sqreen 1.20.3 → 1.20.4.beta1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4bdcf1837e4c2ea45300af52682c98574d0c007703b507a469aeced98088bbda
-  data.tar.gz: df2416f673ff51cf73b4056da0148738eb0f162bc054fba7480ce2d8ca05ea49
+  metadata.gz: 18fc090589982cc7e09d74263a3bbb17ae9180f00afd8425c47498a0f8b75e36
+  data.tar.gz: 074c3c9cad84ef1a52e6fd7ce1a4db5431920f59298e5b930206ca9a996141e9
 SHA512:
-  metadata.gz: bc5df95d6ddff6c1a45b469dc42a0d18b17a804d0fbeb3689361db8583ad421b3ed1a9b823ec24b88f3494f5192865bd1f4c4dfde28c61fdf15d1fa4d06603bc
-  data.tar.gz: 16980a1f0934e7f29251d0c72d751108ddf033c15f7860bd9f63a66b1ff6a5bc367f99d64faef3955015248ee16df882b44db2040f8e4aa84054a82c1ea18397
+  metadata.gz: afd27c8a52c0c5e21685b9bf6b346a28ca43ff297c529c1976d7197bc132d51a92f2ac52dcb4de150cd8c752c4875b4fdd3baf8e59560a0c1952c4df12585572
+  data.tar.gz: 2e6d09aceaf1dcc351537b0a34e4459e7f1d4659a231cd515e6f01ec42f0515dc40ff89f14adb7094a6971f86fe3983e984bf35f8242b8f047405c164ef0874c

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 1.20.4.beta1
+
+* Add optional dynamic time budget
+* Add advanced per request metrics
+* Improve robustness against exception in instrumentation
+* Improve metric engine thread safety
+* Restrict deferred logger to final logger severity on agent boot
+
 ## 1.20.3
 
 * Fix signature check

data/lib/sqreen/actions/block_user.rb

@@ -22,7 +22,7 @@ module Sqreen
       end
 
       def do_run(identity_params)
-        Sqreen.log.info(
+        Sqreen.log.debug(
           "Will raise due to user being blocked by action #{id}. " \
           "Blocked user identity: #{identity_params}"
         )

data/lib/sqreen/actions/redirect_ip.rb

@@ -25,7 +25,7 @@ module Sqreen
       end
 
       def do_run(client_ip)
-        Sqreen.log.info "Will request redirect for client with IP #{client_ip} " \
+        Sqreen.log.debug "Will request redirect for client with IP #{client_ip} " \
           "(action: #{id})."
         {
           :status => :skip,

data/lib/sqreen/actions/redirect_user.rb

@@ -24,7 +24,7 @@ module Sqreen
       end
 
       def do_run(identity_params)
-        Sqreen.log.info 'Will request redirect for user with identity ' \
+        Sqreen.log.debug 'Will request redirect for user with identity ' \
           "#{identity_params} (action: #{id})."
 
         e = Sqreen::AttackBlocked.new(

data/lib/sqreen/configuration.rb

@@ -57,7 +57,7 @@ module Sqreen
     { :env => :SQREEN_RULES_SIGNATURE, :name => :rules_verify_signature,
       :default => true },
     { :env => :SQREEN_LOG_LEVEL, :name => :log_level,
-      :default => 'WARN', :choice => %w[UNKNOWN FATAL ERROR WARN INFO DEBUG] },
+      :default => 'INFO', :choice => %w[UNKNOWN FATAL ERROR WARN INFO DEBUG] },
     { :env => :SQREEN_LOG_LOCATION, :name => :log_location,
       :default => 'log/sqreen.log' },
     { :env => :SQREEN_RUN_IN_TEST, :name => :run_in_test,

data/lib/sqreen/deferred_logger.rb

@@ -9,39 +9,70 @@ require 'sqreen/logger'
 
 module Sqreen
   class DeferredLogger
-    include Singleton
+    MAX_ENTRIES = 1000
+
+    Entry = Struct.new(:severity, :message)
 
     def initialize
       @buffer = StringIO.new
       @logger = ::Logger.new(@buffer)
+      @entries = []
+      @mutex = Mutex.new
     end
 
     def debug?
       true
     end
 
+    def info?
+      true
+    end
+
+    def warn?
+      true
+    end
+
+    def error?
+      true
+    end
+
+    def fatal?
+      true
+    end
+
     def debug(msg = nil, &block)
-      @logger.debug(msg, &block)
+      add(::Logger::DEBUG, msg, &block)
     end
 
     def info(msg = nil, &block)
-      @logger.info(msg, &block)
+      add(::Logger::INFO, msg, &block)
     end
 
     def warn(msg = nil, &block)
-      @logger.warn(msg, &block)
+      add(::Logger::WARN, msg, &block)
     end
 
     def error(msg = nil, &block)
-      @logger.error(msg, &block)
+      add(::Logger::ERROR, msg, &block)
     end
 
     def fatal(msg = nil, &block)
-      @logger.error(msg, &block)
+      add(::Logger::FATAL, msg, &block)
+    end
+
+    def unknown(msg = nil, &block)
+      add(::Logger::UNKNOWN, msg, &block)
     end
 
     def add(severity, msg = nil, &block)
-      send(Sqreen::Logger::SEVERITY_TO_METHOD[severity], msg, &block)
+      @mutex.synchronize do
+        @entries.shift if @entries.count >= MAX_ENTRIES
+        mark = @buffer.pos
+        @logger.add(severity, msg, &block)
+        @buffer.seek(mark)
+        @entries << Entry.new(severity, @buffer.read)
+        @buffer.truncate(0)
+      end
     end
 
     def formatter=(value)
@@ -49,21 +80,22 @@ module Sqreen
     end
 
     def flush_to(logger)
-      logger.instance_eval { @logdev }.write(read).tap { reset }
+      @mutex.synchronize do
+        @entries.each do |entry|
+          next if entry.severity < logger.level
+          logger.instance_eval { @logdev }.write(entry.message)
+        end
+        reset
+      end
     end
 
     private
 
-    def read
-      @buffer.rewind
-      @buffer.read
-    end
-
     def reset
       buffer = StringIO.new
       logger = ::Logger.new(buffer)
       logger.formatter = @logger.formatter
-      @buffer, @logger = buffer, logger
+      @buffer, @logger, @entries = buffer, logger, []
     end
   end
 end

data/lib/sqreen/deprecation.rb

@@ -0,0 +1,38 @@
+# typed: strong
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
+require 'sqreen/log/loggable'
+
+module Sqreen
+  module Deprecation
+    include Sqreen::Log::Loggable
+
+    module_function
+
+    def deprecate(method)
+      return unless ENV['SQREEN_DEBUG_DEPRECATION']
+
+      owner = method.owner
+      deprecated = :"_deprecated_#{method.name}"
+      klass = owner.is_a?(Module)
+      target = klass ? owner.to_s : owner.class.to_s
+
+      method.owner.instance_eval do
+        alias_method deprecated, method.name
+
+        define_method(method.name) do |*args, &block|
+          msg = [
+            "deprecation",
+            "target:#{target}",
+            "method:#{method.name}",
+            "caller:#{Kernel.caller_locations[0]}",
+          ].join(' ')
+          Sqreen::Deprecation.logger.info(msg)
+          send(deprecated, *args, &block)
+        end
+      end
+    end
+  end
+end

data/lib/sqreen/frameworks/generic.rb

@@ -209,7 +209,16 @@ module Sqreen
 
       # Should the agent not be starting up?
       def prevent_startup
+        # SQREEN-880 - prevent Sqreen startup on Sidekiq workers
+        return :sidekiq_cli if defined?(Sidekiq::CLI)
+        return :delayed_job if defined?(Delayed::Command)
+
+        # Prevent Sqreen startup on rake tasks - unless this is a Sqreen test
+        run_in_test = sqreen_configuration.get(:run_in_test)
+        return :rake if !run_in_test && $0.end_with?('rake')
+
         return :irb if $0 == 'irb'
+
         return if sqreen_configuration.nil?
         disable = sqreen_configuration.get(:disable)
         return :config_disable if disable == true || disable.to_s.to_i == 1

data/lib/sqreen/frameworks/rails.rb

@@ -103,13 +103,6 @@ module Sqreen
         run_in_test = sqreen_configuration.get(:run_in_test)
         return :rails_test if !run_in_test && (Rails.env.test? || Rails.env.cucumber?)
 
-        # SQREEN-880 - prevent Sqreen startup on Sidekiq workers
-        return :sidekiq_cli if defined?(Sidekiq::CLI)
-        return :delayed_job if defined?(Delayed::Command)
-
-        # Prevent Sqreen startup on rake tasks - unless this is a Sqreen test
-        return :rake if !run_in_test && $0.end_with?('rake')
-
         return nil unless defined?(Rails::CommandsTasks)
         return nil if defined?(Rails::Server)
         return :rails_console    if defined?(Rails::Console)

data/lib/sqreen/graft/call.rb

@@ -93,62 +93,106 @@ module Sqreen
       end
     end
 
+    class TimerError < StandardError; end
+
     class Timer
       def self.read
         Process.clock_gettime(Process::CLOCK_MONOTONIC)
       end
 
-      attr_reader :tag, :size, :duration
+      attr_reader :tag, :size
 
       def initialize(tag, &block)
         @tag = tag
         @block = block
-        @duration = 0
+        @tally = 0
         @size = 0
       end
 
       def elapsed
-        @duration + Timer.read
+        raise(TimerError, 'Timer#elapsed when paused') if @size.even?
+
+        @tally + Timer.read
+      end
+
+      def duration
+        raise(TimerError, 'Timer#duration when running') if @size.odd?
+
+        @tally
       end
 
       def ignore
+        raise(TimerError, 'Timer#ignore when paused') if @size.even?
+
         @size += 1
-        @duration += Timer.read
+        @tally += Timer.read
         yield(self)
       ensure
         @size += 1
-        @duration -= Timer.read
+        @tally -= Timer.read
       end
 
       def measure(opts = nil)
+        raise(TimerError, 'Timer#measure when running') if @size.odd?
+
         now = Timer.read
+
         ignore = opts[:ignore] if opts
         if ignore
           ignore.size += 1
-          ignore.duration += now
+          ignore.tally += now
         end
+
         @size += 1
-        @duration -= now
+        @tally -= now
+
         yield(self)
       ensure
         now = Timer.read
+
         if ignore
           ignore.size += 1
-          ignore.duration -= now
+          ignore.tally -= now
         end
+
         @size += 1
-        @duration += now
+        @tally += now
+
         @block.call(self) if @block
       end
 
-      def start
+      def start(at = Timer.read)
+        raise(TimerError, 'Timer#start when started') unless @size.even?
+
         @size += 1
-        @duration -= Timer.read
+        @tally -= at
+
+        at
       end
 
-      def stop
+      def stop(at = Timer.read)
+        raise(TimerError, 'Timer#stop when unstarted') unless @size.odd?
+
         @size += 1
-        @duration += Timer.read
+        @tally += at
+
+        at
+      end
+
+      def started?
+        @size != 0 && @size.odd?
+      end
+
+      def stopped?
+        @size != 0 && @size.even?
+      end
+
+      def running?
+        @size.odd?
+      end
+
+      def paused?
+        @size.even?
       end
 
       def to_s
@@ -157,7 +201,8 @@ module Sqreen
 
       protected
 
-      attr_writer :size, :duration
+      attr_reader :tally
+      attr_writer :size, :tally
     end
   end
 end

data/lib/sqreen/graft/hook.rb

@@ -21,6 +21,13 @@ module Sqreen
         self[hook_point, strategy].add(&block)
       end
 
+      def self.ignore
+        Thread.current[:sqreen_hook_entered] = true
+        yield
+      ensure
+        Thread.current[:sqreen_hook_entered] = false
+      end
+
       attr_reader :point
 
       def initialize(hook_point, dependency_test = nil, strategy = :chain)
@@ -113,18 +120,25 @@ module Sqreen
         @before = []
         @after = []
         @raised = []
+        @ensured = []
       end
 
       def self.wrapper(hook)
         timed_hooks_proc = proc do |t|
-          Thread.current[:sqreen_http_request] && Thread.current[:sqreen_http_request][:timed_hooks] << t
+          if (request = Thread.current[:sqreen_http_request])
+            request[:timed_hooks] << t if request[:timed_level] >= 1
+          end
         end
         timed_callbacks_proc = proc do |t|
-          Thread.current[:sqreen_http_request] && Thread.current[:sqreen_http_request][:timed_callbacks] << t
+          if (request = Thread.current[:sqreen_http_request])
+            request[:timed_callbacks] << t if request[:timed_level] >= 1
+          end
         end
 
         Proc.new do |*args, &block|
-          if Thread.current[:sqreen_hook_entered] || Thread.current[:sqreen_http_request] && Thread.current[:sqreen_http_request][:time_budget_expended]
+          request = Thread.current[:sqreen_http_request]
+
+          if Thread.current[:sqreen_hook_entered]
             if hook.point.super?
               return super(*args, &block)
             else
@@ -132,60 +146,108 @@ module Sqreen
             end
           end
 
+          if request && request[:time_budget_expended] && (hook.before + hook.after + hook.raised + hook.ensured).none?(&:mandatory)
+            if request[:timed_level] >= 2
+              begin
+                request[:skipped_callbacks].concat(hook.before)
+
+                if hook.point.super?
+                  return super(*args, &block)
+                else
+                  return hook.point.apply(self, 'sqreen_hook', *args, &block)
+                end
+              rescue ::Exception # rubocop:disable Lint/RescueException
+                request[:skipped_callbacks].concat(hook.raised)
+                raise
+              else
+                request[:skipped_callbacks].concat(hook.after)
+              ensure
+                request[:skipped_callbacks].concat(hook.ensured)
+              end
+            else
+              if hook.point.super? # rubocop:disable Style/IfInsideElse
+                return super(*args, &block)
+              else
+                return hook.point.apply(self, 'sqreen_hook', *args, &block)
+              end
+            end
+          end
+
           hook_point_super = hook.point.super?
           logger = Sqreen::Graft.logger
           logger_debug = Sqreen::Graft.logger.debug?
 
           Timer.new(hook.point, &timed_hooks_proc).measure do |chrono|
-            logger.debug { "[#{Process.pid}] Hook #{hook.point} disabled:#{hook.disabled?} caller:#{Kernel.caller[2].inspect}" } if logger_debug
+            # budget implies request
+            # TODO: make budget depend on a generic context (currently "request")
+            budget = request[:time_budget] if request
+            if budget
+              budget_threshold = request[:time_budget_threshold]
+              budget_ratio = request[:time_budget_ratio]
+              sqreen_timer = request[:sqreen_timer]
+              request_timer = request[:request_timer]
+            end
 
-            budget = Thread.current[:sqreen_http_request] && Thread.current[:sqreen_http_request][:time_budget]
-            timer = Thread.current[:sqreen_http_request] && Thread.current[:sqreen_http_request][:timer] if budget
             hooked_call = HookedCall.new(self, args)
 
             begin
-              timer.start if timer
-              Thread.current[:sqreen_hook_entered] = true
-
-              # TODO: make Call have #ball to throw by cb
-              # TODO: can Call be the ball? r = catch(Call.new, &c)
-              # TODO: is catch return value a Call? a #dispatch?
-              # TODO: make before/after/raised return a CallbackCollection << Array (or extend with module)
-              # TODO: add CallbackCollection#each_with_call(instance, args) { |call| ... } ?
-              # TODO: HookCall x CallbackCollection#each_with_call x Flow
-              # TODO: TimedHookCall TimedCallbackCall
-              # TODO: TimeBoundHookCall TimeBoundCallbackCall TimeBoundFlow?
-
-              hook.before.each do |c|
-                next if c.ignore && c.ignore.call
-
-                if timer && !c.mandatory
-                  remaining = budget - timer.elapsed
-                  unless remaining > 0
-                    Thread.current[:sqreen_http_request] && Thread.current[:sqreen_http_request][:skipped_callbacks] << c && Thread.current[:sqreen_http_request][:time_budget_expended] = true
-                    next
+              begin
+                sqreen_timer.start if budget
+                Thread.current[:sqreen_hook_entered] = true
+
+                # TODO: make Call have #ball to throw by cb
+                # TODO: can Call be the ball? r = catch(Call.new, &c)
+                # TODO: is catch return value a Call? a #dispatch?
+                # TODO: make before/after/raised return a CallbackCollection << Array (or extend with module)
+                # TODO: add CallbackCollection#each_with_call(instance, args) { |call| ... } ?
+                # TODO: HookCall x CallbackCollection#each_with_call x Flow
+                # TODO: TimedHookCall TimedCallbackCall
+                # TODO: TimeBoundHookCall TimeBoundCallbackCall TimeBoundFlow?
+
+                request_elapsed = request_timer.elapsed if budget
+
+                hook.before.each do |c|
+                  next if c.ignore && c.ignore.call
+
+                  if budget && !c.mandatory
+                    sqreen_elapsed = sqreen_timer.elapsed
+                    if budget_ratio && !request[:time_budget_expended]
+                      fixed_budget = budget_threshold
+                      proportional_budget = (request_elapsed - sqreen_elapsed) * budget_ratio
+                      remaining = (fixed_budget > proportional_budget ? fixed_budget : proportional_budget) - sqreen_elapsed
+                    else
+                      remaining = budget_threshold - sqreen_elapsed
+                    end
+                    unless remaining > 0
+                      request[:skipped_callbacks] << c
+                      request[:time_budget_expended] = true
+                      next
+                    end
                   end
-                end
 
-                flow = catch(Ball.new) do |ball|
-                  Timer.new(c.name, &timed_callbacks_proc).measure(ignore: chrono) do
-                    c.call(CallbackCall.new(c, remaining, hooked_call.instance, hooked_call.args_passed), ball)
+                  flow = catch(Ball.new) do |ball|
+                    Timer.new(c.name, &timed_callbacks_proc).measure(ignore: chrono) do
+                      c.call(CallbackCall.new(c, remaining, hooked_call.instance, hooked_call.args_passed), ball)
+                    end
                   end
-                end
 
-                next unless c.flow && flow.is_a?(Flow)
-                hooked_call.raise = flow.raise and hooked_call.raising = true if flow.raise?
-                hooked_call.args_pass = flow.args and hooked_call.args_passing = true if flow.args?
-                hooked_call.return = flow.return and hooked_call.returning = true if flow.return?
-                break if flow.break?
-              end unless hook.disabled?
+                  next unless c.flow && flow.is_a?(Flow)
+                  hooked_call.raise = flow.raise and hooked_call.raising = true if flow.raise?
+                  hooked_call.args_pass = flow.args and hooked_call.args_passing = true if flow.args?
+                  hooked_call.return = flow.return and hooked_call.returning = true if flow.return?
+                  break if flow.break?
+                end unless hook.disabled?
+              rescue StandardError => e
+                Sqreen::Weave.logger.debug { "exception:#{e.class} message:'#{e.message}' location:\"#{e.backtrace[0]}\"" }
+                Sqreen::RemoteException.record(e) if Sqreen.queue
+              end
 
               raise hooked_call.raise if hooked_call.raising
               return hooked_call.return if hooked_call.returning
             ensure
               Thread.current[:sqreen_hook_entered] = false
-              timer.stop if timer
-            end
+              sqreen_timer.stop if budget
+            end unless hook.before.empty?
 
             begin
               chrono.ignore do
@@ -196,98 +258,157 @@ module Sqreen
                 end
               end
             rescue ::Exception => e # rubocop:disable Lint/RescueException
-              timer.start if timer
-              Thread.current[:sqreen_hook_entered] = true
-              hooked_call.raised = e
-
-              logger.debug { "[#{Process.pid}] Hook #{hook.point} disabled:#{hook.disabled?} exception:#{e}" } if logger_debug
-              raise if hook.raised.empty?
-
-              hook.raised.each do |c|
-                next if c.ignore && c.ignore.call
-
-                if timer && !c.mandatory
-                  remaining = budget - timer.elapsed
-                  unless remaining > 0
-                    Thread.current[:sqreen_http_request] && Thread.current[:sqreen_http_request][:skipped_callbacks] << c && Thread.current[:sqreen_http_request][:time_budget_expended] = true
-                    next
+              begin
+                sqreen_timer.start if budget
+                Thread.current[:sqreen_hook_entered] = true
+                hooked_call.raised = e
+
+                logger.debug { "[#{Process.pid}] Hook #{hook.point} disabled:#{hook.disabled?} exception:#{e}" } if logger_debug
+                raise if hook.raised.empty?
+
+                request_elapsed = request_timer.elapsed if budget
+
+                hook.raised.each do |c|
+                  next if c.ignore && c.ignore.call
+
+                  if budget && !c.mandatory
+                    sqreen_elapsed = sqreen_timer.elapsed
+                    if budget_ratio && !request[:time_budget_expended]
+                      fixed_budget = budget_threshold
+                      proportional_budget = (request_elapsed - sqreen_elapsed) * budget_ratio
+                      remaining = (fixed_budget > proportional_budget ? fixed_budget : proportional_budget) - sqreen_elapsed
+                    else
+                      remaining = budget_threshold - sqreen_elapsed
+                    end
+                    unless remaining > 0
+                      request[:skipped_callbacks] << c
+                      request[:time_budget_expended] = true
+                      next
+                    end
                   end
-                end
 
-                flow = catch(Ball.new) do |ball|
-                  Timer.new(c.name, &timed_callbacks_proc).measure(ignore: chrono) do
-                    c.call(CallbackCall.new(c, remaining, hooked_call.instance, hooked_call.args_passing ? hooked_call.args_pass : hooked_call.args_passed, hooked_call.raised), ball)
+                  flow = catch(Ball.new) do |ball|
+                    Timer.new(c.name, &timed_callbacks_proc).measure(ignore: chrono) do
+                      c.call(CallbackCall.new(c, remaining, hooked_call.instance, hooked_call.args_passing ? hooked_call.args_pass : hooked_call.args_passed, hooked_call.raised), ball)
+                    end
                   end
-                end
 
-                next unless c.flow && flow.is_a?(Flow)
-                hooked_call.raise = flow.raise and hooked_call.raising = true if flow.raise?
-                hooked_call.return = flow.return and hooked_call.returning = true if flow.return?
-                hooked_call.retrying = true if flow.retry?
-                break if flow.break?
-              end unless hook.disabled?
+                  next unless c.flow && flow.is_a?(Flow)
+                  hooked_call.raise = flow.raise and hooked_call.raising = true if flow.raise?
+                  hooked_call.return = flow.return and hooked_call.returning = true if flow.return?
+                  hooked_call.retrying = true if flow.retry?
+                  break if flow.break?
+                end unless hook.disabled?
+              rescue StandardError => e
+                Sqreen::Weave.logger.debug { "exception:#{e.class} message:'#{e.message}' location:\"#{e.backtrace[0]}\"" }
+                Sqreen::RemoteException.record(e) if Sqreen.queue
+              end
 
               retry if hooked_call.retrying
               raise hooked_call.raise if hooked_call.raising
               return hooked_call.return if hooked_call.returning
               raise
             else
-              timer.start if timer
-              Thread.current[:sqreen_hook_entered] = true
-
-              hook.after.each do |c|
-                next if c.ignore && c.ignore.call
-
-                if timer && !c.mandatory
-                  remaining = budget - timer.elapsed
-                  unless remaining > 0
-                    Thread.current[:sqreen_http_request] && Thread.current[:sqreen_http_request][:skipped_callbacks] << c && Thread.current[:sqreen_http_request][:time_budget_expended] = true
-                    next
+              begin
+                sqreen_timer.start if budget
+                Thread.current[:sqreen_hook_entered] = true
+
+                # TODO: hooked_call.returning should be always false here?
+                return hooked_call.returning ? hooked_call.return : hooked_call.returned if hook.after.empty?
+
+                request_elapsed = request_timer.elapsed if budget
+
+                hook.after.each do |c|
+                  next if c.ignore && c.ignore.call
+
+                  if budget && !c.mandatory
+                    sqreen_elapsed = sqreen_timer.elapsed
+                    if budget_ratio && !request[:time_budget_expended]
+                      fixed_budget = budget_threshold
+                      proportional_budget = (request_elapsed - sqreen_elapsed) * budget_ratio
+                      remaining = (fixed_budget > proportional_budget ? fixed_budget : proportional_budget) - sqreen_elapsed
+                    else
+                      remaining = budget_threshold - sqreen_elapsed
+                    end
+                    unless remaining > 0
+                      request[:skipped_callbacks] << c
+                      request[:time_budget_expended] = true
+                      next
+                    end
                   end
-                end
 
-                flow = catch(Ball.new) do |ball|
-                  Timer.new(c.name, &timed_callbacks_proc).measure(ignore: chrono) do
-                    c.call(CallbackCall.new(c, remaining, hooked_call.instance, hooked_call.args_passing ? hooked_call.args_pass : hooked_call.args_passed, nil, hooked_call.returned), ball)
+                  flow = catch(Ball.new) do |ball|
+                    Timer.new(c.name, &timed_callbacks_proc).measure(ignore: chrono) do
+                      c.call(CallbackCall.new(c, remaining, hooked_call.instance, hooked_call.args_passing ? hooked_call.args_pass : hooked_call.args_passed, nil, hooked_call.returned), ball)
+                    end
                   end
-                end
 
-                next unless c.flow && flow.is_a?(Flow)
-                hooked_call.raise = flow.raise and hooked_call.raising = true if flow.raise?
-                hooked_call.return = flow.return and hooked_call.returning = true if flow.return?
-                break if flow.break?
-              end unless hook.disabled?
+                  next unless c.flow && flow.is_a?(Flow)
+                  hooked_call.raise = flow.raise and hooked_call.raising = true if flow.raise?
+                  hooked_call.return = flow.return and hooked_call.returning = true if flow.return?
+                  break if flow.break?
+                end unless hook.disabled?
+              rescue StandardError => e
+                Sqreen::Weave.logger.debug { "exception:#{e.class} message:'#{e.message}' location:\"#{e.backtrace[0]}\"" }
+                Sqreen::RemoteException.record(e) if Sqreen.queue
+              end
 
               raise hooked_call.raise if hooked_call.raising
               return hooked_call.returning ? hooked_call.return : hooked_call.returned
             ensure
-              # TODO: timer.start if someone has thrown?
-
-              hook.ensured.each do |c|
-                next if c.ignore && c.ignore.call
-
-                if timer && !c.mandatory
-                  remaining = budget - timer.elapsed
-                  unless remaining > 0
-                    Thread.current[:sqreen_http_request] && Thread.current[:sqreen_http_request][:skipped_callbacks] << c && Thread.current[:sqreen_http_request][:time_budget_expended] = true
-                    next
+              begin
+                # TODO: sqreen_timer.start if someone has thrown?
+                # TODO: sqreen_timer.stop at end of rescue+else?
+                # TODO: Thread.current[:sqreen_hook_entered] = true if neither rescue nor else ie thrown?
+                # TODO: Thread.current[:sqreen_hook_entered] = false at end of rescue+else? (risky?)
+
+                # TODO: uniform early bail out? (but don't forget sqreen_hook_entered and sqreen_timer)
+                # return hooked_call.returning ? hooked_call.return : hooked_call.returned if hook.ensured.empty?
+
+                # done at either rescue or else
+                # request_elapsed = request_timer.elapsed if budget # && !hook.ensured.empty?
+
+                hook.ensured.each do |c|
+                  next if c.ignore && c.ignore.call
+
+                  if budget && !c.mandatory
+                    sqreen_elapsed = sqreen_timer.elapsed
+                    if budget_ratio && !request[:time_budget_expended]
+                      fixed_budget = budget_threshold
+                      proportional_budget = (request_elapsed - sqreen_elapsed) * budget_ratio
+                      remaining = (fixed_budget > proportional_budget ? fixed_budget : proportional_budget) - sqreen_elapsed
+                    else
+                      remaining = budget_threshold - sqreen_elapsed
+                    end
+                    unless remaining > 0
+                      request[:skipped_callbacks] << c
+                      request[:time_budget_expended] = true
+                      next
+                    end
                   end
-                end
 
-                flow = catch(Ball.new) do |ball|
-                  Timer.new(c.name, &timed_callbacks_proc).measure(ignore: chrono) do
-                    c.call(CallbackCall.new(c, remaining, hooked_call.instance, hooked_call.args_passing ? hooked_call.args_pass : hooked_call.args_passed, nil, hooked_call.returned), ball)
+                  flow = catch(Ball.new) do |ball|
+                    Timer.new(c.name, &timed_callbacks_proc).measure(ignore: chrono) do
+                      c.call(CallbackCall.new(c, remaining, hooked_call.instance, hooked_call.args_passing ? hooked_call.args_pass : hooked_call.args_passed, nil, hooked_call.returned), ball)
+                    end
                   end
-                end
 
-                next unless c.flow && flow.is_a?(Flow)
-                hooked_call.raise = flow.raise and hooked_call.raising = true if flow.raise?
-                hooked_call.return = flow.return and hooked_call.returning = true if flow.return?
-                break if flow.break?
-              end unless hook.disabled?
+                  next unless c.flow && flow.is_a?(Flow)
+                  hooked_call.raise = flow.raise and hooked_call.raising = true if flow.raise?
+                  hooked_call.return = flow.return and hooked_call.returning = true if flow.return?
+                  break if flow.break?
+                end unless hook.ensured.empty? || hook.disabled?
+
+                Thread.current[:sqreen_hook_entered] = false
+                sqreen_timer.stop if budget
+              rescue StandardError => e
+                Sqreen::Weave.logger.debug { "exception:#{e.class} message:'#{e.message}' location:\"#{e.backtrace[0]}\"" }
+                Sqreen::RemoteException.record(e) if Sqreen.queue
+              end
 
-              Thread.current[:sqreen_hook_entered] = false
-              timer.stop if timer
+              # TODO: should we run the following?
+              # raise hooked_call.raise if hooked_call.raising
+              # return hooked_call.returning ? hooked_call.return : hooked_call.returned
             end
           end # chrono
         end