Ensure metasploit rpc service is warmed and healthy up before accepting requests

[adfoster-r7]

Before

The metasploit service boots up, and defers creating a framework object until the first request to the running RPC service is received. This then triggers database connections, migrations, etc, which can raise errors:

After

The sinatra application is first warmed up, and verified that it has successfully booted up before attempting to bind the rpc service on the host and allow connections.

Verification

Run the application and ensure it works:

bundle exec thin --rackup msf-json-rpc.ru --address 0.0.0.0 --port 8081 --environment production --tag msf-json-rpc start

With Puma:

bundle exec puma msf-json-rpc.ru --port 8081 --environment production --tag msf-json-rpc start

Now break something within the rpc service, easiest solution is modifying anywhere in framework to raise an unexpected exception. I divided by zero in the core/framework.rb initialize method for instance:

bundle exec thin --rackup msf-json-rpc.ru --address 0.0.0.0 --port 8081 --environment production --tag msf-json-rpc start

[-] There was an error executing the RPC: divided by 0.
    Call Stack:
...
msf-json-rpc.ru:52:in `block (2 levels) in <main>': Metasploit JSON RPC did not successfully start up. Unexpected response returned: {"jsonrpc":"2.0","error":{"code":-32603,"message":"Internal JSON-RPC error: divided by 0"},"id":null} (RuntimeError)

Ensure that curl requests still work:

curl --request POST \
  --url http://localhost:8081/api/v1/json-rpc \
  --header 'Content-Type: application/json' \
  --data '{
        "jsonrpc": "2.0",
        "method": "db.workspaces",
        "id": 1,
        "params": []
}'

Curling the health check:

curl --request POST \
  --url http://localhost:8081/api/v1/json-rpc \
  --header 'Content-Type: application/json' \
  --data '{
        "jsonrpc": "2.0",
        "method": "health.check",
        "id": 1,
        "params": []
}'

Verifying RPC client

Run the the server:

bundle exec ruby ./msfrpcd -P foo -f

[*] MSGRPC starting on 0.0.0.0:55553 (SSL):Msg...
[*] MSGRPC ready at 2021-04-14 23:28:04 +0100.

Connect with the client and confirm that the new method works as expected:

bundle exec ruby ./msfrpc -P foo -a 127.0.0.1
rpc.call('health.check')[*] The 'rpc' object holds the RPC client interface
[*] Use rpc.call('group.command') to make RPC calls

>> rpc.call('health.check')
=> {"status"=>"UP"}

[adfoster-r7]

@msjenkins-r7 retest this please

[cgranleese-r7]

Before

After

Ran the application and everything works as expected:

Ran with Puma:

Breaking something within the rpc service:

Ensure that curl requests still work:

Curling the health check:

Run the the server:

Connect with the client and confirm that the new method works as expected:

All looks good to me 👍

[cgranleese-r7]

Release Notes

Fixed errors which could occur on the first call to the Metasploit JSON RPC service. Now we ensure that the Metasploit JSON RPC service is warmed and healthy up before accepting requests.