sqreen 1.20.1-java → 1.21.0.beta3-java
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +5 -5
- data/CHANGELOG.md +16 -0
- data/lib/sqreen/actions/block_user.rb +1 -1
- data/lib/sqreen/actions/redirect_ip.rb +1 -1
- data/lib/sqreen/actions/redirect_user.rb +1 -1
- data/lib/sqreen/attack_detected.html +1 -2
- data/lib/sqreen/condition_evaluator.rb +9 -2
- data/lib/sqreen/conditionable.rb +24 -6
- data/lib/sqreen/configuration.rb +1 -1
- data/lib/sqreen/deferred_logger.rb +50 -14
- data/lib/sqreen/deliveries/batch.rb +8 -1
- data/lib/sqreen/deprecation.rb +38 -0
- data/lib/sqreen/ecosystem.rb +96 -0
- data/lib/sqreen/ecosystem/dispatch_table.rb +43 -0
- data/lib/sqreen/ecosystem/exception_reporting.rb +26 -0
- data/lib/sqreen/ecosystem/http/net_http.rb +50 -0
- data/lib/sqreen/ecosystem/http/rack_request.rb +39 -0
- data/lib/sqreen/ecosystem/loggable.rb +13 -0
- data/lib/sqreen/ecosystem/module_api.rb +30 -0
- data/lib/sqreen/ecosystem/module_api/event_listener.rb +18 -0
- data/lib/sqreen/ecosystem/module_api/instrumentation.rb +23 -0
- data/lib/sqreen/ecosystem/module_api/message_producer.rb +51 -0
- data/lib/sqreen/ecosystem/module_api/signal_producer.rb +24 -0
- data/lib/sqreen/ecosystem/module_api/tracing.rb +45 -0
- data/lib/sqreen/ecosystem/module_api/tracing/client_data.rb +31 -0
- data/lib/sqreen/ecosystem/module_api/tracing/server_data.rb +27 -0
- data/lib/sqreen/ecosystem/module_api/tracing_id_generation.rb +16 -0
- data/lib/sqreen/ecosystem/module_api/transaction_storage.rb +71 -0
- data/lib/sqreen/ecosystem/module_registry.rb +44 -0
- data/lib/sqreen/ecosystem/redis/redis_connection.rb +43 -0
- data/lib/sqreen/ecosystem/tracing/modules/client.rb +31 -0
- data/lib/sqreen/ecosystem/tracing/modules/server.rb +30 -0
- data/lib/sqreen/ecosystem/tracing/sampler.rb +160 -0
- data/lib/sqreen/ecosystem/tracing/sampling_configuration.rb +150 -0
- data/lib/sqreen/ecosystem/tracing/signals/tracing_client.rb +53 -0
- data/lib/sqreen/ecosystem/tracing/signals/tracing_server.rb +53 -0
- data/lib/sqreen/ecosystem/tracing_broker.rb +101 -0
- data/lib/sqreen/ecosystem/tracing_id_setup.rb +34 -0
- data/lib/sqreen/ecosystem/transaction_storage.rb +64 -0
- data/lib/sqreen/ecosystem/util/call_writers_from_init.rb +13 -0
- data/lib/sqreen/ecosystem_integration.rb +87 -0
- data/lib/sqreen/ecosystem_integration/around_callbacks.rb +99 -0
- data/lib/sqreen/ecosystem_integration/instrumentation_service.rb +42 -0
- data/lib/sqreen/ecosystem_integration/request_lifecycle_tracking.rb +58 -0
- data/lib/sqreen/ecosystem_integration/signal_consumption.rb +35 -0
- data/lib/sqreen/events/request_record.rb +0 -1
- data/lib/sqreen/frameworks/generic.rb +24 -1
- data/lib/sqreen/frameworks/rails.rb +0 -7
- data/lib/sqreen/frameworks/request_recorder.rb +2 -0
- data/lib/sqreen/graft/call.rb +106 -19
- data/lib/sqreen/graft/callback.rb +1 -1
- data/lib/sqreen/graft/hook.rb +212 -100
- data/lib/sqreen/graft/hook_point.rb +18 -11
- data/lib/sqreen/legacy/instrumentation.rb +22 -10
- data/lib/sqreen/legacy/old_event_submission_strategy.rb +9 -2
- data/lib/sqreen/log.rb +3 -2
- data/lib/sqreen/log/loggable.rb +1 -0
- data/lib/sqreen/logger.rb +24 -0
- data/lib/sqreen/metrics.rb +1 -0
- data/lib/sqreen/metrics/req_detailed.rb +41 -0
- data/lib/sqreen/metrics_store.rb +11 -0
- data/lib/sqreen/null_logger.rb +22 -0
- data/lib/sqreen/remote_command.rb +4 -0
- data/lib/sqreen/rules.rb +8 -4
- data/lib/sqreen/rules/blacklist_ips_cb.rb +2 -2
- data/lib/sqreen/rules/custom_error_cb.rb +3 -3
- data/lib/sqreen/rules/rule_cb.rb +4 -2
- data/lib/sqreen/rules/waf_cb.rb +3 -3
- data/lib/sqreen/runner.rb +63 -8
- data/lib/sqreen/session.rb +2 -0
- data/lib/sqreen/signals/conversions.rb +6 -1
- data/lib/sqreen/version.rb +1 -1
- data/lib/sqreen/weave/budget.rb +35 -0
- data/lib/sqreen/weave/legacy/instrumentation.rb +274 -132
- data/lib/sqreen/worker.rb +6 -2
- metadata +46 -9
- data/lib/sqreen/encoding_sanitizer.rb +0 -27
@@ -0,0 +1,26 @@
|
|
1
|
+
require 'sqreen/ecosystem/dispatch_table'
|
2
|
+
require 'sqreen/ecosystem/loggable'
|
3
|
+
require 'sqreen/kit/signals/specialized/sqreen_exception'
|
4
|
+
|
5
|
+
module Sqreen
|
6
|
+
module Ecosystem
|
7
|
+
module ExceptionReporting
|
8
|
+
include Loggable
|
9
|
+
|
10
|
+
private
|
11
|
+
|
12
|
+
# @param [String] message
|
13
|
+
# @param [Exception] e
|
14
|
+
def report_exception(message, e)
|
15
|
+
logger.warn { "#{message}: #{e.message}" }
|
16
|
+
logger.debug { e.backtrace.map { |x| " #{x}" }.join("\n") }
|
17
|
+
|
18
|
+
signal = Sqreen::Kit::Signals::Specialized::SqreenException.new(
|
19
|
+
ruby_exception: e
|
20
|
+
)
|
21
|
+
|
22
|
+
DispatchTable.consume_signal signal
|
23
|
+
end
|
24
|
+
end
|
25
|
+
end
|
26
|
+
end
|
@@ -0,0 +1,50 @@
|
|
1
|
+
require 'sqreen/ecosystem/module_api'
|
2
|
+
require 'sqreen/ecosystem/module_api/instrumentation'
|
3
|
+
require 'sqreen/ecosystem/module_api/message_producer'
|
4
|
+
require 'sqreen/ecosystem/module_api/tracing_id_generation'
|
5
|
+
require 'sqreen/ecosystem/module_api/tracing/client_data'
|
6
|
+
|
7
|
+
module Sqreen
|
8
|
+
module Ecosystem
|
9
|
+
module Http
|
10
|
+
class NetHttp
|
11
|
+
class HttpConnectionData
|
12
|
+
include ModuleApi::Tracing::ClientData
|
13
|
+
end
|
14
|
+
|
15
|
+
include ModuleApi::Instrumentation
|
16
|
+
include ModuleApi::MessageProducer
|
17
|
+
include ModuleApi::TracingIdGeneration
|
18
|
+
|
19
|
+
def setup
|
20
|
+
advice = wrap_for_interest(HttpConnectionData, &method(:before_advice))
|
21
|
+
instrument 'Net::HTTP#request', before: advice
|
22
|
+
end
|
23
|
+
|
24
|
+
private
|
25
|
+
|
26
|
+
# instr. def request(req, body = nil, &block) # :yield: +response+
|
27
|
+
# req is of type +Net::HTTPGenericRequest+
|
28
|
+
def before_advice(call, _ball)
|
29
|
+
tracing_id = create_tracing_id
|
30
|
+
|
31
|
+
# build & submit signal
|
32
|
+
host = call.instance.address
|
33
|
+
port = call.instance.port
|
34
|
+
|
35
|
+
# add tracing header
|
36
|
+
req = call.args[0]
|
37
|
+
req[ModuleApi::TRACE_ID_HEADER] = tracing_id
|
38
|
+
|
39
|
+
host += ':' + port.to_s if port != 80 && port != 443
|
40
|
+
|
41
|
+
HttpConnectionData.new(
|
42
|
+
transport: 'http',
|
43
|
+
host: host,
|
44
|
+
tracing_identifier: tracing_id
|
45
|
+
)
|
46
|
+
end
|
47
|
+
end
|
48
|
+
end
|
49
|
+
end
|
50
|
+
end
|
@@ -0,0 +1,39 @@
|
|
1
|
+
require 'sqreen/ecosystem/module_api'
|
2
|
+
require 'sqreen/ecosystem/module_api/event_listener'
|
3
|
+
require 'sqreen/ecosystem/module_api/message_producer'
|
4
|
+
require 'sqreen/ecosystem/module_api/tracing/server_data'
|
5
|
+
|
6
|
+
module Sqreen
|
7
|
+
module Ecosystem
|
8
|
+
module Http
|
9
|
+
class RackRequest
|
10
|
+
class HttpServerData
|
11
|
+
include ModuleApi::Tracing::ServerData
|
12
|
+
end
|
13
|
+
|
14
|
+
include ModuleApi::EventListener
|
15
|
+
include ModuleApi::MessageProducer
|
16
|
+
|
17
|
+
def setup
|
18
|
+
advice = wrap_for_interest(
|
19
|
+
ModuleApi::Tracing::ServerData,
|
20
|
+
&method(:handle_request)
|
21
|
+
)
|
22
|
+
on_request_start(&advice)
|
23
|
+
end
|
24
|
+
|
25
|
+
private
|
26
|
+
|
27
|
+
def handle_request(rack_request)
|
28
|
+
trace_id = rack_request.env[ModuleApi::TRACE_ID_ENV_KEY]
|
29
|
+
|
30
|
+
HttpServerData.new(
|
31
|
+
transport: 'http',
|
32
|
+
client_ip: rack_request.ip,
|
33
|
+
tracing_identifier: trace_id
|
34
|
+
)
|
35
|
+
end
|
36
|
+
end
|
37
|
+
end
|
38
|
+
end
|
39
|
+
end
|
@@ -0,0 +1,30 @@
|
|
1
|
+
require 'sqreen/ecosystem/loggable'
|
2
|
+
|
3
|
+
module Sqreen
|
4
|
+
module Ecosystem
|
5
|
+
# The API that the transport/tracing modules are written against
|
6
|
+
module ModuleApi
|
7
|
+
TRACE_ID_HEADER = 'X-Sqreen-Trace-Identifier'.freeze
|
8
|
+
TRACE_ID_ENV_KEY = 'HTTP_X_SQREEN_TRACE_IDENTIFIER'.freeze
|
9
|
+
|
10
|
+
Loggable = Sqreen::Ecosystem::Loggable
|
11
|
+
|
12
|
+
module ClassMethods
|
13
|
+
attr_writer :module_name
|
14
|
+
|
15
|
+
def module_name
|
16
|
+
if instance_variable_defined?(:@module_name)
|
17
|
+
@module_name
|
18
|
+
else
|
19
|
+
# to snake case
|
20
|
+
@module_name = to_s.sub(/.*::/, '').gsub(/([a-z])([A-Z])/, '\1_\2').downcase
|
21
|
+
end
|
22
|
+
end
|
23
|
+
end
|
24
|
+
|
25
|
+
def self.included(mod)
|
26
|
+
mod.extend(ClassMethods)
|
27
|
+
end
|
28
|
+
end
|
29
|
+
end
|
30
|
+
end
|
@@ -0,0 +1,18 @@
|
|
1
|
+
require 'sqreen/ecosystem/dispatch_table'
|
2
|
+
|
3
|
+
module Sqreen
|
4
|
+
module Ecosystem
|
5
|
+
module ModuleApi
|
6
|
+
module EventListener
|
7
|
+
private
|
8
|
+
|
9
|
+
# XXX: callbacks need to be wrapped in order ot handle
|
10
|
+
# perfcap, exceptions, and maybe other concerns applying
|
11
|
+
# across the board
|
12
|
+
def on_request_start(&cb)
|
13
|
+
DispatchTable.add_request_start_listener.call(cb)
|
14
|
+
end
|
15
|
+
end
|
16
|
+
end
|
17
|
+
end
|
18
|
+
end
|
@@ -0,0 +1,23 @@
|
|
1
|
+
require 'sqreen/ecosystem/module_api'
|
2
|
+
|
3
|
+
module Sqreen
|
4
|
+
module Ecosystem
|
5
|
+
module ModuleApi
|
6
|
+
module Instrumentation
|
7
|
+
def self.included(mod)
|
8
|
+
mod.send :include, ModuleApi unless mod.ancestors.include?(ModuleApi)
|
9
|
+
end
|
10
|
+
|
11
|
+
private
|
12
|
+
|
13
|
+
# Just forwards the call to the instrumentation service
|
14
|
+
# @param [String] method
|
15
|
+
# @param [Hash{Symbol=>Proc}] advice keys are one of: :before, :after,
|
16
|
+
# :raised,
|
17
|
+
def instrument(method, advice)
|
18
|
+
DispatchTable.instrument.call(self.class.module_name, method, advice)
|
19
|
+
end
|
20
|
+
end
|
21
|
+
end
|
22
|
+
end
|
23
|
+
end
|
@@ -0,0 +1,51 @@
|
|
1
|
+
require 'sqreen/ecosystem/loggable'
|
2
|
+
|
3
|
+
module Sqreen
|
4
|
+
module Ecosystem
|
5
|
+
module ModuleApi
|
6
|
+
module MessageProducer
|
7
|
+
include Loggable
|
8
|
+
|
9
|
+
# method for ecosystem to inject the config
|
10
|
+
# @param [Sqreen::Ecosystem::TracingBroker]
|
11
|
+
attr_writer :tracing_broker
|
12
|
+
|
13
|
+
private
|
14
|
+
|
15
|
+
def determine_interest(type, hints = {})
|
16
|
+
@tracing_broker.interested_consumers(type, hints)
|
17
|
+
end
|
18
|
+
|
19
|
+
def publish(data, interested)
|
20
|
+
@tracing_broker.publish(data, interested)
|
21
|
+
end
|
22
|
+
|
23
|
+
# Convenience wrapper.
|
24
|
+
# Wraps a callback, skipping it if there is no interest in the type
|
25
|
+
# produced and submitting the return value as a message to the
|
26
|
+
# tracing broker
|
27
|
+
def wrap_for_interest(type, gen_hints = nil, &block)
|
28
|
+
raise ArgumentError, 'no block passed' if block.nil?
|
29
|
+
|
30
|
+
proc do |*args|
|
31
|
+
hints = gen_hints[*args] if gen_hints
|
32
|
+
interested = determine_interest(type, hints || {})
|
33
|
+
|
34
|
+
unless interested
|
35
|
+
logger.debug { "No interested consumers in #{type}" }
|
36
|
+
next
|
37
|
+
end
|
38
|
+
|
39
|
+
res = block[*args]
|
40
|
+
|
41
|
+
next if res.nil?
|
42
|
+
|
43
|
+
raise 'unexpected return type' unless res.is_a?(type)
|
44
|
+
|
45
|
+
@tracing_broker.publish(res, interested)
|
46
|
+
end
|
47
|
+
end
|
48
|
+
end
|
49
|
+
end
|
50
|
+
end
|
51
|
+
end
|
@@ -0,0 +1,24 @@
|
|
1
|
+
require 'sqreen/ecosystem/dispatch_table'
|
2
|
+
|
3
|
+
module Sqreen
|
4
|
+
module Ecosystem
|
5
|
+
module ModuleApi
|
6
|
+
module SignalProducer
|
7
|
+
# for injection
|
8
|
+
# callable taking no arguments and generating a tracing id
|
9
|
+
attr_writer :tracing_id_producer
|
10
|
+
|
11
|
+
private
|
12
|
+
|
13
|
+
def create_tracing_id
|
14
|
+
@tracing_id_producer.call
|
15
|
+
end
|
16
|
+
|
17
|
+
# @param [Sqreen::Kit::Signals::Signal] signal
|
18
|
+
def submit_signal(signal)
|
19
|
+
DispatchTable.consume_signal.call(signal)
|
20
|
+
end
|
21
|
+
end
|
22
|
+
end
|
23
|
+
end
|
24
|
+
end
|
@@ -0,0 +1,45 @@
|
|
1
|
+
require 'sqreen/ecosystem/module_api/signal_producer'
|
2
|
+
|
3
|
+
module Sqreen
|
4
|
+
module Ecosystem
|
5
|
+
module ModuleApi
|
6
|
+
module Tracing
|
7
|
+
include SignalProducer
|
8
|
+
|
9
|
+
def self.included(mod)
|
10
|
+
mod.extend(ClassMethods)
|
11
|
+
end
|
12
|
+
|
13
|
+
module ClassMethods
|
14
|
+
private
|
15
|
+
|
16
|
+
# @param [Module] type The type the including module is interested in
|
17
|
+
def consumes(type)
|
18
|
+
@consumes = type
|
19
|
+
end
|
20
|
+
|
21
|
+
# A fixed (non-virtual) scope for this tracing module
|
22
|
+
# @param [String] scope
|
23
|
+
def fixed_scope(scope)
|
24
|
+
@fixed_scope = scope
|
25
|
+
end
|
26
|
+
end
|
27
|
+
|
28
|
+
def consumed_type
|
29
|
+
self.class.instance_variable_get(:@consumes) \
|
30
|
+
|| raise('@consumes not specified')
|
31
|
+
end
|
32
|
+
|
33
|
+
def scope(_hints = {})
|
34
|
+
self.class.instance_variable_get(:@fixed_scope) \
|
35
|
+
|| raise('@fixed_scope not set')
|
36
|
+
end
|
37
|
+
|
38
|
+
# including class must implement it
|
39
|
+
def receive(_data)
|
40
|
+
raise NotImplementedError
|
41
|
+
end
|
42
|
+
end
|
43
|
+
end
|
44
|
+
end
|
45
|
+
end
|
@@ -0,0 +1,31 @@
|
|
1
|
+
require 'sqreen/ecosystem/util/call_writers_from_init'
|
2
|
+
|
3
|
+
module Sqreen
|
4
|
+
module Ecosystem
|
5
|
+
module ModuleApi
|
6
|
+
module Tracing
|
7
|
+
# The data the tracing module needs in order to populate
|
8
|
+
# +Sqreen::Ecosystem::Tracing::Signals::TracingClient::Payload+
|
9
|
+
#
|
10
|
+
# Signals are not produced by the data producers (transport)
|
11
|
+
# because of superior orders, as the only current use of this
|
12
|
+
# data is to generate signals.
|
13
|
+
module ClientData
|
14
|
+
include Util::CallWritersFromInit
|
15
|
+
|
16
|
+
# @return [Symbol]
|
17
|
+
attr_accessor :transport
|
18
|
+
|
19
|
+
# @return [String]
|
20
|
+
attr_accessor :host
|
21
|
+
|
22
|
+
# @return [String]
|
23
|
+
attr_accessor :ip
|
24
|
+
|
25
|
+
# @return [String]
|
26
|
+
attr_accessor :tracing_identifier
|
27
|
+
end
|
28
|
+
end
|
29
|
+
end
|
30
|
+
end
|
31
|
+
end
|
@@ -0,0 +1,27 @@
|
|
1
|
+
require 'sqreen/ecosystem/util/call_writers_from_init'
|
2
|
+
|
3
|
+
module Sqreen
|
4
|
+
module Ecosystem
|
5
|
+
module ModuleApi
|
6
|
+
module Tracing
|
7
|
+
# The data the tracing module needs in order to populate
|
8
|
+
# +Sqreen::Ecosystem::Tracing::Signals::TracingServer::Payload+
|
9
|
+
module ServerData
|
10
|
+
include Util::CallWritersFromInit
|
11
|
+
|
12
|
+
# @return [Symbol]
|
13
|
+
attr_accessor :transport
|
14
|
+
|
15
|
+
# @return [String]
|
16
|
+
attr_accessor :client_ip
|
17
|
+
|
18
|
+
# @return [Array<String>]
|
19
|
+
attr_accessor :previous_hops
|
20
|
+
|
21
|
+
# @return [String]
|
22
|
+
attr_accessor :tracing_identifier
|
23
|
+
end
|
24
|
+
end
|
25
|
+
end
|
26
|
+
end
|
27
|
+
end
|
@@ -0,0 +1,71 @@
|
|
1
|
+
require 'sqreen/ecosystem/transaction_storage'
|
2
|
+
require 'sqreen/ecosystem/loggable'
|
3
|
+
|
4
|
+
module Sqreen
|
5
|
+
module Ecosystem
|
6
|
+
module ModuleApi
|
7
|
+
module TransactionStorage
|
8
|
+
class TxLocalVariables
|
9
|
+
class << self
|
10
|
+
class << self
|
11
|
+
include Sqreen::Ecosystem::Loggable
|
12
|
+
|
13
|
+
private
|
14
|
+
|
15
|
+
def attr_reader(attr, _opts = {})
|
16
|
+
define_method attr do
|
17
|
+
tx_storage = Ecosystem::TransactionStorage.fetch_thread_local
|
18
|
+
return unless tx_storage
|
19
|
+
tx_storage[attr]
|
20
|
+
end
|
21
|
+
end
|
22
|
+
|
23
|
+
def attr_accessor(attr, opts = {})
|
24
|
+
# reader
|
25
|
+
attr_reader attr, opts
|
26
|
+
|
27
|
+
# writer (2 variants)
|
28
|
+
do_assign = proc do |value|
|
29
|
+
tx_storage = Ecosystem::TransactionStorage.fetch_thread_local
|
30
|
+
unless tx_storage
|
31
|
+
logger.debug do
|
32
|
+
"Assignment of tx local attribute #{attr} to #{value} has no effect"
|
33
|
+
end
|
34
|
+
return
|
35
|
+
end
|
36
|
+
|
37
|
+
tx_storage[attr] = value
|
38
|
+
end
|
39
|
+
|
40
|
+
if opts.fetch(:allow_overwrite, false)
|
41
|
+
define "#{attr}=", &do_assign
|
42
|
+
else
|
43
|
+
define_method "#{attr}=" do |value|
|
44
|
+
cur = public_send(attr)
|
45
|
+
unless cur.nil?
|
46
|
+
raise "Cannot override value of #{attr} from #{cur} with #{value}"
|
47
|
+
end
|
48
|
+
|
49
|
+
do_assign.call(value)
|
50
|
+
end
|
51
|
+
end
|
52
|
+
end
|
53
|
+
end # TxLocalVariables.singleton_class.singleton_class
|
54
|
+
|
55
|
+
# usage:
|
56
|
+
# attr_reader :xxx
|
57
|
+
|
58
|
+
# in the future, we'll possibly need to expose the full
|
59
|
+
# TransactionStorage to the modules, at least if we don't
|
60
|
+
# opt for a more structured fashion of data exchange between
|
61
|
+
# the modules.
|
62
|
+
end # TxLocalVariables.singleton_class
|
63
|
+
end # TxLocalVariables
|
64
|
+
|
65
|
+
def tx_local_vars
|
66
|
+
TxLocalVariables
|
67
|
+
end
|
68
|
+
end # TransactionStorage module
|
69
|
+
end
|
70
|
+
end
|
71
|
+
end
|