|
+
|
27
|
+
f['match_status'] = SensitiveDataRedactor::MASK
|
28
|
+
f['resolved_value'] = SensitiveDataRedactor::MASK
|
29
|
+
end
|
30
|
+
end
|
31
|
+
e[:infos][:waf_data] = JSON.dump(redacted)
|
32
|
+
end
|
33
|
+
end
|
34
|
+
|
35
|
+
# see https://github.com/sqreen/TechDoc/blob/master/content/specs/spec000022-waf-data-sanitization.md#changes-to-the-agents
|
36
|
+
def redact_exceptions!(exceptions, values)
|
37
|
+
return exceptions if values.empty?
|
38
|
+
|
39
|
+
exceptions.each do |e|
|
40
|
+
next(e) unless e[:infos]
|
41
|
+
next(e) unless e[:infos][:waf]
|
42
|
+
|
43
|
+
e[:infos][:waf].delete(:args)
|
44
|
+
end
|
45
|
+
end
|
46
|
+
end
|
47
|
+
end
|
48
|
+
end
|
49
|
+
end
|
data/lib/sqreen/log.rb
CHANGED
@@ -14,16 +14,17 @@ require 'sqreen/deferred_logger'
|
|
14
14
|
|
15
15
|
module Sqreen
|
16
16
|
def self.log_init
|
17
|
+
deferred_logger = @logger
|
17
18
|
@logger = Sqreen::Logger.new(
|
18
19
|
Sqreen.config_get(:log_level).to_s.upcase,
|
19
20
|
Sqreen.config_get(:log_location)
|
20
21
|
)
|
21
|
-
|
22
|
+
deferred_logger.flush_to(@logger.instance_eval { @logger })
|
22
23
|
rescue => e
|
23
24
|
warn "Sqreen logger exception: #{e}"
|
24
25
|
end
|
25
26
|
|
26
27
|
def self::log
|
27
|
-
@logger
|
28
|
+
@logger ||= Sqreen::DeferredLogger.new
|
28
29
|
end
|
29
30
|
end
|
data/lib/sqreen/log/loggable.rb
CHANGED
@@ -4,6 +4,7 @@
|
|
4
4
|
# Please refer to our terms for more information: https://www.sqreen.com/terms.html
|
5
5
|
|
6
6
|
require 'logger'
|
7
|
+
require 'sqreen/log'
|
7
8
|
|
8
9
|
module Sqreen; end
|
9
10
|
module Sqreen::Log; end
|
@@ -23,6 +24,6 @@ module Sqreen::Log::Loggable
|
|
23
24
|
end
|
24
25
|
|
25
26
|
def logger
|
26
|
-
@logger ||
|
27
|
+
@logger || singleton_class.logger
|
27
28
|
end
|
28
29
|
end
|
data/lib/sqreen/logger.rb
CHANGED
@@ -28,6 +28,26 @@ module Sqreen
|
|
28
28
|
create_error_logger
|
29
29
|
end
|
30
30
|
|
31
|
+
def debug?
|
32
|
+
@logger.debug?
|
33
|
+
end
|
34
|
+
|
35
|
+
def info?
|
36
|
+
@logger.info?
|
37
|
+
end
|
38
|
+
|
39
|
+
def warn?
|
40
|
+
@logger.warn?
|
41
|
+
end
|
42
|
+
|
43
|
+
def error?
|
44
|
+
@logger.error?
|
45
|
+
end
|
46
|
+
|
47
|
+
def fatal?
|
48
|
+
@logger.fatal?
|
49
|
+
end
|
50
|
+
|
31
51
|
def debug(msg = nil, &block)
|
32
52
|
@logger.debug(msg, &block)
|
33
53
|
end
|
@@ -45,6 +65,10 @@ module Sqreen
|
|
45
65
|
@logger.error(msg, &block)
|
46
66
|
end
|
47
67
|
|
68
|
+
def unknown(msg = nil, &block)
|
69
|
+
@logger.unknown(msg, &block)
|
70
|
+
end
|
71
|
+
|
48
72
|
def add(severity, msg = nil, &block)
|
49
73
|
send(SEVERITY_TO_METHOD[severity], msg, &block)
|
50
74
|
end
|
data/lib/sqreen/metrics/base.rb
CHANGED
data/lib/sqreen/metrics_store.rb
CHANGED
@@ -3,6 +3,7 @@
|
|
3
3
|
# Copyright (c) 2015 Sqreen. All Rights Reserved.
|
4
4
|
# Please refer to our terms for more information: https://www.sqreen.com/terms.html
|
5
5
|
|
6
|
+
require 'sqreen/aggregated_metric'
|
6
7
|
require 'sqreen/metrics'
|
7
8
|
require 'sqreen/mono_time'
|
8
9
|
require 'sqreen/metrics_store/unknown_metric'
|
@@ -26,12 +27,16 @@ module Sqreen
|
|
26
27
|
def initialize
|
27
28
|
@store = []
|
28
29
|
@metrics = {} # name => (metric, period, start)
|
30
|
+
@mutex = Mutex.new
|
29
31
|
end
|
30
32
|
|
31
33
|
# Definition contains a name,period and aggregate at least
|
32
34
|
# @param definition [Hash] a metric definition
|
35
|
+
# @param rule [RuleCB] the rule associated with this metric, if any
|
33
36
|
# @param mklass [Object] Override metric object (used in testing)
|
34
|
-
def create_metric(definition, mklass = nil)
|
37
|
+
def create_metric(definition, rule = nil, mklass = nil)
|
38
|
+
@mutex.lock
|
39
|
+
|
35
40
|
name = definition[NAME_KEY]
|
36
41
|
kind = definition[KIND_KEY]
|
37
42
|
klass = valid_metric(kind, name)
|
@@ -43,30 +48,41 @@ module Sqreen
|
|
43
48
|
definition[PERIOD_KEY],
|
44
49
|
nil # Start
|
45
50
|
]
|
51
|
+
metric.name = name
|
52
|
+
metric.rule = rule
|
53
|
+
metric.period = definition[PERIOD_KEY]
|
46
54
|
metric
|
55
|
+
ensure
|
56
|
+
@mutex.unlock
|
47
57
|
end
|
48
58
|
|
49
59
|
def metric?(name)
|
50
60
|
@metrics.key?(name)
|
51
61
|
end
|
52
62
|
|
53
|
-
# @
|
63
|
+
# @param at [Time] when is the store emptied
|
54
64
|
def update(name, at, key, value)
|
65
|
+
@mutex.lock
|
55
66
|
metric, period, start = @metrics[name]
|
56
67
|
raise UnregisteredMetric, "Unknown metric #{name}" unless metric
|
57
68
|
next_sample(name, at) if start.nil? || (start + period) < at
|
58
69
|
metric.update(key, value)
|
70
|
+
ensure
|
71
|
+
@mutex.unlock
|
59
72
|
end
|
60
73
|
|
61
74
|
# Drains every metrics and returns the store content
|
62
|
-
# @
|
75
|
+
# @param at [Time] when is the store emptied
|
63
76
|
def publish(flush = true, at = Sqreen.time)
|
77
|
+
@mutex.lock
|
64
78
|
@metrics.each do |name, (_, period, start)|
|
65
79
|
next_sample(name, at) if flush || !start.nil? && (start + period) < at
|
66
80
|
end
|
67
81
|
out = @store
|
68
82
|
@store = []
|
69
83
|
out
|
84
|
+
ensure
|
85
|
+
@mutex.unlock
|
70
86
|
end
|
71
87
|
|
72
88
|
protected
|
@@ -75,15 +91,20 @@ module Sqreen
|
|
75
91
|
metric = @metrics[name][0]
|
76
92
|
r = metric.next_sample(at)
|
77
93
|
@metrics[name][2] = at # new start
|
78
|
-
|
79
|
-
|
80
|
-
|
81
|
-
|
82
|
-
|
83
|
-
|
84
|
-
|
85
|
-
|
86
|
-
|
94
|
+
return unless r
|
95
|
+
|
96
|
+
r[NAME_KEY] = name
|
97
|
+
obs = r[Metric::OBSERVATION_KEY]
|
98
|
+
return unless obs && (!obs.respond_to?(:empty?) || !obs.empty?)
|
99
|
+
start_of_mono = Time.now.utc - Sqreen.time
|
100
|
+
|
101
|
+
agg = AggregatedMetric.new
|
102
|
+
agg.metric = metric
|
103
|
+
agg.rule = agg.metric.rule
|
104
|
+
agg.start = start_of_mono + r[Metric::START_KEY]
|
105
|
+
agg.finish = start_of_mono + r[Metric::FINISH_KEY]
|
106
|
+
agg.data = obs
|
107
|
+
@store << agg
|
87
108
|
end
|
88
109
|
|
89
110
|
def valid_metric(kind, name)
|
data/lib/sqreen/null_logger.rb
CHANGED
@@ -9,6 +9,26 @@ module Sqreen
|
|
9
9
|
class NullLogger
|
10
10
|
include Singleton
|
11
11
|
|
12
|
+
def debug?
|
13
|
+
false
|
14
|
+
end
|
15
|
+
|
16
|
+
def info?
|
17
|
+
false
|
18
|
+
end
|
19
|
+
|
20
|
+
def warn?
|
21
|
+
false
|
22
|
+
end
|
23
|
+
|
24
|
+
def error?
|
25
|
+
false
|
26
|
+
end
|
27
|
+
|
28
|
+
def fatal?
|
29
|
+
false
|
30
|
+
end
|
31
|
+
|
12
32
|
def debug(_msg = nil); end
|
13
33
|
|
14
34
|
def info(_msg = nil); end
|
@@ -19,6 +39,8 @@ module Sqreen
|
|
19
39
|
|
20
40
|
def fatal(_msg = nil); end
|
21
41
|
|
42
|
+
def unknown(_msg = nil); end
|
43
|
+
|
22
44
|
def add(_severity, _msg = nil); end
|
23
45
|
|
24
46
|
def formatter=(_); end
|
@@ -122,10 +122,16 @@ module Sqreen
|
|
122
122
|
attr_reader :metrics_store
|
123
123
|
attr_reader :period
|
124
124
|
|
125
|
-
def ensure_metric(metric_name)
|
125
|
+
def ensure_metric(metric_name, rule = nil)
|
126
126
|
return if metrics_store.metric?(metric_name)
|
127
127
|
metrics_store.create_metric(
|
128
|
-
|
128
|
+
{
|
129
|
+
'name' => metric_name,
|
130
|
+
'period' => period,
|
131
|
+
'kind' => 'Binning',
|
132
|
+
'options' => @perf_metric_opts,
|
133
|
+
},
|
134
|
+
rule
|
129
135
|
)
|
130
136
|
end
|
131
137
|
|
@@ -18,6 +18,7 @@ module Sqreen
|
|
18
18
|
:features_get => :features,
|
19
19
|
:features_change => :change_features,
|
20
20
|
:force_logout => :shutdown,
|
21
|
+
:force_restart => :restart,
|
21
22
|
:paths_whitelist => :change_whitelisted_paths,
|
22
23
|
:ips_whitelist => :change_whitelisted_ips,
|
23
24
|
:get_bundle => :upload_bundle,
|
data/lib/sqreen/rules.rb
CHANGED
@@ -114,7 +114,7 @@ module Sqreen
|
|
114
114
|
Sqreen.log.warn('No JavaScript engine is available. ' \
|
115
115
|
'JavaScript callbacks will be ignored')
|
116
116
|
end
|
117
|
-
Sqreen.log.
|
117
|
+
Sqreen.log.debug("Ignoring JS callback #{rule_name}")
|
118
118
|
return nil
|
119
119
|
end
|
120
120
|
|
@@ -135,13 +135,15 @@ module Sqreen
|
|
135
135
|
return nil
|
136
136
|
end
|
137
137
|
|
138
|
+
rule_cb = cb_class.new(instr_class, instr_method, hash_rule)
|
139
|
+
|
138
140
|
if metrics_store
|
139
141
|
(hash_rule[Attrs::METRICS] || []).each do |metric|
|
140
|
-
metrics_store.create_metric(metric)
|
142
|
+
metrics_store.create_metric(metric, rule_cb)
|
141
143
|
end
|
142
144
|
end
|
143
145
|
|
144
|
-
|
146
|
+
rule_cb
|
145
147
|
rescue => e
|
146
148
|
rule_name = nil
|
147
149
|
rulespack_id = nil
|
@@ -33,7 +33,7 @@ module Sqreen
|
|
33
33
|
private
|
34
34
|
|
35
35
|
def insert_values(ranges)
|
36
|
-
Sqreen.log.
|
36
|
+
Sqreen.log.debug 'no ips given for IP blacklisting' if ranges.empty?
|
37
37
|
|
38
38
|
ranges.map { |r| Prefix.from_str(r, r) }.each do |prefix|
|
39
39
|
trie_for(prefix).insert prefix
|
@@ -50,7 +50,7 @@ module Sqreen
|
|
50
50
|
begin
|
51
51
|
ipa = IPAddr.new(rip)
|
52
52
|
rescue StandardError
|
53
|
-
Sqreen.log.
|
53
|
+
Sqreen.log.debug "invalid IP address given by framework: #{rip}"
|
54
54
|
return nil
|
55
55
|
end
|
56
56
|
|
data/lib/sqreen/rules/rule_cb.rb
CHANGED
@@ -3,6 +3,7 @@
|
|
3
3
|
# Copyright (c) 2015 Sqreen. All Rights Reserved.
|
4
4
|
# Please refer to our terms for more information: https://www.sqreen.com/terms.html
|
5
5
|
|
6
|
+
require 'sqreen/deprecation'
|
6
7
|
require 'sqreen/framework_cb'
|
7
8
|
require 'sqreen/context'
|
8
9
|
require 'sqreen/conditionable'
|
@@ -61,7 +62,9 @@ module Sqreen
|
|
61
62
|
:infos => infos,
|
62
63
|
:rulespack_id => rulespack_id,
|
63
64
|
:rule_name => rule_name,
|
65
|
+
:attack_type => @rule['attack_type'], # for signal
|
64
66
|
:test => test,
|
67
|
+
:block => @rule['block'], # for signal
|
65
68
|
:time => at,
|
66
69
|
}
|
67
70
|
if payload_tpl.include?('context')
|
@@ -107,6 +110,7 @@ module Sqreen
|
|
107
110
|
)
|
108
111
|
true
|
109
112
|
end
|
113
|
+
Sqreen::Deprecation.deprecate(instance_method(:overtime!))
|
110
114
|
end
|
111
115
|
end
|
112
116
|
end
|
data/lib/sqreen/rules/waf_cb.rb
CHANGED
@@ -132,20 +132,23 @@ module Sqreen
|
|
132
132
|
end
|
133
133
|
|
134
134
|
def record_exception(exception, infos = {}, at = Time.now.utc)
|
135
|
-
infos.merge!(
|
135
|
+
infos.merge!(waf_infos(exception)) if exception.is_a?(Sqreen::WAFError)
|
136
136
|
super(exception, infos, at)
|
137
137
|
end
|
138
138
|
|
139
139
|
private
|
140
140
|
|
141
|
-
|
141
|
+
# see https://github.com/sqreen/TechDoc/blob/master/content/specs/spec000016-waf-integration.md#error-management
|
142
|
+
def waf_infos(e)
|
142
143
|
{
|
143
|
-
|
144
|
-
|
145
|
-
|
146
|
-
|
147
|
-
|
148
|
-
|
144
|
+
waf: {
|
145
|
+
waf_rule: e.rule_name,
|
146
|
+
error_code: ERROR_CODES[e.error],
|
147
|
+
}.tap do |r|
|
148
|
+
r[:error_data] = e.data if e.data
|
149
|
+
r[:args] = e.args if e.arg
|
150
|
+
end,
|
151
|
+
}
|
149
152
|
end
|
150
153
|
|
151
154
|
ERROR_CODES = {
|
data/lib/sqreen/runner.rb
CHANGED
@@ -11,6 +11,7 @@ require 'sqreen/events/attack'
|
|
11
11
|
|
12
12
|
require 'sqreen/log'
|
13
13
|
|
14
|
+
require 'sqreen/agent_message'
|
14
15
|
require 'sqreen/rules'
|
15
16
|
require 'sqreen/session'
|
16
17
|
require 'sqreen/remote_command'
|
@@ -18,11 +19,13 @@ require 'sqreen/capped_queue'
|
|
18
19
|
require 'sqreen/metrics_store'
|
19
20
|
require 'sqreen/deliveries/simple'
|
20
21
|
require 'sqreen/deliveries/batch'
|
22
|
+
require 'sqreen/endpoint_testing'
|
21
23
|
require 'sqreen/performance_notifications/metrics'
|
22
24
|
require 'sqreen/performance_notifications/binned_metrics'
|
23
25
|
require 'sqreen/legacy/instrumentation'
|
24
26
|
require 'sqreen/call_countable'
|
25
27
|
require 'sqreen/weave/legacy/instrumentation'
|
28
|
+
require 'sqreen/kit/configuration'
|
26
29
|
|
27
30
|
module Sqreen
|
28
31
|
@features = {}
|
@@ -37,6 +40,8 @@ module Sqreen
|
|
37
40
|
PERF_METRICS_PERIOD = 60 # 1 min
|
38
41
|
DEFAULT_PERF_LEVEL = 0 # disabled
|
39
42
|
|
43
|
+
DEFAULT_USE_SIGNALS = false
|
44
|
+
|
40
45
|
class << self
|
41
46
|
attr_reader :features
|
42
47
|
def update_features(features)
|
@@ -87,7 +92,9 @@ module Sqreen
|
|
87
92
|
|
88
93
|
attr_accessor :heartbeat_delay
|
89
94
|
attr_accessor :metrics_engine
|
95
|
+
# @return [Sqreen::Deliveries::Simple]
|
90
96
|
attr_reader :deliverer
|
97
|
+
# @return [Sqreen::Session]
|
91
98
|
attr_reader :session
|
92
99
|
attr_reader :instrumenter
|
93
100
|
attr_accessor :running
|
@@ -108,15 +115,24 @@ module Sqreen
|
|
108
115
|
@next_metrics = []
|
109
116
|
@running = true
|
110
117
|
|
118
|
+
@proxy_url = @configuration.get(:proxy_url)
|
119
|
+
chosen_endpoints = determine_endpoints
|
120
|
+
|
111
121
|
@token = @configuration.get(:token)
|
112
122
|
@app_name = @configuration.get(:app_name)
|
113
|
-
@url =
|
123
|
+
@url = chosen_endpoints.control.url
|
124
|
+
@cert_store = chosen_endpoints.control.ca_store
|
125
|
+
|
114
126
|
Sqreen.update_whitelisted_paths([])
|
115
127
|
Sqreen.update_whitelisted_ips({})
|
116
128
|
Sqreen.update_performance_budget(nil)
|
117
|
-
raise(Sqreen::Exception, 'no url found') unless @url
|
118
129
|
raise(Sqreen::TokenNotFoundException, 'no token found') unless @token
|
119
130
|
|
131
|
+
Sqreen::Kit::Configuration.logger = Sqreen.log
|
132
|
+
Sqreen::Kit::Configuration.ingestion_url = chosen_endpoints.ingestion.url
|
133
|
+
Sqreen::Kit::Configuration.certificate_store = chosen_endpoints.ingestion.ca_store
|
134
|
+
Sqreen::Kit::Configuration.proxy_url = @proxy_url
|
135
|
+
|
120
136
|
register_exit_cb if set_at_exit
|
121
137
|
|
122
138
|
self.metrics_engine = MetricsStore.new
|
@@ -133,6 +149,7 @@ module Sqreen
|
|
133
149
|
|
134
150
|
Sqreen.log.debug "Using token #{@token}"
|
135
151
|
response = create_session(session_class)
|
152
|
+
post_endpoint_testing_msgs(chosen_endpoints)
|
136
153
|
wanted_features = response.fetch('features', {})
|
137
154
|
conf_initial_features = configuration.get(:initial_features)
|
138
155
|
unless conf_initial_features.nil?
|
@@ -142,10 +159,10 @@ module Sqreen
|
|
142
159
|
Sqreen.log.debug do
|
143
160
|
"Override initial features with #{conf_features.inspect}"
|
144
161
|
end
|
145
|
-
wanted_features = conf_features
|
162
|
+
wanted_features = wanted_features.merge(conf_features)
|
146
163
|
rescue
|
147
164
|
Sqreen.log.warn do
|
148
|
-
"NOT using invalid
|
165
|
+
"NOT using invalid initial features #{conf_initial_features}"
|
149
166
|
end
|
150
167
|
end
|
151
168
|
end
|
@@ -161,7 +178,7 @@ module Sqreen
|
|
161
178
|
end
|
162
179
|
|
163
180
|
def create_session(session_class)
|
164
|
-
@session = session_class.new(@url, @token, @app_name)
|
181
|
+
@session = session_class.new(@url, @cert_store, @token, @app_name, @proxy_url)
|
165
182
|
session.login(@framework)
|
166
183
|
end
|
167
184
|
|
@@ -170,8 +187,18 @@ module Sqreen
|
|
170
187
|
@deliverer = new_deliverer
|
171
188
|
end
|
172
189
|
|
173
|
-
def batch_events(batch_size, max_staleness = nil)
|
190
|
+
def batch_events(batch_size, max_staleness = nil, use_signals = false)
|
174
191
|
size = batch_size.to_i
|
192
|
+
|
193
|
+
if size <= 1 && use_signals
|
194
|
+
Sqreen.log.warn do
|
195
|
+
"Using signals with no delivery batching is unsupported. " \
|
196
|
+
"Using instead batching with batch size = 30, max_staleness = 60"
|
197
|
+
end
|
198
|
+
size = 30
|
199
|
+
max_staleness = 60
|
200
|
+
end
|
201
|
+
|
175
202
|
self.deliverer = if size < 1
|
176
203
|
Deliveries::Simple.new(session)
|
177
204
|
else
|
@@ -301,19 +328,37 @@ module Sqreen
|
|
301
328
|
def do_heartbeat
|
302
329
|
@last_heartbeat_request = Time.now
|
303
330
|
@next_metrics.concat(metrics_engine.publish(false)) if metrics_engine
|
304
|
-
|
331
|
+
metrics_in_hb = use_signals? ? nil : next_metrics
|
332
|
+
|
333
|
+
res = session.heartbeat(next_command_results, metrics_in_hb)
|
305
334
|
next_command_results.clear
|
335
|
+
|
336
|
+
deliver_metrics_as_event if use_signals?
|
306
337
|
next_metrics.clear
|
338
|
+
|
307
339
|
process_commands(res['commands'])
|
308
340
|
end
|
309
341
|
|
342
|
+
def deliver_metrics_as_event
|
343
|
+
# this is disastrous withe simple delivery strategy,
|
344
|
+
# as each aggregated metric would trigger an http request
|
345
|
+
# Sending of metrics is therefore not supported with simple delivery strategy
|
346
|
+
# TODO: Confirm that only batch is used in production
|
347
|
+
next_metrics.each { |x| deliverer.post_event(x) }
|
348
|
+
end
|
349
|
+
|
310
350
|
def features(_context_infos = {})
|
311
351
|
Sqreen.features
|
312
352
|
end
|
313
353
|
|
354
|
+
def use_signals?
|
355
|
+
features.fetch('use_signals', DEFAULT_USE_SIGNALS)
|
356
|
+
end
|
357
|
+
|
314
358
|
def features=(features)
|
315
359
|
Sqreen.update_features(features)
|
316
360
|
session.request_compression = features['request_compression'] if session
|
361
|
+
session.use_signals = use_signals?
|
317
362
|
self.performance_metrics_period = features['performance_metrics_period']
|
318
363
|
|
319
364
|
unless @configuration.get(:weave)
|
@@ -331,7 +376,7 @@ module Sqreen
|
|
331
376
|
hd = features['heartbeat_delay'].to_i
|
332
377
|
self.heartbeat_delay = hd if hd > 0
|
333
378
|
return if features['batch_size'].nil?
|
334
|
-
batch_events(features['batch_size'], features['max_staleness'])
|
379
|
+
batch_events(features['batch_size'], features['max_staleness'], use_signals?)
|
335
380
|
end
|
336
381
|
|
337
382
|
def change_whitelisted_paths(paths, _context_infos = {})
|
@@ -342,8 +387,25 @@ module Sqreen
|
|
342
387
|
|
343
388
|
def change_performance_budget(budget, _context_infos = {})
|
344
389
|
return false unless budget.nil? || budget.to_f > 0
|
345
|
-
|
346
|
-
|
390
|
+
|
391
|
+
if @configuration.get(:weave)
|
392
|
+
prev = Sqreen::Weave::Budget.current
|
393
|
+
prev = prev.to_h if prev
|
394
|
+
|
395
|
+
budget_s = budget.to_f / 1000 if budget
|
396
|
+
|
397
|
+
feature = features['performance_budget']
|
398
|
+
if feature
|
399
|
+
budget_s = feature['threshold'] if feature.key?('threshold')
|
400
|
+
ratio = feature['ratio'] if feature.key?('ratio')
|
401
|
+
end
|
402
|
+
|
403
|
+
Sqreen::Weave::Budget.update(threshold: budget_s, ratio: ratio)
|
404
|
+
else
|
405
|
+
prev = Sqreen.performance_budget
|
406
|
+
Sqreen.update_performance_budget(budget)
|
407
|
+
end
|
408
|
+
|
347
409
|
{ :was => prev }
|
348
410
|
end
|
349
411
|
|
@@ -433,6 +495,15 @@ module Sqreen
|
|
433
495
|
logout
|
434
496
|
end
|
435
497
|
|
498
|
+
def restart(_context_infos = {})
|
499
|
+
shutdown
|
500
|
+
heartbeat_delay = @heartbeat_delay
|
501
|
+
Thread.new do
|
502
|
+
sleep(2 * heartbeat_delay)
|
503
|
+
Sqreen::Worker.start(Sqreen.framework)
|
504
|
+
end
|
505
|
+
end
|
506
|
+
|
436
507
|
def logout(retrying = true)
|
437
508
|
return unless session
|
438
509
|
Sqreen.log.debug("Logging out")
|
@@ -470,6 +541,28 @@ module Sqreen
|
|
470
541
|
|
471
542
|
private
|
472
543
|
|
544
|
+
def post_endpoint_testing_msgs(chosen_endpoints)
|
545
|
+
chosen_endpoints.messages.each do |msg|
|
546
|
+
session.post_agent_message(@framework, msg)
|
547
|
+
end
|
548
|
+
rescue => e
|
549
|
+
Sqreen.log.warn "Error submitting agent message: #{e}"
|
550
|
+
RemoteException.record(e)
|
551
|
+
end
|
552
|
+
|
553
|
+
def determine_endpoints
|
554
|
+
# there's no sniffing going on; just a misnamed config setting
|
555
|
+
if @configuration.get(:no_sniff_domains)
|
556
|
+
# reproduces behaviour before endpoint testing was introduced
|
557
|
+
EndpointTesting.no_test_endpoints(@configuration.get(:url),
|
558
|
+
@configuration.get(:ingestion_url))
|
559
|
+
else
|
560
|
+
EndpointTesting.test_endpoints(@proxy_url,
|
561
|
+
@configuration.get(:url),
|
562
|
+
@configuration.get(:ingestion_url))
|
563
|
+
end
|
564
|
+
end
|
565
|
+
|
473
566
|
def load_actions(hashes)
|
474
567
|
unsupported = Set.new
|
475
568
|
|