Confidential & proprietary © Sqreen, 2015

We make products antifragile.

https://www.sqreen.io

Instrument Rack to visualize Rails requests processing

© Sqreen, 2015https://www.sqreen.io

Jean-Baptiste AviatSqreen CTO (https://sqreen.io)

Former Apple software security engineer

Former white hat hacker

Twitter: @JbAviat

Mail: jb@sqreen.io

© Sqreen, 2015https://www.sqreen.io

What is Rack ?« Interface between webservers and frameworks »

Ruby framework: Rails, Sinatra…

Ruby server: Webrick, Puma, Mongrel…

require 'rack' app = Proc.new do |env| [‘200', {'Content-Type' => ‘text/html'}, [Time.now.to_s] ] end Rack::Handler::WEBrick.run app

© Sqreen, 2015https://www.sqreen.io

Rails with Rack request processingAround 6000 lines of code

No strict boundaries: frameworks rely on Rack for some tasks

Need to instrument low level HTTP calls

Sinatra

Rails with Grape

Needed a clear and simple Rack knowledge

© Sqreen, 2015https://www.sqreen.io

Instrumentation: what is it?Hooking into software to modify original behavior

Display Rack actions

x86 compiled code

3 engineers for 1 month work, databases, ASM

Ruby code

3 lines and 1 minute

© Sqreen, 2015https://www.sqreen.io

Ruby instrumentation capabilitiesKernel#set_trace_func

Arguments are:

1. An event name (call, line, return…)

2. A filename and a line number

3. An object id

4. A binding

5. The name of a class

set_trace_func proc { |*args| puts args

}

© Sqreen, 2015https://www.sqreen.io

Find the needle in the haystackThe Binding class holds a block binding

You can inspect anything in any line of code

binding.local_variables.each do |var|

val = binding.local_variable_get var if val.is_a? String and val.include? query puts "#{classname}.#{event} (#{file}:#{line} - #{val}" end end

}

© Sqreen, 2015https://www.sqreen.io

Function identification exampleLocate where the SqreenUA User-Agent is processed:

In Sinatra output:

$ curl -A SqreenUA localhost:4567/hi

Regexp.c-return (webrick/httprequest.rb:436) `User-Agent: SqreenUA` Kernel.c-return (webrick/httputils.rb:140) `Host: localhost:4567 User-Agent: SqreenUA Accept: */*` […] String.c-return (webrick/httprequest.rb:403) - `SqreenUA` Kernel.c-return (/rack/handler/webrick.rb:60) - `SqreenUA`

© Sqreen, 2015https://www.sqreen.io

Modules involved in request processing

© Sqreen, 2015https://www.sqreen.io

Instruction count (most used classes)

© Sqreen, 2015https://www.sqreen.io

Instruction count (exhaustive)

© Sqreen, 2015https://www.sqreen.io

Sqreen: you code, we protectWe automatically protect your apps

Strong and transparent

Beta program available:

Come and see me if you have Rails or Sinatra based applications

Sqreen is growing…

jobs@sqreen.io