Skip to content

Commit f8cd188

Browse files
yoloyyhyoloyyh
committed
feat process version check
1 parent bac50ac commit f8cd188

File tree

4 files changed

+81
-30
lines changed

4 files changed

+81
-30
lines changed

‎rasp/librasp/src/jvm.rs

+19
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,25 @@ pub fn vm_version(pid: i32) -> Result<i32> {
143143
};
144144
}
145145

146+
pub fn check_java_version(ver: &String, pid:i32) -> Result<()> {
147+
let ver:u32 = match ver.parse::<u32>() {
148+
Ok(v) => {v}
149+
Err(_) => {0}
150+
};
151+
if ver < 8 {
152+
warn!("process {} Java version lower than 8: {}, so not inject", pid, ver);
153+
let msg = format!("Java version lower than 8: {}, so not inject", ver);
154+
return Err(anyhow!(msg));
155+
} else if ver == 13 || ver == 14 {
156+
// jdk bug https://bugs.openjdk.org/browse/JDK-8222005
157+
warn!("process {} Java version {} has attach bug, so not inject", pid, ver);
158+
let msg = format!("process {} Java version {} has attach bug, so not inject", pid, ver);
159+
return Err(anyhow!(msg));
160+
} else {
161+
return Ok(());
162+
}
163+
}
164+
146165
pub fn prop(pid: i32) -> Result<ProbeState> {
147166
return match jcmd(pid, " VM.system_properties") {
148167
Ok(stdout) => {

‎rasp/librasp/src/manager.rs

+28-2
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ use log::*;
1212

1313
use crate::cpython::{python_attach, CPythonProbe, CPythonProbeState};
1414
use crate::golang::{golang_attach, GolangProbe, GolangProbeState};
15-
use crate::jvm::{java_attach, java_detach, JVMProbe, JVMProbeState};
16-
use crate::nodejs::{nodejs_attach, NodeJSProbe};
15+
use crate::jvm::{check_java_version, java_attach, java_detach, JVMProbe, JVMProbeState};
16+
use crate::nodejs::{check_nodejs_version, nodejs_attach, NodeJSProbe};
1717
use crate::php::{php_attach, PHPProbeState};
1818
use crate::{
1919
comm::{Control, EbpfMode, ProcessMode, RASPComm, ThreadMode, check_need_mount},
@@ -334,6 +334,14 @@ impl RASPManager {
334334
Ok(true)
335335
}
336336
ProbeState::NotAttach => {
337+
if !runtime_info.version.is_empty() {
338+
match check_java_version(&runtime_info.version, pid) {
339+
Ok(_) => {}
340+
Err(e) => {
341+
return Err(anyhow!(e));
342+
}
343+
}
344+
}
337345
if self.can_copy(mnt_namespace) {
338346
for from in JVMProbe::names().0.iter() {
339347
self.copy_file_from_to_dest(from.clone(), root_dir.clone())?;
@@ -342,9 +350,19 @@ impl RASPManager {
342350
self.copy_dir_from_to_dest(from.clone(), root_dir.clone())?;
343351
}
344352
}
353+
345354
java_attach(process_info.pid)
355+
346356
}
347357
ProbeState::AttachedVersionNotMatch => {
358+
if !runtime_info.version.is_empty() {
359+
match check_java_version(&runtime_info.version, pid) {
360+
Ok(_) => {}
361+
Err(e) => {
362+
return Err(anyhow!(e));
363+
}
364+
}
365+
}
348366
let mut diff_ns:bool = false;
349367
match check_need_mount(mnt_namespace) {
350368
Ok(value) => {
@@ -473,6 +491,14 @@ impl RASPManager {
473491
}
474492
},
475493
"NodeJS" => {
494+
if !runtime_info.version.is_empty() {
495+
match check_nodejs_version(&runtime_info.version) {
496+
Ok(_) => {}
497+
Err(e) => {
498+
return Err(anyhow!(e));
499+
}
500+
}
501+
}
476502
if self.can_copy(mnt_namespace) {
477503
for from in NodeJSProbe::names().0.iter() {
478504
self.copy_file_from_to_dest(from.clone(), root_dir.clone())?;

‎rasp/librasp/src/nodejs.rs

+33
Original file line numberDiff line numberDiff line change
@@ -150,3 +150,36 @@ pub fn nodejs_version(pid: i32, nodejs_bin_path: &String) -> Result<(u32, u32, S
150150
};
151151
Ok((major_number, minor_number, String::from(version)))
152152
}
153+
154+
pub fn check_nodejs_version(ver: &String) -> Result<()> {
155+
let major_minor: Option<(u32, u32)> = match ver.split('.').next() {
156+
Some(major_str) => {
157+
if let Ok(major) = major_str.parse::<u32>() {
158+
if let Some(minor_str) = ver.split('.').nth(1) {
159+
if let Ok(minor) = minor_str.parse::<u32>() {
160+
Some((major, minor))
161+
} else {
162+
None
163+
}
164+
} else {
165+
Some((major, 0))
166+
}
167+
} else {
168+
None
169+
}
170+
}
171+
None => None,
172+
};
173+
174+
if let Some((major, minor)) = major_minor {
175+
if major > 8 || (major == 8 && minor >= 6) {
176+
return Ok(());
177+
} else {
178+
let msg = format!("nodejs version lower than 8.6: {}", ver);
179+
return Err(anyhow!(msg));
180+
}
181+
} else {
182+
let msg = format!("nodejs version cannot parse: {}", ver);
183+
return Err(anyhow!(msg));
184+
}
185+
}

‎rasp/librasp/src/runtime.rs

+1-28
Original file line numberDiff line numberDiff line change
@@ -112,28 +112,11 @@ pub trait RuntimeInspect {
112112
Err(e) => info!("Failed to check '+DisableAttachMechanism': {}", e),
113113
}
114114

115-
// https://bugs.openjdk.org/browse/JDK-8292695
116-
// let uptime = count_uptime(process_info.start_time.unwrap()).unwrap_or(0);
117-
// if uptime > 0 && uptime < 5 {
118-
// let interval = 5 - uptime;
119-
// info!("JVM process {} just start, so sleep {} sec", process_info.pid, interval);
120-
// std::thread::sleep(Duration::from_secs(interval));
121-
// }
122115
match Self::check_signal_dispatch(process_info.pid) {
123116
Ok(v) => {
124117
if v == true {
125118
let version = match vm_version(process_info.pid) {
126119
Ok(ver) => {
127-
if ver < 8 {
128-
warn!("process {} Java version lower than 8: {}, so not inject", process_info.pid, ver);
129-
let msg = format!("Java version lower than 8: {}, so not inject", ver);
130-
return Err(anyhow!(msg));
131-
} else if ver == 13 || ver == 14 {
132-
// jdk bug https://bugs.openjdk.org/browse/JDK-8222005
133-
warn!("process {} Java version {} has attach bug, so not inject", process_info.pid, ver);
134-
let msg = format!("process {} Java version {} has attach bug, so not inject", process_info.pid, ver);
135-
return Err(anyhow!(msg));
136-
}
137120
ver.to_string()
138121
}
139122
Err(e) => {
@@ -193,17 +176,7 @@ pub trait RuntimeInspect {
193176
};
194177
if nodejs_process_filter_check_reuslt {
195178
let version = match nodejs_version(process_info.pid, &process_exe_file) {
196-
Ok((major, minor, v)) => {
197-
if major < 8 {
198-
let msg = format!("nodejs version lower than 8.6: {}", v);
199-
return Err(anyhow!(msg));
200-
}
201-
if major == 8 {
202-
if minor < 6 {
203-
let msg = format!("nodejs version lower than 8.6: {}", v);
204-
return Err(anyhow!(msg));
205-
}
206-
}
179+
Ok((_, _, v)) => {
207180
v
208181
}
209182
Err(e) => {

0 commit comments

Comments
 (0)