sqreen 1.20.0 → 1.20.4
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +29 -0
- data/lib/sqreen/actions/block_user.rb +1 -1
- data/lib/sqreen/actions/redirect_ip.rb +1 -1
- data/lib/sqreen/actions/redirect_user.rb +1 -1
- data/lib/sqreen/agent_message.rb +20 -0
- data/lib/sqreen/attack_detected.html +1 -2
- data/lib/sqreen/ca.crt +24 -0
- data/lib/sqreen/condition_evaluator.rb +8 -2
- data/lib/sqreen/configuration.rb +5 -3
- data/lib/sqreen/deferred_logger.rb +50 -14
- data/lib/sqreen/deprecation.rb +38 -0
- data/lib/sqreen/endpoint_testing.rb +184 -0
- data/lib/sqreen/events/request_record.rb +0 -1
- data/lib/sqreen/frameworks/generic.rb +9 -0
- data/lib/sqreen/frameworks/rails.rb +0 -7
- data/lib/sqreen/frameworks/request_recorder.rb +2 -0
- data/lib/sqreen/graft/call.rb +76 -18
- data/lib/sqreen/graft/callback.rb +1 -1
- data/lib/sqreen/graft/hook.rb +187 -85
- data/lib/sqreen/graft/hook_point.rb +1 -1
- data/lib/sqreen/legacy/instrumentation.rb +22 -10
- data/lib/sqreen/legacy/old_event_submission_strategy.rb +2 -1
- data/lib/sqreen/log.rb +3 -2
- data/lib/sqreen/log/loggable.rb +2 -1
- data/lib/sqreen/logger.rb +24 -0
- data/lib/sqreen/metrics_store.rb +11 -0
- data/lib/sqreen/null_logger.rb +22 -0
- data/lib/sqreen/remote_command.rb +1 -0
- data/lib/sqreen/rules.rb +8 -4
- data/lib/sqreen/rules/blacklist_ips_cb.rb +2 -2
- data/lib/sqreen/rules/custom_error_cb.rb +3 -3
- data/lib/sqreen/rules/rule_cb.rb +2 -0
- data/lib/sqreen/rules/waf_cb.rb +3 -3
- data/lib/sqreen/runner.rb +64 -9
- data/lib/sqreen/session.rb +17 -11
- data/lib/sqreen/version.rb +1 -1
- data/lib/sqreen/weave/budget.rb +46 -0
- data/lib/sqreen/weave/legacy/instrumentation.rb +194 -103
- data/lib/sqreen/worker.rb +6 -2
- metadata +9 -7
- data/lib/sqreen/encoding_sanitizer.rb +0 -27
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: d7324df5cecbb626299a4e048550c6f7c5a3e15bef2eecc8d89011d0342914aa
|
|
4
|
+
data.tar.gz: eabb5203769dcf898d8a4e373c6cfee7e5b0eac8bbfc3977fb8924a54504b126
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 5e7f4bb53e01c0f5328a5190b189c82b596bcf28eada2104b1491c5601b1275866ef8950ae9ad92c91303011636a3c11ebcb3c3dbccd75280d6b89c1c69d301a
|
|
7
|
+
data.tar.gz: 77770ff7b00b9d07ea7f4137eadce1e840bc1ad94e885b42623354707306ebd42425187833e0403e33d02bea7471010bf934bda9010c5fe1d604715c5daf88c1
|
data/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,32 @@
|
|
|
1
|
+
## 1.20.4
|
|
2
|
+
|
|
3
|
+
* Fix missing budget check
|
|
4
|
+
* Improve performance
|
|
5
|
+
* Align internal setting name for WAF
|
|
6
|
+
* Include response information in all payloads
|
|
7
|
+
* Improve robustness against invalid Unicode
|
|
8
|
+
* Prevent rule execution to pursue in early block cases
|
|
9
|
+
|
|
10
|
+
## 1.20.4.beta1
|
|
11
|
+
|
|
12
|
+
* Add optional dynamic time budget
|
|
13
|
+
* Add advanced per request metrics
|
|
14
|
+
* Improve robustness against exception in instrumentation
|
|
15
|
+
* Improve metric engine thread safety
|
|
16
|
+
* Restrict deferred logger to final logger severity on agent boot
|
|
17
|
+
|
|
18
|
+
## 1.20.3
|
|
19
|
+
|
|
20
|
+
* Fix signature check
|
|
21
|
+
|
|
22
|
+
## 1.20.2
|
|
23
|
+
|
|
24
|
+
* Fix performance regression in instrumentation engine
|
|
25
|
+
|
|
26
|
+
## 1.20.1
|
|
27
|
+
|
|
28
|
+
* Add fallback mechanisms when connecting to new Sqreen backend API domains
|
|
29
|
+
|
|
1
30
|
## 1.20.0
|
|
2
31
|
|
|
3
32
|
* Enable new instrumentation engine by default
|
|
@@ -24,7 +24,7 @@ module Sqreen
|
|
|
24
24
|
end
|
|
25
25
|
|
|
26
26
|
def do_run(identity_params)
|
|
27
|
-
Sqreen.log.
|
|
27
|
+
Sqreen.log.debug 'Will request redirect for user with identity ' \
|
|
28
28
|
"#{identity_params} (action: #{id})."
|
|
29
29
|
|
|
30
30
|
e = Sqreen::AttackBlocked.new(
|
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
require 'digest'
|
|
2
|
+
|
|
3
|
+
module Sqreen
|
|
4
|
+
class AgentMessage
|
|
5
|
+
def initialize(kind, message, id = nil)
|
|
6
|
+
id ||= message + "\x00" + kind
|
|
7
|
+
@hash_hex = Digest::SHA1.hexdigest(id)
|
|
8
|
+
@kind = kind
|
|
9
|
+
@message = message
|
|
10
|
+
end
|
|
11
|
+
|
|
12
|
+
def to_h
|
|
13
|
+
{
|
|
14
|
+
id: @hash_hex,
|
|
15
|
+
kind: @kind,
|
|
16
|
+
message: @message,
|
|
17
|
+
}
|
|
18
|
+
end
|
|
19
|
+
end
|
|
20
|
+
end
|
|
@@ -1,2 +1 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
1
|
+
<!-- Sorry, you’ve been blocked --><!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>You've been blocked</title><style>a,body,div,h1,html,span{margin:0;padding:0;border:0;font-size:100%;font:inherit;vertical-align:baseline}body{background:-webkit-radial-gradient(26% 19%,circle,#fff,#f4f7f9);background:radial-gradient(circle at 26% 19%,#fff,#f4f7f9);display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-ms-flex-line-pack:center;align-content:center;width:100%;min-height:100vh;line-height:1;flex-direction:column}h1,p,svg{display:block}svg{margin:0 auto 4vh}main{text-align:center;flex:1;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-ms-flex-line-pack:center;align-content:center;flex-direction:column}h1{font-family:sans-serif;font-weight:600;font-size:34px;color:#1e0936;line-height:1.2}p{font-size:18px;line-height:normal;color:#646464;font-family:sans-serif;font-weight:400}a{color:#4842b7}footer{width:100%;text-align:center}footer p{font-size:16px}</style></head><body><main><svg width="170px" height="193px" viewBox="0 0 170 193" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true"><g id="exports" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd"><g id="Artboard" transform="translate(-186.000000, -189.000000)"><g id="logo-cmyk-indigo" transform="translate(186.000000, 189.000000)"><g id="nest-cmyk-indigo"><ellipse id="sqreen" fill="#B0ACFF" cx="85" cy="96.5" rx="45.7692308" ry="45.7966102"></ellipse><path d="M78.4615385,175.749389 L78.4615385,102.2092 L13.1398162,64.4731256 L13.1398162,129.181112 L36.352167,115.771438 C37.9764468,119.873152 40.1038639,123.720553 42.6582364,127.237412 L18.5723996,141.151695 L78.4615385,175.749389 Z M91.5384615,175.749389 L151.4276,141.151695 L127.341764,127.237412 C129.896136,123.720553 132.023553,119.873152 133.647833,115.771438 L156.860184,129.181112 L156.860184,64.4731256 L91.5384615,102.2092 L91.5384615,175.749389 Z M18.0061522,52.1754237 L85,90.8774777 L151.993848,52.1754237 L91.5384615,17.2506105 L91.5384615,44.565949 C89.3964992,44.2986903 87.2143177,44.1610169 85,44.1610169 C82.7856823,44.1610169 80.6035008,44.2986903 78.4615385,44.565949 L78.4615385,17.2506105 L18.0061522,52.1754237 Z M90.8846156,1.76392358 L164.052491,44.0326866 C167.693904,46.1363149 169.937107,50.0239804 169.937107,54.231237 L169.937107,138.768763 C169.937107,142.97602 167.693904,146.863685 164.052491,148.967313 L90.8846156,191.236076 C87.2432028,193.339705 82.7567972,193.339705 79.1153844,191.236076 L5.94750871,148.967313 C2.30609589,146.863685 0.0628930904,142.97602 0.0628930904,138.768763 L0.0628930904,54.231237 C0.0628930904,50.0239804 2.30609589,46.1363149 5.94750871,44.0326866 L79.1153844,1.76392358 C82.7567972,-0.339704735 87.2432028,-0.339704735 90.8846156,1.76392358 Z" id="app" fill="#4842B7"></path></g></g></g></g></svg><h1>Sorry, you've been blocked</h1><p>Contact the website owner</p></main><footer><p>Security provided by <a href="https://www.sqreen.com/?utm_medium=block_page" target="_blank">Sqreen</a></p></footer></body></html>
|
data/lib/sqreen/ca.crt
CHANGED
|
@@ -70,3 +70,27 @@ WE9gyn6CagsCqiUXObXbf+eEZSqVir2G3l6BFoMtEMze/aiCKm0oHw0LxOXnGiYZ
|
|
|
70
70
|
4fQRbxC1lfznQgUy286dUV4otp6F01vvpX1FQHKOtw5rDgb7MzVIcbidJ4vEZV8N
|
|
71
71
|
hnacRHr2lVz2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq
|
|
72
72
|
-----END CERTIFICATE-----
|
|
73
|
+
-----BEGIN CERTIFICATE-----
|
|
74
|
+
MIID7zCCAtegAwIBAgIBADANBgkqhkiG9w0BAQsFADCBmDELMAkGA1UEBhMCVVMx
|
|
75
|
+
EDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBgNVBAoT
|
|
76
|
+
HFN0YXJmaWVsZCBUZWNobm9sb2dpZXMsIEluYy4xOzA5BgNVBAMTMlN0YXJmaWVs
|
|
77
|
+
ZCBTZXJ2aWNlcyBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAtIEcyMB4XDTA5
|
|
78
|
+
MDkwMTAwMDAwMFoXDTM3MTIzMTIzNTk1OVowgZgxCzAJBgNVBAYTAlVTMRAwDgYD
|
|
79
|
+
VQQIEwdBcml6b25hMRMwEQYDVQQHEwpTY290dHNkYWxlMSUwIwYDVQQKExxTdGFy
|
|
80
|
+
ZmllbGQgVGVjaG5vbG9naWVzLCBJbmMuMTswOQYDVQQDEzJTdGFyZmllbGQgU2Vy
|
|
81
|
+
dmljZXMgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgLSBHMjCCASIwDQYJKoZI
|
|
82
|
+
hvcNAQEBBQADggEPADCCAQoCggEBANUMOsQq+U7i9b4Zl1+OiFOxHz/Lz58gE20p
|
|
83
|
+
OsgPfTz3a3Y4Y9k2YKibXlwAgLIvWX/2h/klQ4bnaRtSmpDhcePYLQ1Ob/bISdm2
|
|
84
|
+
8xpWriu2dBTrz/sm4xq6HZYuajtYlIlHVv8loJNwU4PahHQUw2eeBGg6345AWh1K
|
|
85
|
+
Ts9DkTvnVtYAcMtS7nt9rjrnvDH5RfbCYM8TWQIrgMw0R9+53pBlbQLPLJGmpufe
|
|
86
|
+
hRhJfGZOozptqbXuNC66DQO4M99H67FrjSXZm86B0UVGMpZwh94CDklDhbZsc7tk
|
|
87
|
+
6mFBrMnUVN+HL8cisibMn1lUaJ/8viovxFUcdUBgF4UCVTmLfwUCAwEAAaNCMEAw
|
|
88
|
+
DwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFJxfAN+q
|
|
89
|
+
AdcwKziIorhtSpzyEZGDMA0GCSqGSIb3DQEBCwUAA4IBAQBLNqaEd2ndOxmfZyMI
|
|
90
|
+
bw5hyf2E3F/YNoHN2BtBLZ9g3ccaaNnRbobhiCPPE95Dz+I0swSdHynVv/heyNXB
|
|
91
|
+
ve6SbzJ08pGCL72CQnqtKrcgfU28elUSwhXqvfdqlS5sdJ/PHLTyxQGjhdByPq1z
|
|
92
|
+
qwubdQxtRbeOlKyWN7Wg0I8VRw7j6IPdj/3vQQF3zCepYoUz8jcI73HPdwbeyBkd
|
|
93
|
+
iEDPfUYd/x7H4c7/I9vG+o1VTqkC50cRRj70/b17KSa7qWFiNyi2LSr2EIZkyXCn
|
|
94
|
+
0q23KXB56jzaYyWf/Wi3MOxw+3WKt21gZ7IeyLnp2KhvAotnDU0mV3HaIPzBSlCN
|
|
95
|
+
sSi6
|
|
96
|
+
-----END CERTIFICATE-----
|
|
@@ -67,7 +67,7 @@ module Sqreen
|
|
|
67
67
|
return true if rem <= 0
|
|
68
68
|
if hash.is_a?(Array)
|
|
69
69
|
return hash.any? do |v|
|
|
70
|
-
|
|
70
|
+
hash_key_include?(values, v, min_value_size, rem - 1)
|
|
71
71
|
end
|
|
72
72
|
end
|
|
73
73
|
|
|
@@ -81,7 +81,13 @@ module Sqreen
|
|
|
81
81
|
if hkey.respond_to?(:empty?) && hkey.empty?
|
|
82
82
|
false
|
|
83
83
|
else
|
|
84
|
-
|
|
84
|
+
key_incl = if values.is_a?(String)
|
|
85
|
+
str_include?(values, hkey.to_s)
|
|
86
|
+
else
|
|
87
|
+
values.include?(hkey.to_s)
|
|
88
|
+
end
|
|
89
|
+
|
|
90
|
+
key_incl || hash_key_include?(values, hval, min_value_size, rem - 1)
|
|
85
91
|
end
|
|
86
92
|
end
|
|
87
93
|
end
|
data/lib/sqreen/configuration.rb
CHANGED
|
@@ -43,9 +43,9 @@ module Sqreen
|
|
|
43
43
|
{ :env => :SQREEN_WEAVE_STRATEGY, :name => :weave_strategy,
|
|
44
44
|
:default => :prepend, :convert => :to_sym },
|
|
45
45
|
{ :env => :SQREEN_URL, :name => :url,
|
|
46
|
-
:default =>
|
|
46
|
+
:default => nil },
|
|
47
47
|
{ :env => :SQREEN_INGESTION_URL, :name => :ingestion_url,
|
|
48
|
-
:default =>
|
|
48
|
+
:default => nil },
|
|
49
49
|
{ :env => :SQREEN_PROXY_URL, :name => :proxy_url,
|
|
50
50
|
:default => nil },
|
|
51
51
|
{ :env => :SQREEN_TOKEN, :name => :token,
|
|
@@ -57,7 +57,7 @@ module Sqreen
|
|
|
57
57
|
{ :env => :SQREEN_RULES_SIGNATURE, :name => :rules_verify_signature,
|
|
58
58
|
:default => true },
|
|
59
59
|
{ :env => :SQREEN_LOG_LEVEL, :name => :log_level,
|
|
60
|
-
:default => '
|
|
60
|
+
:default => 'INFO', :choice => %w[UNKNOWN FATAL ERROR WARN INFO DEBUG] },
|
|
61
61
|
{ :env => :SQREEN_LOG_LOCATION, :name => :log_location,
|
|
62
62
|
:default => 'log/sqreen.log' },
|
|
63
63
|
{ :env => :SQREEN_RUN_IN_TEST, :name => :run_in_test,
|
|
@@ -78,6 +78,8 @@ module Sqreen
|
|
|
78
78
|
:default => nil },
|
|
79
79
|
{ :env => :SQREEN_STRIP_SENSITIVE_REGEX, :name => :strip_sensitive_regex,
|
|
80
80
|
:default => nil },
|
|
81
|
+
{ :env => :SQREEN_NO_SNIFF_DOMAINS, :name => :no_sniff_domains,
|
|
82
|
+
:default => false },
|
|
81
83
|
|
|
82
84
|
].freeze
|
|
83
85
|
|
|
@@ -9,35 +9,70 @@ require 'sqreen/logger'
|
|
|
9
9
|
|
|
10
10
|
module Sqreen
|
|
11
11
|
class DeferredLogger
|
|
12
|
-
|
|
12
|
+
MAX_ENTRIES = 1000
|
|
13
|
+
|
|
14
|
+
Entry = Struct.new(:severity, :message)
|
|
13
15
|
|
|
14
16
|
def initialize
|
|
15
17
|
@buffer = StringIO.new
|
|
16
18
|
@logger = ::Logger.new(@buffer)
|
|
19
|
+
@entries = []
|
|
20
|
+
@mutex = Mutex.new
|
|
21
|
+
end
|
|
22
|
+
|
|
23
|
+
def debug?
|
|
24
|
+
true
|
|
25
|
+
end
|
|
26
|
+
|
|
27
|
+
def info?
|
|
28
|
+
true
|
|
29
|
+
end
|
|
30
|
+
|
|
31
|
+
def warn?
|
|
32
|
+
true
|
|
33
|
+
end
|
|
34
|
+
|
|
35
|
+
def error?
|
|
36
|
+
true
|
|
37
|
+
end
|
|
38
|
+
|
|
39
|
+
def fatal?
|
|
40
|
+
true
|
|
17
41
|
end
|
|
18
42
|
|
|
19
43
|
def debug(msg = nil, &block)
|
|
20
|
-
|
|
44
|
+
add(::Logger::DEBUG, msg, &block)
|
|
21
45
|
end
|
|
22
46
|
|
|
23
47
|
def info(msg = nil, &block)
|
|
24
|
-
|
|
48
|
+
add(::Logger::INFO, msg, &block)
|
|
25
49
|
end
|
|
26
50
|
|
|
27
51
|
def warn(msg = nil, &block)
|
|
28
|
-
|
|
52
|
+
add(::Logger::WARN, msg, &block)
|
|
29
53
|
end
|
|
30
54
|
|
|
31
55
|
def error(msg = nil, &block)
|
|
32
|
-
|
|
56
|
+
add(::Logger::ERROR, msg, &block)
|
|
33
57
|
end
|
|
34
58
|
|
|
35
59
|
def fatal(msg = nil, &block)
|
|
36
|
-
|
|
60
|
+
add(::Logger::FATAL, msg, &block)
|
|
61
|
+
end
|
|
62
|
+
|
|
63
|
+
def unknown(msg = nil, &block)
|
|
64
|
+
add(::Logger::UNKNOWN, msg, &block)
|
|
37
65
|
end
|
|
38
66
|
|
|
39
67
|
def add(severity, msg = nil, &block)
|
|
40
|
-
|
|
68
|
+
@mutex.synchronize do
|
|
69
|
+
@entries.shift if @entries.count >= MAX_ENTRIES
|
|
70
|
+
mark = @buffer.pos
|
|
71
|
+
@logger.add(severity, msg, &block)
|
|
72
|
+
@buffer.seek(mark)
|
|
73
|
+
@entries << Entry.new(severity, @buffer.read)
|
|
74
|
+
@buffer.truncate(0)
|
|
75
|
+
end
|
|
41
76
|
end
|
|
42
77
|
|
|
43
78
|
def formatter=(value)
|
|
@@ -45,21 +80,22 @@ module Sqreen
|
|
|
45
80
|
end
|
|
46
81
|
|
|
47
82
|
def flush_to(logger)
|
|
48
|
-
|
|
83
|
+
@mutex.synchronize do
|
|
84
|
+
@entries.each do |entry|
|
|
85
|
+
next if entry.severity < logger.level
|
|
86
|
+
logger.instance_eval { @logdev }.write(entry.message)
|
|
87
|
+
end
|
|
88
|
+
reset
|
|
89
|
+
end
|
|
49
90
|
end
|
|
50
91
|
|
|
51
92
|
private
|
|
52
93
|
|
|
53
|
-
def read
|
|
54
|
-
@buffer.rewind
|
|
55
|
-
@buffer.read
|
|
56
|
-
end
|
|
57
|
-
|
|
58
94
|
def reset
|
|
59
95
|
buffer = StringIO.new
|
|
60
96
|
logger = ::Logger.new(buffer)
|
|
61
97
|
logger.formatter = @logger.formatter
|
|
62
|
-
@buffer, @logger = buffer, logger
|
|
98
|
+
@buffer, @logger, @entries = buffer, logger, []
|
|
63
99
|
end
|
|
64
100
|
end
|
|
65
101
|
end
|
|
@@ -0,0 +1,38 @@
|
|
|
1
|
+
# typed: strong
|
|
2
|
+
|
|
3
|
+
# Copyright (c) 2015 Sqreen. All Rights Reserved.
|
|
4
|
+
# Please refer to our terms for more information: https://www.sqreen.com/terms.html
|
|
5
|
+
|
|
6
|
+
require 'sqreen/log/loggable'
|
|
7
|
+
|
|
8
|
+
module Sqreen
|
|
9
|
+
module Deprecation
|
|
10
|
+
include Sqreen::Log::Loggable
|
|
11
|
+
|
|
12
|
+
module_function
|
|
13
|
+
|
|
14
|
+
def deprecate(method)
|
|
15
|
+
return unless ENV['SQREEN_DEBUG_DEPRECATION']
|
|
16
|
+
|
|
17
|
+
owner = method.owner
|
|
18
|
+
deprecated = :"_deprecated_#{method.name}"
|
|
19
|
+
klass = owner.is_a?(Module)
|
|
20
|
+
target = klass ? owner.to_s : owner.class.to_s
|
|
21
|
+
|
|
22
|
+
method.owner.instance_eval do
|
|
23
|
+
alias_method deprecated, method.name
|
|
24
|
+
|
|
25
|
+
define_method(method.name) do |*args, &block|
|
|
26
|
+
msg = [
|
|
27
|
+
"deprecation",
|
|
28
|
+
"target:#{target}",
|
|
29
|
+
"method:#{method.name}",
|
|
30
|
+
"caller:#{Kernel.caller_locations[0]}",
|
|
31
|
+
].join(' ')
|
|
32
|
+
Sqreen::Deprecation.logger.info(msg)
|
|
33
|
+
send(deprecated, *args, &block)
|
|
34
|
+
end
|
|
35
|
+
end
|
|
36
|
+
end
|
|
37
|
+
end
|
|
38
|
+
end
|
|
@@ -0,0 +1,184 @@
|
|
|
1
|
+
require 'net/https'
|
|
2
|
+
require 'sqreen/agent_message'
|
|
3
|
+
require 'sqreen/log/loggable'
|
|
4
|
+
|
|
5
|
+
module Sqreen
|
|
6
|
+
class EndpointTesting
|
|
7
|
+
Endpoint = Struct.new(:url, :ca_store)
|
|
8
|
+
class ChosenEndpoints
|
|
9
|
+
def initialize
|
|
10
|
+
@messages = []
|
|
11
|
+
end
|
|
12
|
+
|
|
13
|
+
# @return [Sqreen::EndpointTesting::Endpoint]
|
|
14
|
+
attr_accessor :control
|
|
15
|
+
|
|
16
|
+
# @return [Sqreen::EndpointTesting::Endpoint]
|
|
17
|
+
attr_accessor :ingestion
|
|
18
|
+
|
|
19
|
+
# @return [Array<Sqreen::AgentMessage>]
|
|
20
|
+
attr_reader :messages
|
|
21
|
+
|
|
22
|
+
# @param [Sqreen::AgentMessage] message
|
|
23
|
+
def add_message(message)
|
|
24
|
+
@messages << message
|
|
25
|
+
end
|
|
26
|
+
end
|
|
27
|
+
|
|
28
|
+
MAIN_CONTROL_HOST = 'back.sqreen.com'.freeze
|
|
29
|
+
MAIN_INJECTION_HOST = 'ingestion.sqreen.com'.freeze
|
|
30
|
+
FALLBACK_ENDPOINT_URL = 'https://back.sqreen.io/'.freeze
|
|
31
|
+
GLOBAL_TIMEOUT = 30
|
|
32
|
+
|
|
33
|
+
CONTROL_ERROR_KIND = 'back_sqreen_com_unavailable'.freeze
|
|
34
|
+
INGESTION_ERROR_KIND = 'ingestion_sqreen_com_unavailable'.freeze
|
|
35
|
+
|
|
36
|
+
class << self
|
|
37
|
+
include Log::Loggable
|
|
38
|
+
|
|
39
|
+
# reproduces behaviour before endpoint testing was introduced
|
|
40
|
+
def no_test_endpoints(config_url, config_ingestion_url)
|
|
41
|
+
endpoints = ChosenEndpoints.new
|
|
42
|
+
|
|
43
|
+
endpoints.control = Endpoint.new(
|
|
44
|
+
config_url || "https://#{MAIN_CONTROL_HOST}/", cert_store
|
|
45
|
+
)
|
|
46
|
+
endpoints.ingestion = Endpoint.new(
|
|
47
|
+
config_ingestion_url || "https://#{MAIN_INJECTION_HOST}/", nil
|
|
48
|
+
)
|
|
49
|
+
|
|
50
|
+
endpoints
|
|
51
|
+
end
|
|
52
|
+
|
|
53
|
+
def test_endpoints(proxy_url, config_url, config_ingestion_url)
|
|
54
|
+
proxy_params = create_proxy_params(proxy_url)
|
|
55
|
+
|
|
56
|
+
# execute the tests in separate threads and wait for them
|
|
57
|
+
thread_control = Thread.new do
|
|
58
|
+
thread_main(config_url, proxy_params, MAIN_CONTROL_HOST)
|
|
59
|
+
end
|
|
60
|
+
thread_injection = Thread.new do
|
|
61
|
+
thread_main(config_ingestion_url, proxy_params, MAIN_INJECTION_HOST)
|
|
62
|
+
end
|
|
63
|
+
|
|
64
|
+
wait_for_threads(thread_control, thread_injection)
|
|
65
|
+
|
|
66
|
+
# build and return result
|
|
67
|
+
fallback = Endpoint.new(FALLBACK_ENDPOINT_URL, cert_store)
|
|
68
|
+
endpoints = ChosenEndpoints.new
|
|
69
|
+
endpoints.control = thread_control[:endpoint] || fallback
|
|
70
|
+
endpoints.ingestion = thread_injection[:endpoint] || fallback
|
|
71
|
+
|
|
72
|
+
if thread_control[:endpoint_error]
|
|
73
|
+
msg = AgentMessage.new(CONTROL_ERROR_KIND, thread_control[:endpoint_error])
|
|
74
|
+
endpoints.add_message msg
|
|
75
|
+
end
|
|
76
|
+
if thread_injection[:endpoint_error]
|
|
77
|
+
msg = AgentMessage.new(INGESTION_ERROR_KIND, thread_injection[:endpoint_error])
|
|
78
|
+
endpoints.add_message msg
|
|
79
|
+
end
|
|
80
|
+
|
|
81
|
+
endpoints
|
|
82
|
+
end
|
|
83
|
+
|
|
84
|
+
private
|
|
85
|
+
|
|
86
|
+
def thread_main(configured_url, proxy_params, host)
|
|
87
|
+
res = if configured_url
|
|
88
|
+
Endpoint.new(configured_url, nil)
|
|
89
|
+
else
|
|
90
|
+
EndpointTesting.send(:test_with_store_variants, proxy_params, host)
|
|
91
|
+
end
|
|
92
|
+
|
|
93
|
+
Thread.current[:endpoint] = res
|
|
94
|
+
rescue StandardError => e
|
|
95
|
+
Thread.current[:endpoint_error] = e.message
|
|
96
|
+
end
|
|
97
|
+
|
|
98
|
+
def create_proxy_params(proxy_url)
|
|
99
|
+
return [] unless proxy_url
|
|
100
|
+
|
|
101
|
+
proxy = URI.parse(proxy_url)
|
|
102
|
+
|
|
103
|
+
return [] unless proxy.scheme == 'http'
|
|
104
|
+
|
|
105
|
+
[proxy.host, proxy.port, proxy.user, proxy.password]
|
|
106
|
+
end
|
|
107
|
+
|
|
108
|
+
def test_with_store_variants(proxy_params, server_name)
|
|
109
|
+
# first without custom store
|
|
110
|
+
do_test(proxy_params, server_name, false)
|
|
111
|
+
rescue StandardError => _e
|
|
112
|
+
do_test(proxy_params, server_name, true)
|
|
113
|
+
end
|
|
114
|
+
|
|
115
|
+
# @param [Array] proxy_params
|
|
116
|
+
# @param [String] server_name
|
|
117
|
+
# @param [Boolean] custom_store
|
|
118
|
+
def do_test(proxy_params, server_name, custom_store)
|
|
119
|
+
http = Net::HTTP.new(server_name, 443, *proxy_params)
|
|
120
|
+
http.use_ssl = true
|
|
121
|
+
http.verify_mode = OpenSSL::SSL::VERIFY_NONE if ENV['SQREEN_SSL_NO_VERIFY']
|
|
122
|
+
http.verify_callback = lambda do |preverify_ok, ctx|
|
|
123
|
+
unless preverify_ok
|
|
124
|
+
logger.warn do
|
|
125
|
+
"Certificate validation failure for certificate issued to " \
|
|
126
|
+
"#{ctx.chain[0].subject}: #{ctx.error_string}"
|
|
127
|
+
end
|
|
128
|
+
end
|
|
129
|
+
|
|
130
|
+
preverify_ok
|
|
131
|
+
end
|
|
132
|
+
|
|
133
|
+
http.open_timeout = 13
|
|
134
|
+
http.ssl_timeout = 7
|
|
135
|
+
http.read_timeout = 7
|
|
136
|
+
http.close_on_empty_response = true
|
|
137
|
+
|
|
138
|
+
http.cert_store = cert_store if custom_store
|
|
139
|
+
|
|
140
|
+
resp = http.get('/ping')
|
|
141
|
+
|
|
142
|
+
logger.info do
|
|
143
|
+
"Got response from #{server_name}'s ping endpoint. " \
|
|
144
|
+
"Status code is #{resp.code} (custom CA store: #{custom_store})"
|
|
145
|
+
end
|
|
146
|
+
|
|
147
|
+
unless resp.code == '200'
|
|
148
|
+
raise "Response code for /ping is #{resp.code}, not 200"
|
|
149
|
+
end
|
|
150
|
+
|
|
151
|
+
Endpoint.new("https://#{server_name}/", http.cert_store)
|
|
152
|
+
rescue StandardError => e
|
|
153
|
+
logger.info do
|
|
154
|
+
"Error in request to #{server_name} " \
|
|
155
|
+
"(custom store: #{custom_store}): #{e.message}"
|
|
156
|
+
end
|
|
157
|
+
|
|
158
|
+
raise "Error in request to #{server_name}: #{e.message}"
|
|
159
|
+
end
|
|
160
|
+
|
|
161
|
+
def wait_for_threads(thread_control, thread_injection)
|
|
162
|
+
deadline = Time.now + GLOBAL_TIMEOUT
|
|
163
|
+
[thread_control, thread_injection].each do |thread|
|
|
164
|
+
rem = deadline - Time.now
|
|
165
|
+
rem = 0.1 if rem < 0.1
|
|
166
|
+
next if thread.join(rem)
|
|
167
|
+
logger.debug { "Timeout for thread #{thread}" }
|
|
168
|
+
thread.kill
|
|
169
|
+
thread[:endpoint_error] = "Timeout doing endpoint testing"
|
|
170
|
+
end
|
|
171
|
+
end
|
|
172
|
+
|
|
173
|
+
def cert_store
|
|
174
|
+
@cert_store ||= begin
|
|
175
|
+
cert_file = File.join(File.dirname(__FILE__), 'ca.crt')
|
|
176
|
+
cert_store = OpenSSL::X509::Store.new
|
|
177
|
+
cert_store.add_file cert_file
|
|
178
|
+
|
|
179
|
+
cert_store
|
|
180
|
+
end
|
|
181
|
+
end
|
|
182
|
+
end
|
|
183
|
+
end
|
|
184
|
+
end
|