Updates

Author: voltsparx

lib/asrfacet_rb.rb

@@ -57,6 +57,12 @@
 require_relative "asrfacet_rb/core/recon_memory"
 require_relative "asrfacet_rb/core/scope_engine"
 require_relative "asrfacet_rb/core/noise_filter"
+require_relative "asrfacet_rb/intelligence/open_asset_model"
+require_relative "asrfacet_rb/intelligence/asset_graph"
+require_relative "asrfacet_rb/intelligence/session_manager"
+require_relative "asrfacet_rb/intelligence/analysis/relationship_mapper"
+require_relative "asrfacet_rb/intelligence/analysis/attack_surface"
+require_relative "asrfacet_rb/intelligence/analysis/asset_differ"
 require_relative "asrfacet_rb/plugins/base"
 require_relative "asrfacet_rb/plugins/dns_enrich_plugin"
 require_relative "asrfacet_rb/passive/base_source"

lib/asrfacet_rb/event_bus.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # SPDX-License-Identifier: Proprietary
 #
 # ASRFacet-Rb: Attack Surface Reconnaissance Framework
@@ -11,33 +12,16 @@
 # This file is part of ASRFacet-Rb and is subject to the terms
 # and conditions defined in the LICENSE file.
 
+require "concurrent"
 require "thread"
 require "time"
 
 module ASRFacet
   class EventBus
     DEFAULT_MAX_QUEUE = 1_000
 
-    EVENT_TYPES = %i[
-      domain
-      subdomain
-      dns_record
-      ip_address
-      open_port
-      http_response
-      ssl_cert
-      finding
-      error
-      asn
-      crawl
-      js_endpoint
-      correlation
-      service
-      stage
-    ].freeze
-
     def initialize(max_queue: DEFAULT_MAX_QUEUE, logger: ASRFacet::Core::ThreadSafe)
-      @subscribers = Hash.new { |hash, key| hash[key] = [] }
+      @handlers = Concurrent::Map.new { |hash, key| hash[key] = [] }
       @max_queue = max_queue.to_i.positive? ? max_queue.to_i : DEFAULT_MAX_QUEUE
       @queue = SizedQueue.new(@max_queue)
       @mutex = Mutex.new
@@ -49,59 +33,41 @@ def initialize(max_queue: DEFAULT_MAX_QUEUE, logger: ASRFacet::Core::ThreadSafe)
         blocked_pushes: 0
       }
       @accepting = true
-    rescue StandardError
-      @subscribers = Hash.new { |hash, key| hash[key] = [] }
-      @queue = Queue.new
-      @mutex = Mutex.new
-      @logger = logger
-      @max_queue = DEFAULT_MAX_QUEUE
-      @stats = { emitted: 0, dispatched: 0, dropped: 0, blocked_pushes: 0 }
-      @accepting = true
-    end
-
-    def stats
-      @mutex.synchronize do
-        @stats.merge(
-          subscribers: @subscribers.transform_values(&:size),
-          queue_depth: queue_depth,
-          max_queue: @max_queue,
-          accepting: @accepting
-        )
-      end
-    rescue StandardError
-      { emitted: 0, dispatched: 0, dropped: 0, blocked_pushes: 0, subscribers: {}, queue_depth: 0, max_queue: @max_queue, accepting: false }
     end
 
-    def subscribe(event_type, &block)
-      return nil unless EVENT_TYPES.include?(event_type.to_sym) && block
+    def on(event, priority: 50, &block)
+      return nil unless block
 
       @mutex.synchronize do
-        @subscribers[event_type.to_sym] << block
+        entries = Array(@handlers[event.to_sym]).dup
+        entries << { priority: priority.to_i, handler: block }
+        entries.sort_by! { |entry| entry[:priority] }
+        @handlers[event.to_sym] = entries
       end
       true
-    rescue StandardError
-      nil
     end
 
-    def emit(event_type, data, dispatch_now: false, non_block: false)
-      return nil unless EVENT_TYPES.include?(event_type.to_sym)
+    def subscribe(event, priority: 50, &block)
+      on(event, priority: priority, &block)
+    end
+
+    def emit(event, payload = {}, dispatch_now: false, non_block: false)
       return nil unless accepting?
 
-      event = {
-        type: event_type.to_sym,
-        data: data,
-        timestamp: Time.now.iso8601
+      entry = {
+        type: event.to_sym,
+        data: payload,
+        timestamp: Time.now.utc.iso8601
       }
       increment_stat(:emitted)
+
       if dispatch_now
-        dispatched = dispatch(event)
-        dispatched ? event : nil
+        dispatch(entry)
+        entry
       else
-        queued = queue_event(event, non_block: non_block)
-        queued ? event : nil
+        queued = queue_event(entry, non_block: non_block)
+        queued ? entry : nil
       end
-    rescue StandardError
-      nil
     end
 
     def process_all
@@ -111,49 +77,57 @@ def process_all
       end
     rescue ThreadError
       true
-    rescue StandardError
-      nil
     end
 
     def drain_async(workers: 10)
-      count = [workers.to_i, 1].max
-      Array.new(count) do
+      Array.new([workers.to_i, 1].max) do
         Thread.new do
           loop do
             event = @queue.pop
             break if event.nil?
 
             dispatch(event)
-          rescue StandardError
-            nil
           end
         end
       end
-    rescue StandardError
-      []
     end
 
     def stop(workers:)
       @mutex.synchronize { @accepting = false }
       [workers.to_i, 1].max.times { @queue << nil }
       true
-    rescue StandardError
-      nil
+    end
+
+    def handler_count(event)
+      Array(@handlers[event.to_sym]).size
+    end
+
+    def stats
+      @mutex.synchronize do
+        {
+          emitted: @stats[:emitted],
+          dispatched: @stats[:dispatched],
+          dropped: @stats[:dropped],
+          blocked_pushes: @stats[:blocked_pushes],
+          subscribers: @handlers.each_pair.each_with_object({}) { |(event, entries), memo| memo[event] = entries.size },
+          queue_depth: queue_depth,
+          max_queue: @max_queue,
+          accepting: @accepting
+        }
+      end
     end
 
     private
 
     def dispatch(event)
-      handlers = @mutex.synchronize { @subscribers[event[:type]].dup }
-      handlers.each do |handler|
-        handler.call(event[:data])
-      rescue StandardError
-        nil
+      handlers = Array(@handlers[event[:type]]).dup
+      handlers.each do |entry|
+        entry[:handler].call(event[:data])
+      rescue ASRFacet::Error => e
+        @logger&.print_warning("Event handler error for #{event[:type]}: #{e.message}")
       end
       increment_stat(:dispatched)
       true
-    rescue StandardError
-      nil
     end
 
     def queue_event(event, non_block: false)
@@ -167,35 +141,25 @@ def queue_event(event, non_block: false)
     rescue ThreadError
       increment_stat(:dropped)
       @logger&.print_warning("Event bus queue is full; dropping #{event[:type]} event.")
-      nil
-    rescue StandardError
-      nil
+      false
     end
 
     def increment_stat(key)
-      @mutex.synchronize { @stats[key] = @stats[key].to_i + 1 }
-    rescue StandardError
-      nil
+      @mutex.synchronize do
+        @stats[key] = @stats[key].to_i + 1
+      end
     end
 
     def queue_depth
       @queue.respond_to?(:length) ? @queue.length : @queue.size
-    rescue StandardError
-      0
     end
 
     def queue_full?
-      return false unless @queue.is_a?(SizedQueue)
-
       queue_depth >= @max_queue
-    rescue StandardError
-      false
     end
 
     def accepting?
       @mutex.synchronize { @accepting }
-    rescue StandardError
-      false
     end
   end
 end

lib/asrfacet_rb/graph/exporter.rb

@@ -34,7 +34,7 @@ def to_dot
         end
         lines << ""
         @graph.edges.each do |edge|
-          lines << "  \"#{edge[:from]}\" -> \"#{edge[:to]}\" [label=\"#{edge[:rel] || edge[:relation]}\"];"
+          lines << "  \"#{edge[:from] || edge[:from_id]}\" -> \"#{edge[:to] || edge[:to_id]}\" [label=\"#{edge[:rel] || edge[:relation] || edge[:type]}\"];"
         end
         lines << "}"
         lines.join("\n")
@@ -55,10 +55,12 @@ def to_json_graph
       def to_mermaid
         lines = ["graph LR"]
         @graph.edges.each do |edge|
-          from = mermaid_id(edge[:from])
-          to = mermaid_id(edge[:to])
-          rel = edge[:rel] || edge[:relation]
-          lines << "  #{from}[\"#{edge[:from]}\"] -->|#{rel}| #{to}[\"#{edge[:to]}\"]"
+          edge_from = edge[:from] || edge[:from_id]
+          edge_to = edge[:to] || edge[:to_id]
+          from = mermaid_id(edge_from)
+          to = mermaid_id(edge_to)
+          rel = edge[:rel] || edge[:relation] || edge[:type]
+          lines << "  #{from}[\"#{edge_from}\"] -->|#{rel}| #{to}[\"#{edge_to}\"]"
         end
         lines.join("\n")
       end
@@ -72,11 +74,18 @@ def dot_label(node)
       def dot_color(type)
         {
           domain: "#AED6F1",
+          fqdn: "#A9DFBF",
           subdomain: "#A9DFBF",
           ip: "#FAD7A0",
+          ip_address: "#FAD7A0",
+          netblock: "#F5CBA7",
           port: "#F1948A",
           service: "#F1948A",
           asn: "#D7BDE2",
+          as_desc: "#D2B4DE",
+          certificate: "#F7DC6F",
+          technology: "#82E0AA",
+          email: "#AED6F1",
           finding: "#F9E79F"
         }.fetch(type&.to_sym, "#EAECEE")
       end