Class: Aikido::Zen::RuntimeSettings

Inherits:
Struct
  • Object
show all
Defined in:
lib/aikido/zen/runtime_settings.rb

Overview

Stores the firewall configuration sourced from the Aikido dashboard. This object is updated by the Agent regularly.

Because the RuntimeSettings object can be modified in runtime, it implements the Observable API, allowing you to subscribe to updates. These are triggered whenever #update_from_runtime_settings_json makes a change (i.e. if the settings don’t change, no update is triggered).

You can subscribe to changes with #add_observer(object, func_name), which will call the function passing the settings as an argument

Defined Under Namespace

Classes: DomainSettings, Domains, Endpoints, IPSet, ProtectionSettings, RateLimitSettings

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize ⇒ RuntimeSettings

Returns a new instance of RuntimeSettings.



15
16
17
18
19
20
 
# File 'lib/aikido/zen/runtime_settings.rb', line 15

def initialize(*)
  super
  self.endpoints ||= RuntimeSettings::Endpoints.new
  self.bypassed_ips ||= RuntimeSettings::IPSet.new
  self.domains ||= RuntimeSettings::Domains.new
end

Instance Attribute Details

#block_new_outbound ⇒ Boolean

Returns:

  • (Boolean) 


14
15
16
 
# File 'lib/aikido/zen/runtime_settings.rb', line 14

def block_new_outbound
  @block_new_outbound
end

#blocked_user_agent_regexp ⇒ Regexp

Returns:

  • (Regexp) 


14
15
16
 
# File 'lib/aikido/zen/runtime_settings.rb', line 14

def blocked_user_agent_regexp
  @blocked_user_agent_regexp
end

#blocked_user_ids ⇒ Array

Returns:

  • (Array) 


14
15
16
 
# File 'lib/aikido/zen/runtime_settings.rb', line 14

def blocked_user_ids
  @blocked_user_ids
end

#blocking_mode ⇒ Boolean

Returns:

  • (Boolean) 


14
15
16
 
# File 'lib/aikido/zen/runtime_settings.rb', line 14

def blocking_mode
  @blocking_mode
end

#bypassed_ips ⇒ Aikido::Zen::RuntimeSettings::IPSet

Returns:



14
15
16
 
# File 'lib/aikido/zen/runtime_settings.rb', line 14

def bypassed_ips
  @bypassed_ips
end

#domains ⇒ Array<Aikido::Zen::RuntimeSettings::DomainSettings>

Returns:



14
15
16
 
# File 'lib/aikido/zen/runtime_settings.rb', line 14

def domains
  @domains
end

#endpoints ⇒ Aikido::Zen::RuntimeSettings::Endpoints

Returns:



14
15
16
 
# File 'lib/aikido/zen/runtime_settings.rb', line 14

def endpoints
  @endpoints
end

#excluded_user_ids_from_rate_limiting ⇒ Array<String>?

Returns the user IDs that should be skipped from rate limiting entirely.

Returns:

  • (Array<String>, nil) —

    the user IDs that should be skipped from rate limiting entirely.



14
15
16
 
# File 'lib/aikido/zen/runtime_settings.rb', line 14

def excluded_user_ids_from_rate_limiting
  @excluded_user_ids_from_rate_limiting
end

#heartbeat_interval ⇒ Integer

Returns duration in seconds between heartbeat requests to the Aikido server.

Returns:

  • (Integer) —

    duration in seconds between heartbeat requests to the Aikido server.



14
15
16
 
# File 'lib/aikido/zen/runtime_settings.rb', line 14

def heartbeat_interval
  @heartbeat_interval
end

#monitored_user_agent_regexp ⇒ Regexp

Returns:

  • (Regexp) 


14
15
16
 
# File 'lib/aikido/zen/runtime_settings.rb', line 14

def monitored_user_agent_regexp
  @monitored_user_agent_regexp
end

#received_any_stats ⇒ Boolean

Returns whether the Aikido server has received any data from this application.

Returns:

  • (Boolean) —

    whether the Aikido server has received any data from this application.



14
15
16
 
# File 'lib/aikido/zen/runtime_settings.rb', line 14

def received_any_stats
  @received_any_stats
end

#updated_at ⇒ Time

Returns when these settings were updated in the Aikido dashboard.

Returns:

  • (Time) —

    when these settings were updated in the Aikido dashboard.



14
15
16
 
# File 'lib/aikido/zen/runtime_settings.rb', line 14

def updated_at
  @updated_at
end

#user_agent_details ⇒ Regexp

Returns:

  • (Regexp) 


14
15
16
 
# File 'lib/aikido/zen/runtime_settings.rb', line 14

def user_agent_details
  @user_agent_details
end

Instance Method Details

#block_outbound?(connection) ⇒ Boolean

Returns:

  • (Boolean) 


173
174
175
176
177
178
179
 
# File 'lib/aikido/zen/runtime_settings.rb', line 173

def block_outbound?(connection)
  domain = domains[connection.host]

  return true if !domain.equal?(RuntimeSettings::DomainSettings.none) && domain.block?

  block_new_outbound && domain.block?
end

#blocked_user_agent?(user_agent) ⇒ Boolean

Returns whether the user agent should be blocked.

Parameters:

  • user_agent (String) —

    the user agent

Returns:

  • (Boolean) —

    whether the user agent should be blocked



149
150
151
152
153
 
# File 'lib/aikido/zen/runtime_settings.rb', line 149

def blocked_user_agent?(user_agent)
  return false if blocked_user_agent_regexp.nil?

  blocked_user_agent_regexp.match?(user_agent)
end

#bypassed_ip?(ip) ⇒ Boolean

Returns Whether the IP is included in the bypassed IPs set.

Parameters:

  • ip (String)

Returns:

  • (Boolean) —

    Whether the IP is included in the bypassed IPs set.



136
137
138
 
# File 'lib/aikido/zen/runtime_settings.rb', line 136

def bypassed_ip?(ip)
  bypassed_ips.include?(ip)
end

#monitored_user_agent?(user_agent) ⇒ Boolean

Returns whether the user agent should be monitored.

Parameters:

  • user_agent (String) —

    the user agent

Returns:

  • (Boolean) —

    whether the user agent should be monitored



157
158
159
160
161
 
# File 'lib/aikido/zen/runtime_settings.rb', line 157

def monitored_user_agent?(user_agent)
  return false if monitored_user_agent_regexp.nil?

  monitored_user_agent_regexp.match?(user_agent)
end

#update_from_runtime_config_json(data) ⇒ bool

Parse and interpret the JSON response from the core API with updated runtime settings, and apply the changes.

This will also notify any subscriber to updates.

Parameters:

  • data (Hash) —

    the decoded JSON payload from the /api/runtime/config API endpoint.

Returns:

  • (bool) 


72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
 
# File 'lib/aikido/zen/runtime_settings.rb', line 72

def update_from_runtime_config_json(data)
  last_updated_at = updated_at

  self.updated_at = Time.at(data["configUpdatedAt"].to_i / 1000)
  self.heartbeat_interval = data["heartbeatIntervalInMS"].to_i / 1000
  self.endpoints = RuntimeSettings::Endpoints.from_json(data["endpoints"])
  self.blocked_user_ids = data["blockedUserIds"]
  self.bypassed_ips = RuntimeSettings::IPSet.from_json(data["allowedIPAddresses"])
  self.received_any_stats = data["receivedAnyStats"]
  self.blocking_mode = data["block"]

  self.block_new_outbound = data["blockNewOutgoingRequests"]
  self.domains = RuntimeSettings::Domains.from_json(data["domains"])

  self.excluded_user_ids_from_rate_limiting = data["excludedUserIdsFromRateLimiting"]

  updated_at != last_updated_at
end

#update_from_runtime_firewall_lists_json(data) ⇒ void

This method returns an undefined value.

Parse and interpret the JSON response from the core API with updated runtime firewall lists, and apply the changes.

Parameters:

  • data (Hash) —

    the decoded JSON payload from the /api/runtime/firewall/lists API endpoint.



97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
 
# File 'lib/aikido/zen/runtime_settings.rb', line 97

def update_from_runtime_firewall_lists_json(data)
  self.blocked_user_agent_regexp = pattern(data["blockedUserAgents"])

  self.monitored_user_agent_regexp = pattern(data["monitoredUserAgents"])

  self.user_agent_details = []

  data["userAgentDetails"]&.each do |record|
    key = record["key"]
    pattern = pattern(record["pattern"])

    next if key.nil? || pattern.nil?

    user_agent_details << {
      key: key,
      pattern: pattern
    }
  end
end

#user_agent_keys(user_agent) ⇒ Array<String>

Returns the matching user agent keys.

Parameters:

  • user_agent (String) —

    the user agent

Returns:

  • (Array<String>) —

    the matching user agent keys



165
166
167
168
169
170
171
 
# File 'lib/aikido/zen/runtime_settings.rb', line 165

def user_agent_keys(user_agent)
  return [] if user_agent_details.nil?

  user_agent_details
    .filter { |record| record[:pattern].match?(user_agent) }
    .map { |record| record[:key] }
end

#user_excluded_from_rate_limiting?(user_id) ⇒ Boolean

Returns Whether the user is excluded from rate limiting.

Parameters:

  • user_id (String, nil)

Returns:

  • (Boolean) —

    Whether the user is excluded from rate limiting.



142
143
144
145
 
# File 'lib/aikido/zen/runtime_settings.rb', line 142

def user_excluded_from_rate_limiting?(user_id)
  return false if user_id.nil?
  excluded_user_ids_from_rate_limiting&.include?(user_id.to_s) || false
end