Releases: jvm-rasp/jrasp-agent
Releases · jvm-rasp/jrasp-agent
v1.1.5
v1.1.4
1.1.4 【2023-10-26】
Enhancement
- [module] 增加自定义的响应头X-Protected-By:JRASP
- [module] 增加java.io.file#createNewFile的hook
- [module] 增加http response的hook和检测模块
Bugfix
- [module] 修复xxe模块运行类转换失败问题
- [agent] 修复日志路径初始化为空的bug
- [module] 修复请求中contentType判断bug
- [module] 修复xml反序列化漏报问题
- [daemon] 修复启动脚本service.sh进程错误识别问题
- [daemon] 解决进程延迟上报bug
v1.1.3
1.1.3 【2023-09-09】
1.1.3 主要以修复bug为主,新特性暂缓合入
Enhancement
- [module] 重构JNDI检测模块
- [daemon] 新增jrasp-daemon打开文件数量监控
- [daemon] 新增jdk反序列化黑名单
Bugfix
- [module] 修复http-hook类型转换失败的bug
- [module] 扫描器特征识别优化,防止误报
- [daemon] 修复json反序列化检测异常
- [module] 获取http请求参数置后
- [daemon] PathExists优化解决cpu飙高问题
- [daemon] 解决进程延迟上报bug
v1.1.2
1.1.2 【2023-07-26】
1.1.2 主要以修复bug为主,新特性暂缓合入
Enhancement
- [agent] 增加jvm性能监控
- [module] 新增shiro检测模块
Bugfix
- [module] xercesImpl 2.6.2 版本没有实现setFeature方法,调用会报错的问题
- [module] 修复xml反序列化类型转换错误问题
- [daemon] 修复docker主机名称获取bug
- [module] 修复sql检测算法cpu耗时高的问题
- [module] 修复命令token分割失败问题
- [module] 修复xml反序列化类参数读取错误
TODO
- [daemon] 支持容器&进程运行时注入
- [agent] jrasp agent内置 filebeat
- [module] 模块参数根据注解自动生成
v1.1.1-20230621
- bug 修复
- 增加性能监控
v1.1.1-20230616
Merge pull request #23 from jvm-rasp/dev-20230615 代码优化
v1.1.1-20230513
Merge pull request #20 from jvm-rasp/v1.1.1 V1.1.1
v1.1.0
v1.0.4
-
增加native 方法hook;
-
插桩模块和算法模块拆分,降低字节码转换频率;
-
linux 系统一键运行
第一步:安装jrasp (复制下面的命令在终端运行)
## 安装包下载
wget https://jrasp-daemon-1254321150.cos.ap-shanghai.myqcloud.com/2022-04-04/v1.0.4/jrasp-1.0.4.tar.gz
tar -xvf jrasp-1.0.4.tar.gz -C /usr/local/
## 配置守护进程
cat << EOF > /usr/lib/systemd/system/jrasp-daemon.service
[Unit]
Description=jrasp-daemon service
[Service]
Type=simple
WorkingDirectory=/usr/local/jrasp/bin
ExecStart=/usr/local/jrasp/bin/startup.sh
ExecStop=/usr/local/jrasp/bin/shutdown.sh
Restart=always
[Install]
WantedBy=multi-user.target
EOF
## 设置开机启动与自动拉起
systemctl daemon-reload;
systemctl enable jrasp-daemon.service;
systemctl stop jrasp-daemon.service;
systemctl start jrasp-daemon.service;
systemctl status jrasp-daemon.service;
第二步:安装filebeat (复制下面的命令在终端运行)
## 日志目录
logDir=/usr/local/jrasp/logs
## fileBeat 安装目录
fileBeatHome=/opt/filebeat
cd /opt/ && yum install wget -y && wget https://repo.huaweicloud.com/filebeat/7.9.1/filebeat-7.9.1-linux-x86_64.tar.gz;
tar -zxvf filebeat-7.9.1-linux-x86_64.tar.gz -C /opt/ && mv filebeat-7.9.1-linux-x86_64 filebeat && rm -rf filebeat-7.9.1-linux-x86_64.tar.gz;
cat << EOF > ${fileBeatHome}/filebeat.yml
filebeat.inputs:
- type: log
fields:
kafka_topic: "jrasp-daemon"
paths:
- ${logDir}/jrasp-daemon.log
- type: log
fields:
kafka_topic: "jrasp-agent"
paths:
- ${logDir}/jrasp-agent.log
- type: log
fields:
kafka_topic: "jrasp-module"
paths:
- ${logDir}/jrasp-module.log
filebeat.config.modules:
path: \${path.config}/modules.d/*.yml
reload.enabled: false
setup.template.settings:
index.number_of_shards: 1
output.kafka:
enabled: true
hosts: ["106.14.26.4:9092","47.101.64.183:9092","139.224.220.2:9092"]
topic: '%{[fields.kafka_topic]}'
processors:
- add_host_metadata:
when.not.contains.tags: forwarded
- add_cloud_metadata: ~
- add_docker_metadata: ~
- add_kubernetes_metadata: ~
processors:
- decode_json_fields:
fields: ['message']
target: ''
overwrite_keys: true
- drop_fields:
fields: ["host","agent","log","input","ecs","@timestamp"]
logging.level: info
EOF
## systemctl
cat << EOF > /usr/lib/systemd/system/filebeat.service
[Unit]
Description=filebeat
Wants=network-online.target
After=network-online.target
[Service]
User=root
ExecStart=${fileBeatHome}/filebeat -c ${fileBeatHome}/filebeat.yml
Restart=always
[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload && systemctl enable filebeat.service;
systemctl stop filebeat.service && systemctl start filebeat.service;
systemctl status filebeat.service;