Skip to content
This repository was archived by the owner on Nov 2, 2023. It is now read-only.

Commit af87910

Browse files
author
Julio Guerra
committed
v0.14.0
New Feature: - (#142) RASP: add Shellshock protection support. This protection is currently attached to `os.StartProcess()` which is the common function of the Go standard library to execute a process. This protection can be configured at <https://my.sqreen.com/application/goto/modules/rasp/details/shellshock>. Fixes: - (#145) In-App WAF: always recover from panics as this in the way the `reflect` package handles usage errors. - (#144) Backend client: avoid dropping HTTP traces in case of `Host` header parsing errors.
2 parents b3b89ec + b9e650a commit af87910

File tree

15 files changed

+318
-255
lines changed

15 files changed

+318
-255
lines changed

‎.github/workflows/agent-tests.yaml

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: Agent Tests
2+
on:
3+
pull_request:
4+
schedule:
5+
- cron: "0 0 * * *"
6+
jobs:
7+
native:
8+
strategy:
9+
matrix:
10+
runs-on: [ macos-latest, ubuntu-latest, windows-latest ]
11+
go-version: [ 1, 1.15, 1.14, 1.13, 1.12 ]
12+
fail-fast: false
13+
runs-on: ${{ matrix.runs-on }}
14+
steps:
15+
- uses: actions/checkout@v2
16+
- name: Setup go
17+
uses: actions/setup-go@v2
18+
with:
19+
go-version: ${{ matrix.go-version }}
20+
- run: go test ./...
21+
22+
# Same tests but on the official golang container for linux
23+
# Docker for Windows is not yet available on Github Actions.
24+
golang-linux-container:
25+
strategy:
26+
matrix:
27+
go-version: [ 1, 1.15, 1.14, 1.13, 1.12 ]
28+
distribution: [ alpine, buster ]
29+
fail-fast: false
30+
runs-on: ubuntu-latest
31+
container:
32+
image: golang:${{ matrix.go-version }}-${{ matrix.distribution }}
33+
steps:
34+
- uses: actions/checkout@v2
35+
# Install gcc and the libc headers on alpine images
36+
- if: ${{ matrix.distribution == 'alpine' }}
37+
run: apk add gcc musl-dev libc6-compat git
38+
- run: go test ./...
39+
40+
# debian stretch doesn't have the latest go versions
41+
golang-debian-stretch-container:
42+
strategy:
43+
matrix:
44+
go-version: [ 1.14, 1.13, 1.12 ]
45+
fail-fast: false
46+
runs-on: ubuntu-latest
47+
container:
48+
image: golang:${{ matrix.go-version }}-stretch
49+
steps:
50+
- uses: actions/checkout@v2
51+
- run: go test ./...

‎.github/workflows/ci-example-apps.yaml ‎.github/workflows/example-apps.yaml

+2-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
1-
name: Example App Builds
1+
name: Example Apps
22
on:
3-
push:
43
pull_request:
54
schedule:
65
- cron: "0 0 * * *"
@@ -10,7 +9,7 @@ jobs:
109
strategy:
1110
matrix:
1211
example: [ alpine, debian, scratch ]
13-
go-version: [ rc, 1.14, 1.13, 1.12]
12+
go-version: [ rc, 1.14, 1.13, 1.12 ]
1413
do-vendoring: [ true, false ]
1514
runs-on: ubuntu-latest
1615
steps:

‎.github/workflows/system-tests.yaml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: System Tests
2+
on:
3+
push:
4+
branches: [ 'master', 'dev', 'hotfix/*', 'release/*', 'feature/*', 'fix/*' ]
5+
jobs:
6+
# Run system tests when the PR is no longer a draft
7+
system-tests:
8+
if: github.event.pull_request.draft == false
9+
name: System Tests
10+
runs-on: ubuntu-latest
11+
steps:
12+
- name: Run System Tests
13+
uses: felixp8/[email protected]
14+
with:
15+
token: ${{ secrets.GH_TOKEN }}
16+
owner: sqreen
17+
repo: AgentGoTests
18+
event_type: go-agent-commit
19+
client_payload: '{"ref": "${{ github.ref }}", "sha": "${{ github.sha }}"}'
20+
wait_time: 10
21+
max_time: 600

‎CHANGELOG.md

+25-7
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,21 @@
1+
# v0.14.0 - 2 September 2020
2+
3+
## New Feature
4+
5+
- (#142) RASP: add Shellshock protection support. This protection is currently
6+
attached to `os.StartProcess()` which is the common function of the Go
7+
standard library to execute a process. This protection can be configured at
8+
<https://my.sqreen.com/application/goto/modules/rasp/details/shellshock>.
9+
10+
## Fixes
11+
12+
- (#145) In-App WAF: always recover from panics as this in the way the `reflect`
13+
package handles usage errors.
14+
15+
- (#144) Backend client: avoid dropping HTTP traces in case of `Host` header
16+
parsing errors.
17+
18+
119
# v0.13.0 - 24 July 2020
220

321
## New Feature
@@ -80,21 +98,21 @@
8098

8199
## New Features
82100

83-
- (#119) RASP: add Shell Injection protection support. This protection is currently dynamically applied to `os.StartProcess()` which is the only entry point of the Go standard library to execute a process. This protection can be configured at https://my.sqreen.com/application/goto/modules/rasp/details/shi.
101+
- (#119) RASP: add Shell Injection protection support. This protection is currently dynamically applied to `os.StartProcess()` which is the only entry point of the Go standard library to execute a process. This protection can be configured at <https://my.sqreen.com/application/goto/modules/rasp/details/shi>.
84102

85-
- (#119) RASP: add Local File Inclusion protection support. This protection is currently dynamically applied to `os.Open()` which is the only entry point of the Go standard library to open a file for reading. This protection can be configured at https://my.sqreen.com/application/goto/modules/rasp/details/lfi.
103+
- (#119) RASP: add Local File Inclusion protection support. This protection is currently dynamically applied to `os.Open()` which is the only entry point of the Go standard library to open a file for reading. This protection can be configured at <https://my.sqreen.com/application/goto/modules/rasp/details/lfi>.
86104

87-
- (#120) RASP: add Server-Side Request Forgery protection support. This protection is currently dynamically applied to `net/http.(*Client).do()` which is the only entry point of the Go standard library to perform an HTTP request. This protection can be configured at https://my.sqreen.com/application/goto/modules/rasp/details/ssrf.
105+
- (#120) RASP: add Server-Side Request Forgery protection support. This protection is currently dynamically applied to `net/http.(*Client).do()` which is the only entry point of the Go standard library to perform an HTTP request. This protection can be configured at <https://my.sqreen.com/application/goto/modules/rasp/details/ssrf>.
88106

89-
- (#125) RASP: enable SQL Injection protection for every MySQL, Oracle, SQLite and PostgreSQL drivers listed in the Go language wiki page https://github.com/golang/go/wiki/SQLDrivers.
107+
- (#125) RASP: enable SQL Injection protection for every MySQL, Oracle, SQLite and PostgreSQL drivers listed in the Go language wiki page <https://github.com/golang/go/wiki/SQLDrivers>.
90108

91109
- (#115) RASP: store Sqreen's request protection context into the Goroutine Local Storage (GLS). Therefore, Sqreen can now protect every Go function without requiring the request Go context (eg. both `QueryContext()` and `Query()` can be now protected against SQL injections). For now, this protection context is only available in the goroutine handling the request, and sub-goroutines are not protected. Further support will be added very soon to remove this limitation.
92110

93-
- (#121) Add IP denylist support: block every request performed by an IP address of the denylist. Every usage of whitelist and blacklist in the agent was also removed when possible. The IP denylist can be configured at https://my.sqreen.com/application/goto/settings/denylist.
111+
- (#121) Add IP denylist support: block every request performed by an IP address of the denylist. Every usage of whitelist and blacklist in the agent was also removed when possible. The IP denylist can be configured at <https://my.sqreen.com/application/goto/settings/denylist>.
94112

95-
- (#122) Add path passlist support: requests performed on those paths are not monitored nor protected by Sqreen. The Path passlist can be configured at https://my.sqreen.com/application/goto/settings/passlist.
113+
- (#122) Add path passlist support: requests performed on those paths are not monitored nor protected by Sqreen. The Path passlist can be configured at <https://my.sqreen.com/application/goto/settings/passlist>.
96114

97-
- (#123) Export the error type returned by Sqreen protections when blocking in the new SDK package `github.com/sqreen/go-agent/sdk/types` in order to avoid retrying blocked function calls (eg. avoid retrying a blocked SQL query). It must be used along with `errors.As()` to detect such cases. Read more at https://godoc.org/github.com/sqreen/go-agent/sdk/types.
115+
- (#123) Export the error type returned by Sqreen protections when blocking in the new SDK package `github.com/sqreen/go-agent/sdk/types` in order to avoid retrying blocked function calls (eg. avoid retrying a blocked SQL query). It must be used along with `errors.As()` to detect such cases. Read more at <https://godoc.org/github.com/sqreen/go-agent/sdk/types>.
98116

99117
- (#124) Allow to "quickly" remove the agent from a program by only removing it from the source code without disabling the program instrumentation. This is made possible by making the instrumentation fully autonomous to avoid compilation errors.
100118

‎azure-pipelines.yml

-87
This file was deleted.

‎go.mod

+2-2
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,11 @@ require (
2424
github.com/modern-go/reflect2 v1.0.1 // indirect
2525
github.com/onsi/ginkgo v1.7.0
2626
github.com/onsi/gomega v1.4.3
27-
github.com/pkg/errors v0.8.1
27+
github.com/pkg/errors v0.9.1
2828
github.com/spf13/cast v1.3.1 // indirect
2929
github.com/spf13/pflag v1.0.5 // indirect
3030
github.com/spf13/viper v1.3.2
31-
github.com/sqreen/go-libsqreen v0.7.0
31+
github.com/sqreen/go-libsqreen v0.7.1
3232
github.com/sqreen/go-sdk/signal v1.1.0
3333
github.com/stretchr/testify v1.6.1
3434
golang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37 // indirect

‎go.sum

+4-4
Original file line numberDiff line numberDiff line change
@@ -81,8 +81,8 @@ github.com/onsi/gomega v1.4.3 h1:RE1xgDvH7imwFD45h+u2SgIfERHlS2yNG4DObb5BSKU=
8181
github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
8282
github.com/pelletier/go-toml v1.2.0 h1:T5zMGML61Wp+FlcbWjRDT7yAxhJNAiPPLOFECq181zc=
8383
github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
84-
github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
85-
github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
84+
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
85+
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
8686
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
8787
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
8888
github.com/sergi/go-diff v1.0.0 h1:Kpca3qRNrduNnOQeazBd0ysaKrUJiIuISHxogkT9RPQ=
@@ -101,8 +101,8 @@ github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
101101
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
102102
github.com/spf13/viper v1.3.2 h1:VUFqw5KcqRf7i70GOzW7N+Q7+gxVBkSSqiXB12+JQ4M=
103103
github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
104-
github.com/sqreen/go-libsqreen v0.7.0 h1:MRX/KB5lX3O6ucvmTUap6iSDt27bM+76MQpuDNjL+1o=
105-
github.com/sqreen/go-libsqreen v0.7.0/go.mod h1:D324eoKlZGfW+TF3WGg+2fUtpdrI+cEK5UYwpxfaeUc=
104+
github.com/sqreen/go-libsqreen v0.7.1 h1:wKjpt2+BjDx9Gi8VsQOS9YP3Q43lX0o835LwFPpDItQ=
105+
github.com/sqreen/go-libsqreen v0.7.1/go.mod h1:krFVmXmHM5SaWeED8jDb8KwrViK505KDBpYJ8IY2Ks8=
106106
github.com/sqreen/go-sdk/signal v1.1.0 h1:l22lqlUNDlEaqsNjpgVelGteBCwGodZqUDPUMBOLzhE=
107107
github.com/sqreen/go-sdk/signal v1.1.0/go.mod h1:XWJV0TzuoN6PotzRn4YSe6fhTxyw67yRpVYr9NJTzto=
108108
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=

‎internal/backend/api/signal/signal.go

+6-10
Original file line numberDiff line numberDiff line change
@@ -58,15 +58,11 @@ func NewAgentInfra(agentVersion, osType, hostname, runtimeVersion string) *Agent
5858
}
5959

6060
func fromLegacyRequestRecord(record *legacy_api.RequestRecord, infra *AgentInfra) (*http_trace.Trace, error) {
61-
port, err := strconv.ParseUint(record.Request.Port, 10, 64)
62-
if err != nil {
63-
return nil, sqerrors.Wrap(err, "could not parse the request port number as an uint64 value")
64-
}
65-
66-
remotePort, err := strconv.ParseUint(record.Request.RemotePort, 10, 64)
67-
if err != nil {
68-
return nil, sqerrors.Wrap(err, "could not parse the request remote port number as an uint64 value")
69-
}
61+
// Parse the port numbers by ignoring parsing errors and keeping the default
62+
// zero value otherwise anyway to avoid dropping the the trace for that error.
63+
// For example, the port number can be possibly empty.
64+
port, _ := strconv.ParseUint(record.Request.Port, 10, 64)
65+
remotePort, _ := strconv.ParseUint(record.Request.RemotePort, 10, 64)
7066

7167
headers := make([][]string, len(record.Request.Headers))
7268
for i, e := range record.Request.Headers {
@@ -276,7 +272,7 @@ func convertLegacyMetrics(metric *legacy_api.MetricResponse, agentVersion string
276272

277273
values, ok := metric.Observation.Value.(map[string]int64)
278274
if !ok {
279-
return nil, sqerrors.Errorf("unexpected type of metric values `%T` instead of `map[string]intr64`", metric.Observation.Value)
275+
return nil, sqerrors.Errorf("unexpected type of metric values `%T` instead of `%T`", metric.Observation.Value, values)
280276
}
281277

282278
return api.NewSumMetric(name.String(), source, metric.Start, metric.Finish, metric.Finish.Sub(metric.Start), values), nil

0 commit comments

Comments
 (0)