-
Notifications
You must be signed in to change notification settings - Fork 10
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(injector: stdlib): instrument os.OpenFile (#219)
### What does this PR do? This PR instrument all file opening via the `os.Openfile` function for RASP LFI and is the sister PR of DataDog/dd-trace-go#2781 - [x] Write intrumentation file - [x] Write integration tests for the `os` package - [x] Add `tracer-internal: true` to the `dd:orchestrion-enabled` instrumentation to properly enable the GLS storage in dd-trace-go - [x] Add more tests for `dd:orchestrion-enabled` ### Motivation Support for LFI protection. ### Reviewer's Checklist <!-- * Authors can use this list as a reference to ensure that there are no problems during the review but the signing off is to be done by the reviewer(s). --> - [ ] Changed code has unit tests for its functionality. --------- Signed-off-by: Eliott Bouhana <eliott.bouhana@datadoghq.com>
- Loading branch information
1 parent
aee181b
commit f109ee0
Showing
11 changed files
with
376 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -7,3 +7,4 @@ | |
| orchestrion | ||
| coverage/ | ||
| venv/ | ||
| .python-version | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,116 @@ | ||
| // Unless explicitly stated otherwise all files in this repository are licensed | ||
| // under the Apache License Version 2.0. | ||
| // This product includes software developed at Datadog (https://www.datadoghq.com/). | ||
| // Copyright 2023-present Datadog, Inc. | ||
|
|
||
| //go:build integration | ||
|
|
||
| package os | ||
|
|
||
| import ( | ||
| "context" | ||
| "fmt" | ||
| "net/http" | ||
| "os" | ||
| "runtime" | ||
| "testing" | ||
| "time" | ||
|
|
||
| "orchestrion/integration/validator/trace" | ||
|
|
||
| "github.com/stretchr/testify/require" | ||
|
|
||
| "gopkg.in/DataDog/dd-trace-go.v1/appsec/events" | ||
| "gopkg.in/DataDog/dd-trace-go.v1/ddtrace/tracer" | ||
| ) | ||
|
|
||
| type TestCase struct { | ||
| *http.Server | ||
| *testing.T | ||
| } | ||
|
|
||
| func (tc *TestCase) Setup(t *testing.T) { | ||
| if runtime.GOOS == "windows" { | ||
| t.Skip("appsec does not support Windows") | ||
| } | ||
|
|
||
| t.Setenv("DD_APPSEC_RULES", "./testdata/rasp-only-rules.json") | ||
| t.Setenv("DD_APPSEC_ENABLED", "true") | ||
| t.Setenv("DD_APPSEC_RASP_ENABLED", "true") | ||
| t.Setenv("DD_APPSEC_WAF_TIMEOUT", "1h") | ||
| mux := http.NewServeMux() | ||
| tc.Server = &http.Server{ | ||
| Addr: "127.0.0.1:8080", | ||
| Handler: mux, | ||
| } | ||
|
|
||
| mux.HandleFunc("/", tc.handleRoot) | ||
|
|
||
| go func() { require.ErrorIs(t, tc.Server.ListenAndServe(), http.ErrServerClosed) }() | ||
| } | ||
|
|
||
| func (tc *TestCase) Run(t *testing.T) { | ||
| tc.T = t | ||
| resp, err := http.Get(fmt.Sprintf("http://%s/?path=/etc/passwd", tc.Server.Addr)) | ||
| require.NoError(t, err) | ||
| require.Equal(t, http.StatusForbidden, resp.StatusCode) | ||
| } | ||
|
|
||
| func (tc *TestCase) Teardown(t *testing.T) { | ||
| ctx, cancel := context.WithTimeout(context.Background(), time.Second) | ||
| defer cancel() | ||
|
|
||
| require.NoError(t, tc.Server.Shutdown(ctx)) | ||
| } | ||
|
|
||
| func (tc *TestCase) ExpectedTraces() trace.Spans { | ||
| return trace.Spans{ | ||
| { | ||
| Tags: map[string]any{ | ||
| "name": "http.request", | ||
| "resource": "GET /", | ||
| "type": "http", | ||
| }, | ||
| Meta: map[string]any{ | ||
| "component": "net/http", | ||
| "span.kind": "client", | ||
| }, | ||
| Children: trace.Spans{ | ||
| { | ||
| Tags: map[string]any{ | ||
| "name": "http.request", | ||
| "resource": "GET /", | ||
| "type": "web", | ||
| }, | ||
| Meta: map[string]any{ | ||
| "component": "net/http", | ||
| "span.kind": "server", | ||
| "appsec.blocked": "true", | ||
| "is.security.error": "true", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| } | ||
| } | ||
|
|
||
| func (tc *TestCase) handleRoot(w http.ResponseWriter, _ *http.Request) { | ||
|
|
||
| fp, err := os.Open("/etc/passwd") | ||
|
|
||
| require.ErrorIs(tc.T, err, &events.BlockingSecurityEvent{}) | ||
| if events.IsSecurityError(err) { // TODO: response writer instrumentation to not have to do that | ||
| span, _ := tracer.SpanFromContext(context.TODO()) | ||
| span.SetTag("is.security.error", true) | ||
| return | ||
| } | ||
|
|
||
| if err != nil { | ||
| http.Error(w, err.Error(), http.StatusInternalServerError) | ||
| return | ||
| } | ||
|
|
||
| defer fp.Close() | ||
|
|
||
| w.WriteHeader(http.StatusOK) | ||
| } |
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,158 @@ | ||
| { | ||
| "version": "2.2", | ||
| "metadata": { | ||
| "rules_version": "1.4.2" | ||
| }, | ||
| "rules": [ | ||
| { | ||
| "id": "rasp-930-100", | ||
| "name": "Local file inclusion exploit", | ||
| "tags": { | ||
| "type": "lfi", | ||
| "category": "vulnerability_trigger", | ||
| "cwe": "22", | ||
| "capec": "1000/255/153/126", | ||
| "confidence": "0", | ||
| "module": "rasp" | ||
| }, | ||
| "conditions": [ | ||
| { | ||
| "parameters": { | ||
| "resource": [ | ||
| { | ||
| "address": "server.io.fs.file" | ||
| } | ||
| ], | ||
| "params": [ | ||
| { | ||
| "address": "server.request.query" | ||
| }, | ||
| { | ||
| "address": "server.request.body" | ||
| }, | ||
| { | ||
| "address": "server.request.path_params" | ||
| }, | ||
| { | ||
| "address": "grpc.server.request.message" | ||
| }, | ||
| { | ||
| "address": "graphql.server.all_resolvers" | ||
| }, | ||
| { | ||
| "address": "graphql.server.resolver" | ||
| } | ||
| ] | ||
| }, | ||
| "operator": "lfi_detector" | ||
| } | ||
| ], | ||
| "transformers": [], | ||
| "on_match": [ | ||
| "stack_trace", | ||
| "block" | ||
| ] | ||
| }, | ||
| { | ||
| "id": "rasp-934-100", | ||
| "name": "Server-side request forgery exploit", | ||
| "tags": { | ||
| "type": "ssrf", | ||
| "category": "vulnerability_trigger", | ||
| "cwe": "918", | ||
| "capec": "1000/225/115/664", | ||
| "confidence": "0", | ||
| "module": "rasp" | ||
| }, | ||
| "conditions": [ | ||
| { | ||
| "parameters": { | ||
| "resource": [ | ||
| { | ||
| "address": "server.io.net.url" | ||
| } | ||
| ], | ||
| "params": [ | ||
| { | ||
| "address": "server.request.query" | ||
| }, | ||
| { | ||
| "address": "server.request.body" | ||
| }, | ||
| { | ||
| "address": "server.request.path_params" | ||
| }, | ||
| { | ||
| "address": "grpc.server.request.message" | ||
| }, | ||
| { | ||
| "address": "graphql.server.all_resolvers" | ||
| }, | ||
| { | ||
| "address": "graphql.server.resolver" | ||
| } | ||
| ] | ||
| }, | ||
| "operator": "ssrf_detector" | ||
| } | ||
| ], | ||
| "transformers": [], | ||
| "on_match": [ | ||
| "stack_trace", | ||
| "block" | ||
| ] | ||
| }, | ||
| { | ||
| "id": "rasp-942-100", | ||
| "name": "SQL injection exploit", | ||
| "tags": { | ||
| "type": "sql_injection", | ||
| "category": "vulnerability_trigger", | ||
| "cwe": "89", | ||
| "capec": "1000/152/248/66", | ||
| "confidence": "0", | ||
| "module": "rasp" | ||
| }, | ||
| "conditions": [ | ||
| { | ||
| "parameters": { | ||
| "resource": [ | ||
| { | ||
| "address": "server.db.statement" | ||
| } | ||
| ], | ||
| "params": [ | ||
| { | ||
| "address": "server.request.query" | ||
| }, | ||
| { | ||
| "address": "server.request.body" | ||
| }, | ||
| { | ||
| "address": "server.request.path_params" | ||
| }, | ||
| { | ||
| "address": "graphql.server.all_resolvers" | ||
| }, | ||
| { | ||
| "address": "graphql.server.resolver" | ||
| } | ||
| ], | ||
| "db_type": [ | ||
| { | ||
| "address": "server.db.system" | ||
| } | ||
| ] | ||
| }, | ||
| "operator": "sqli_detector" | ||
| } | ||
| ], | ||
| "transformers": [], | ||
| "on_match": [ | ||
| "stack_trace", | ||
| "block" | ||
| ] | ||
| } | ||
| ], | ||
| "rules_data": [] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.