sqreen 1.18.6 → 1.19.0.beta1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a4b8ec01ad0365518711b01aa8a424f179f2d115d614da821b212cbb82e8754e
-  data.tar.gz: 96c2e3da8c0678ba9720d613db4edf828af3559a36862bca313dab9dcd7c181a
+  metadata.gz: 0ffc604ca6c427fc4f689c67c3973a00bf83d6f0207f394c4df333bea1690799
+  data.tar.gz: 3b36a33e74f0dabb4ab75449807d2c2d2459f3edebe5e324ae593f12487815db
 SHA512:
-  metadata.gz: a7cdd3a299af7569fdab2e5cad439e5eedd6de6cdd80d474703408e64b325ae70f4837d4326c4e28a93e658b9c3c15c4279821ad1e0e0e91252faa7ff33e9c1b
-  data.tar.gz: '0691dc3e4aa7650c4fd2a4be33cf5f32843b062b4932fed4711866208011dccd3920f7dda468e4d25555e4b97a7e9ce8a41820cccacd1e473f29f26d2704b25b'
+  metadata.gz: 622abad5c40c24d5740dde29bd53da136ccbe40f357b541f0e9d9fec5131e61aa71f391d525eaf4819dbffb22901d7ca9a186c2b615f9b5f0e617254bce40bdc
+  data.tar.gz: d4072082a4aaf7a22e6d7ccaa0699f19b029c0236c6a5be12125e2c8ee5de3cbd99afa4a7560a772f2d1ac6224511f3ef600daa9b13fbae4cf7d85b65147bdd4

data/CHANGELOG.md

@@ -1,3 +1,10 @@
+## 1.19.0.beta1
+
+* Improve compatibility with a new optional instrumentation engine
+* Fix action reloading not being entirely cleared on reload
+* Improve handling of hash symbol keys in some security rules
+* Fix constant resolution scope on agent boot
+
 ## 1.18.6
 
 * Improve default WAF time budget handling logic

data/lib/sqreen/actions.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/actions/actions_index.rb

@@ -0,0 +1,16 @@
+# typed: true
+module Sqreen
+  module Actions
+    # documents the operations an actions index should implement
+    class ActionsIndex
+      # all actions matching, possibly already expired
+      def actions_matching(_key)
+        raise 'implement in subclasses'
+      end
+
+      def index(_params, _action)
+        raise 'implement in subclasses'
+      end
+    end
+  end
+end

data/lib/sqreen/actions/base.rb

@@ -1,8 +1,11 @@
+# typed: false
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 # TODO: remove class vars
 
+require 'sqreen/sdk'
 require 'sqreen/exception'
 
 module Sqreen
@@ -75,16 +78,7 @@ module Sqreen
           subclasses.keys
         end
 
-        # all actions matching, possibly already expired
-        def actions_matching(_key)
-          raise 'implement in singletons of subclasses'
-        end
-
-        def index(_params, _action)
-          raise 'implement in singletons of subclasses'
-        end
-
-        def clear
+        def new_index
           raise 'implement in singletons of subclasses'
         end
 

data/lib/sqreen/actions/block_ip.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/actions/block_user.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/actions/ip_range_indexed_action_class.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
@@ -6,30 +8,8 @@ require 'sqreen/actions/ip_ranges_index'
 module Sqreen
   module Actions
     module IpRangeIndexedActionClass
-      include IpRangesIndex
-
-      def actions_matching(client_ip)
-        matching_actions client_ip
-      end
-
-      def index(params, action)
-        ranges = parse_ip_ranges params
-
-        ranges.each do |r|
-          add_prefix r, action
-        end
-      end
-
-      private
-
-      # returns array of prefixes in string form
-      def parse_ip_ranges(params)
-        ranges = params['ip_cidr']
-        unless ranges && ranges.is_a?(Array) && !ranges.empty?
-          raise 'no non-empty ip_cidr array present'
-        end
-
-        ranges
+      def new_index
+        IpRangesIndex.new
       end
     end
   end

data/lib/sqreen/actions/ip_ranges_index.rb

@@ -1,22 +1,30 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 require 'ipaddr'
+require 'sqreen/actions/actions_index'
 require 'sqreen/trie'
 require 'sqreen/prefix'
 
 module Sqreen
   module Actions
-    module IpRangesIndex
-      def add_prefix(prefix_str, data)
-        @trie_v4 ||= Sqreen::Trie.new
-        @trie_v6 ||= Sqreen::Trie.new(nil, nil, Socket::AF_INET6)
-        prefix = Sqreen::Prefix.from_str(prefix_str, data)
-        trie = prefix.family == Socket::AF_INET6 ? @trie_v6 : @trie_v4
-        trie.insert prefix
+    class IpRangesIndex < ActionsIndex
+      def initialize
+        @trie_v4 = Sqreen::Trie.new
+        @trie_v6 = Sqreen::Trie.new(nil, nil, Socket::AF_INET6)
+      end
+
+      def index(params, action)
+        ranges = parse_ip_ranges params
+
+        ranges.each do |r|
+          add_prefix r, action
+        end
       end
 
-      def matching_actions(client_ip)
+      def actions_matching(client_ip)
         parsed_ip = IPAddr.new(client_ip.gsub(/%[^%\/]+/, ''))
         trie = parsed_ip.family == Socket::AF_INET6 ? @trie_v6 : @trie_v4
         return [] unless trie
@@ -27,9 +35,22 @@ module Sqreen
         found.map(&:data)
       end
 
-      def clear
-        @trie_v4 = Sqreen::Trie.new
-        @trie_v6 = Sqreen::Trie.new(nil, nil, Socket::AF_INET6)
+      private
+
+      # returns array of prefixes in string form
+      def parse_ip_ranges(params)
+        ranges = params['ip_cidr']
+        unless ranges && ranges.is_a?(Array) && !ranges.empty?
+          raise 'no non-empty ip_cidr array present'
+        end
+
+        ranges
+      end
+
+      def add_prefix(prefix_str, data)
+        prefix = Sqreen::Prefix.from_str(prefix_str, data)
+        trie = prefix.family == Socket::AF_INET6 ? @trie_v6 : @trie_v4
+        trie.insert prefix
       end
     end
   end

data/lib/sqreen/actions/redirect_ip.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/actions/redirect_user.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/actions/repository.rb

@@ -1,24 +1,43 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 module Sqreen
   module Actions
-    # Where the currently loaded actions are stored. Singleton
+    # Where the actions are stored
+    # The current ones are stored in Repository.current
     class Repository
-      include Singleton
+      def initialize
+        @indexes = Hash[Base.known_subclasses.map do |clazz|
+          [clazz.type_name, clazz.new_index]
+        end]
+      end
 
       def add(params, action)
-        action.class.index(params || {}, action)
+        @indexes[action.class.type_name].index(params || {}, action)
       end
 
-      def get(action_class, key)
-        action_class = Base.get_type_class(action_class) unless action_class.class == Class
-        action_class.actions_matching key
+      # type is either a class or a type name
+      def get(type, key)
+        type = type.type_name if type.class == Class
+        @indexes[type].actions_matching key
       end
 
-      def clear
-        Base.known_subclasses.each(&:clear)
+      singleton_class.class_eval do
+        attr_reader :current
+        def current=(new_inst)
+          raise 'nil is unacceptable' if new_inst.nil?
+          @current = new_inst
+        end
+
+        def clear
+          self.current = Repository.new
+        end
       end
+
+      # initialize current to empty repository
+      clear
     end
   end
 end

data/lib/sqreen/actions/unknown_action_type.rb

@@ -1,6 +1,10 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
+require 'sqreen/exception'
+
 module Sqreen
   # Implements actions (behavior taken in response to agent signals)
   module Actions

data/lib/sqreen/actions/user_action_class.rb

@@ -1,40 +1,15 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
-require 'sqreen/exception'
+require 'sqreen/actions/users_index'
 
 module Sqreen
   module Actions
     module UserActionClass
-      def actions_matching(identity_params)
-        return [] unless @idx
-        key = stringify_keys(identity_params)
-        actions = @idx[key]
-        actions || []
-      end
-
-      def index(params, action)
-        @idx ||= {}
-        users = params['users']
-        raise ::Sqreen::Exception, 'nil "users" param for block_user action' if users.nil?
-        raise ::Sqreen::Exception, '"users" param must be an array' unless users.is_a? Array
-
-        users.each do |u|
-          @idx[u] ||= []
-          @idx[u] << action
-        end
-      end
-
-      def clear
-        @idx = {}
-      end
-
-      private
-
-      def stringify_keys(hash)
-        Hash[
-          hash.map { |k, v| [k.to_s, v] }
-        ]
+      def new_index
+        UsersIndex.new
       end
     end
   end

data/lib/sqreen/actions/users_index.rb

@@ -0,0 +1,35 @@
+# typed: true
+require 'sqreen/actions/actions_index'
+
+module Sqreen
+  module Actions
+    class UsersIndex < ActionsIndex
+      def actions_matching(identity_params)
+        return [] unless @idx
+        key = stringify_keys(identity_params)
+        actions = @idx[key]
+        actions || []
+      end
+
+      def index(params, action)
+        @idx ||= {}
+        users = params['users']
+        raise ::Sqreen::Exception, 'nil "users" param for block_user action' if users.nil?
+        raise ::Sqreen::Exception, '"users" param must be an array' unless users.is_a? Array
+
+        users.each do |u|
+          @idx[u] ||= []
+          @idx[u] << action
+        end
+      end
+
+      private
+
+      def stringify_keys(hash)
+        Hash[
+          hash.map { |k, v| [k.to_s, v] }
+        ]
+      end
+    end
+  end
+end

data/lib/sqreen/agent.rb

@@ -1,8 +1,9 @@
+# typed: ignore
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 
 require 'sqreen/version'
-require 'sqreen/instrumentation'
 require 'sqreen/session'
 require 'sqreen/runner'
 require 'sqreen/log'

data/lib/sqreen/attack_blocked.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/backport.rb

@@ -1,3 +1,5 @@
+# typed: strong
+
 # Copyright (c) 2015 Sqreen. All Rights Reserved.
 # Please refer to our terms for more information: https://www.sqreen.com/terms.html
 

data/lib/sqreen/backport/clock_gettime.rb

@@ -0,0 +1,74 @@
+# typed: ignore
+
+# Copyright (c) 2015 Sqreen. All Rights Reserved.
+# Please refer to our terms for more information: https://www.sqreen.com/terms.html
+
+require 'sqreen/backport'
+
+module Sqreen
+  module Backport
+    module ClockGettime
+      class << self
+        def supported?
+          Process.respond_to?(:clock_gettime)
+        end
+      end
+
+      unless supported?
+        require 'ffi'
+
+        class Timespec < FFI::Struct
+          layout :tv_sec => :time_t, :tv_nsec => :long
+        end
+
+        module LibC
+          extend FFI::Library
+          ffi_lib FFI::Library::LIBC
+
+          # TODO: FFI::NotFoundError
+
+          if RUBY_PLATFORM =~ /darwin/
+            attach_function :mach_absolute_time, [], :uint64
+          end
+
+          attach_function :clock_gettime, [:int, :pointer], :int
+        end
+
+        module Constants
+          case RUBY_PLATFORM
+          when /darwin/
+            CLOCK_REALTIME = 0
+            CLOCK_MONOTONIC = 6
+            CLOCK_PROCESS_CPUTIME_ID = 12
+            CLOCK_THERAD_CPUTIME_ID = 16
+          when /linux/
+            CLOCK_REALTIME = 0
+            CLOCK_MONOTONIC = 1
+            CLOCK_PROCESS_CPUTIME_ID = 2
+            CLOCK_THREAD_CPUTIME_ID = 3
+          end
+        end
+
+        def clock_gettime(clock_id, unit = :float_second)
+          unless unit == :float_second
+            raise "Process.clock_gettime: unsupported unit #{unit.inspect}"
+          end
+
+          t = Timespec.new
+          ret = LibC.clock_gettime(clock_id, t.pointer)
+
+          raise SystemCallError, "Errno #{FFI.errno}" if ret == -1
+
+          t[:tv_sec].to_f + t[:tv_nsec].to_f / 1_000_000_000
+        end
+      end
+    end
+  end
+end
+
+unless Sqreen::Backport::ClockGettime.supported?
+  Process.instance_eval do
+    extend Sqreen::Backport::ClockGettime
+    include Sqreen::Backport::ClockGettime::Constants
+  end
+end