tcell_agent 0.2.12 → 0.2.13

data/spec/lib/tcell_agent/policies/appsensor_policy_spec.rb

@@ -2,36 +2,469 @@ require 'spec_helper'
 
 module TCellAgent
   module Policies
+
     describe AppSensorPolicy do
-      policy_json_empty = {
-        "policy_id"=>"01a1",
-        "data"=>{
-          "options"=>{}
-        }
-      }
-
-      policy_json_one = {
-        "policy_id"=>"01a1",
-        "data"=>{
-          "options"=>{
-            "xss"=>true
-          }
-        }
-      }
-
-      empty_policy = AppSensorPolicy.fromJson(policy_json_empty)
-      context "test empty agent" do
-        it "enabled is false" do
-          expect(empty_policy.policy_id).to eq("01a1")
-          expect(empty_policy.enabled).to eq(false)
+
+      describe "#from_json" do
+
+        context "with v1 policy" do
+          context "that is missing a policy id" do
+            it "should raise an error" do
+              expect{
+                AppSensorPolicy.from_json({
+                  "data" => { "options" => {} }
+                })
+              }.to raise_error(RuntimeError)
+            end
+          end
+
+          context "that is empty" do
+            it "should have all sensors disabled" do
+              expect_any_instance_of(AppSensorRuleManager).to receive(:load_default_rules_file)
+
+              policy_json_empty = {
+                "policy_id" => "01a1",
+                "data" => {
+                  "options"=> {}
+                }
+              }
+
+              empty_policy = AppSensorPolicy.from_json(policy_json_empty)
+
+              expect(empty_policy.policy_id).to eq("01a1")
+              expect(empty_policy.options["req_size"]).to_not be_nil
+              expect(empty_policy.options["resp_size"]).to_not be_nil
+              expect(empty_policy.options["resp_codes"]).to_not be_nil
+              expect(empty_policy.options["xss"]).to_not be_nil
+              expect(empty_policy.options["sqli"]).to_not be_nil
+              expect(empty_policy.options["cmdi"]).to_not be_nil
+              expect(empty_policy.options["fpt"]).to_not be_nil
+              expect(empty_policy.options["nullbyte"]).to_not be_nil
+              expect(empty_policy.options["retr"]).to_not be_nil
+              expect(empty_policy.options["login"]).to_not be_nil
+
+              expect(empty_policy.options["req_size"].enabled).to eq(false)
+              expect(empty_policy.options["resp_size"].enabled).to eq(false)
+              expect(empty_policy.options["resp_codes"].enabled).to eq(false)
+              expect(empty_policy.options["xss"].enabled).to eq(false)
+              expect(empty_policy.options["sqli"].enabled).to eq(false)
+              expect(empty_policy.options["cmdi"].enabled).to eq(false)
+              expect(empty_policy.options["fpt"].enabled).to eq(false)
+              expect(empty_policy.options["nullbyte"].enabled).to eq(false)
+              expect(empty_policy.options["retr"].enabled).to eq(false)
+              expect(empty_policy.options["login"].enabled).to eq(false)
+
+              expect(empty_policy.options["xss"].v1_compatability_enabled).to eq(true)
+              expect(empty_policy.options["sqli"].v1_compatability_enabled).to eq(true)
+              expect(empty_policy.options["cmdi"].v1_compatability_enabled).to eq(true)
+              expect(empty_policy.options["fpt"].v1_compatability_enabled).to eq(true)
+              expect(empty_policy.options["nullbyte"].v1_compatability_enabled).to eq(true)
+              expect(empty_policy.options["retr"].v1_compatability_enabled).to eq(true)
+            end
+          end
+
+          context "that only has null enabled" do
+            it "should only have null enabled" do
+              expect_any_instance_of(AppSensorRuleManager).to receive(:load_default_rules_file)
+
+              policy_json = {
+                "policy_id" => "01a1",
+                "data" => {
+                  "options"=> {"null"=>true}
+                }
+              }
+
+              policy = AppSensorPolicy.from_json(policy_json)
+
+              expect(policy.policy_id).to eq("01a1")
+              expect(policy.options["req_size"]).to_not be_nil
+              expect(policy.options["resp_size"]).to_not be_nil
+              expect(policy.options["resp_codes"]).to_not be_nil
+              expect(policy.options["xss"]).to_not be_nil
+              expect(policy.options["sqli"]).to_not be_nil
+              expect(policy.options["cmdi"]).to_not be_nil
+              expect(policy.options["fpt"]).to_not be_nil
+              expect(policy.options["nullbyte"]).to_not be_nil
+              expect(policy.options["retr"]).to_not be_nil
+              expect(policy.options["login"]).to_not be_nil
+
+              expect(policy.options["req_size"].enabled).to eq(false)
+              expect(policy.options["resp_size"].enabled).to eq(false)
+              expect(policy.options["resp_codes"].enabled).to eq(false)
+              expect(policy.options["xss"].enabled).to eq(false)
+              expect(policy.options["sqli"].enabled).to eq(false)
+              expect(policy.options["cmdi"].enabled).to eq(false)
+              expect(policy.options["fpt"].enabled).to eq(false)
+              expect(policy.options["nullbyte"].enabled).to eq(true)
+              expect(policy.options["retr"].enabled).to eq(false)
+              expect(policy.options["login"].enabled).to eq(false)
+
+              expect(policy.options["xss"].v1_compatability_enabled).to eq(true)
+              expect(policy.options["sqli"].v1_compatability_enabled).to eq(true)
+              expect(policy.options["cmdi"].v1_compatability_enabled).to eq(true)
+              expect(policy.options["fpt"].v1_compatability_enabled).to eq(true)
+              expect(policy.options["nullbyte"].v1_compatability_enabled).to eq(true)
+              expect(policy.options["retr"].v1_compatability_enabled).to eq(true)
+            end
+          end
+
+          context "that only has xss enabled" do
+            it "should only have xss enabled" do
+              expect_any_instance_of(AppSensorRuleManager).to receive(:load_default_rules_file)
+
+              policy_json = {
+                "policy_id" => "01a1",
+                "data" => {
+                  "options"=> {"xss"=>true}
+                }
+              }
+
+              empty_policy = AppSensorPolicy.from_json(policy_json)
+
+              expect(empty_policy.policy_id).to eq("01a1")
+              expect(empty_policy.options["req_size"]).to_not be_nil
+              expect(empty_policy.options["resp_size"]).to_not be_nil
+              expect(empty_policy.options["resp_codes"]).to_not be_nil
+              expect(empty_policy.options["xss"]).to_not be_nil
+              expect(empty_policy.options["sqli"]).to_not be_nil
+              expect(empty_policy.options["cmdi"]).to_not be_nil
+              expect(empty_policy.options["fpt"]).to_not be_nil
+              expect(empty_policy.options["nullbyte"]).to_not be_nil
+              expect(empty_policy.options["retr"]).to_not be_nil
+              expect(empty_policy.options["login"]).to_not be_nil
+
+              expect(empty_policy.options["req_size"].enabled).to eq(false)
+              expect(empty_policy.options["resp_size"].enabled).to eq(false)
+              expect(empty_policy.options["resp_codes"].enabled).to eq(false)
+              expect(empty_policy.options["xss"].enabled).to eq(true)
+              expect(empty_policy.options["sqli"].enabled).to eq(false)
+              expect(empty_policy.options["cmdi"].enabled).to eq(false)
+              expect(empty_policy.options["fpt"].enabled).to eq(false)
+              expect(empty_policy.options["nullbyte"].enabled).to eq(false)
+              expect(empty_policy.options["retr"].enabled).to eq(false)
+              expect(empty_policy.options["login"].enabled).to eq(false)
+
+              expect(empty_policy.options["xss"].v1_compatability_enabled).to eq(true)
+              expect(empty_policy.options["sqli"].v1_compatability_enabled).to eq(true)
+              expect(empty_policy.options["cmdi"].v1_compatability_enabled).to eq(true)
+              expect(empty_policy.options["fpt"].v1_compatability_enabled).to eq(true)
+              expect(empty_policy.options["nullbyte"].v1_compatability_enabled).to eq(true)
+              expect(empty_policy.options["retr"].v1_compatability_enabled).to eq(true)
+            end
+          end
+
+          context "that has everything enabled" do
+            it "should have all sensors enabled" do
+              expect_any_instance_of(AppSensorRuleManager).to receive(:load_default_rules_file)
+
+              policy_json = {
+                "policy_id" => "01a1",
+                "data" => {
+                  "options"=> {
+                    "req_res_size"=>true,
+                    "resp_codes"=>true,
+                    "xss"=>true,
+                    "sqli"=>true,
+                    "cmdi"=>true,
+                    "fpt"=>true,
+                    "null"=>true,
+                    "retr"=>true,
+                    "login_failure"=>true
+                  }
+                }
+              }
+
+              policy = AppSensorPolicy.from_json(policy_json)
+
+              expect(policy.policy_id).to eq("01a1")
+              expect(policy.options["req_size"]).to_not be_nil
+              expect(policy.options["resp_size"]).to_not be_nil
+              expect(policy.options["resp_codes"]).to_not be_nil
+              expect(policy.options["xss"]).to_not be_nil
+              expect(policy.options["sqli"]).to_not be_nil
+              expect(policy.options["cmdi"]).to_not be_nil
+              expect(policy.options["fpt"]).to_not be_nil
+              expect(policy.options["nullbyte"]).to_not be_nil
+              expect(policy.options["retr"]).to_not be_nil
+              expect(policy.options["login"]).to_not be_nil
+
+              expect(policy.options["req_size"].enabled).to eq(true)
+              expect(policy.options["resp_size"].enabled).to eq(true)
+              expect(policy.options["resp_codes"].enabled).to eq(true)
+              expect(policy.options["xss"].enabled).to eq(true)
+              expect(policy.options["sqli"].enabled).to eq(true)
+              expect(policy.options["cmdi"].enabled).to eq(true)
+              expect(policy.options["fpt"].enabled).to eq(true)
+              expect(policy.options["nullbyte"].enabled).to eq(true)
+              expect(policy.options["retr"].enabled).to eq(true)
+              expect(policy.options["login"].enabled).to eq(true)
+
+              expect(policy.options["xss"].v1_compatability_enabled).to eq(true)
+              expect(policy.options["sqli"].v1_compatability_enabled).to eq(true)
+              expect(policy.options["cmdi"].v1_compatability_enabled).to eq(true)
+              expect(policy.options["fpt"].v1_compatability_enabled).to eq(true)
+              expect(policy.options["nullbyte"].v1_compatability_enabled).to eq(true)
+              expect(policy.options["retr"].v1_compatability_enabled).to eq(true)
+            end
+          end
         end
-      end
-      from_json = AppSensorPolicy.fromJson(policy_json_one)
-      context "tests xss is true and enabled true" do
-        it "returns true" do
-          expect(from_json.policy_id).to eq("01a1")
-          expect(from_json.enabled).to eq(true)
-          expect(from_json.option_enabled?("xss")).to eq(true)
+
+        context "with v2 policy" do
+          context "that is missing a policy id" do
+            it "should raise an error" do
+              expect{
+                AppSensorPolicy.from_json({
+                  "version" => 2,
+                  "data" => { }
+                })
+              }.to raise_error(RuntimeError)
+            end
+          end
+
+          context "that is empty" do
+            it "should have all sensors disabled" do
+              expect_any_instance_of(AppSensorRuleManager).to receive(:load_default_rules_file)
+
+              policy_json_empty = {
+                "policy_id" => "01a1",
+                "version" => 2,
+                "data" => {
+                  "sensors" => {}
+                }
+              }
+
+              empty_policy = AppSensorPolicy.from_json(policy_json_empty)
+
+              expect(empty_policy.policy_id).to eq("01a1")
+              expect(empty_policy.options["req_size"]).to_not be_nil
+              expect(empty_policy.options["resp_size"]).to_not be_nil
+              expect(empty_policy.options["resp_codes"]).to_not be_nil
+              expect(empty_policy.options["xss"]).to_not be_nil
+              expect(empty_policy.options["sqli"]).to_not be_nil
+              expect(empty_policy.options["cmdi"]).to_not be_nil
+              expect(empty_policy.options["fpt"]).to_not be_nil
+              expect(empty_policy.options["nullbyte"]).to_not be_nil
+              expect(empty_policy.options["retr"]).to_not be_nil
+              expect(empty_policy.options["login"]).to_not be_nil
+
+              expect(empty_policy.options["req_size"].enabled).to eq(false)
+              expect(empty_policy.options["resp_size"].enabled).to eq(false)
+              expect(empty_policy.options["resp_codes"].enabled).to eq(false)
+              expect(empty_policy.options["xss"].enabled).to eq(false)
+              expect(empty_policy.options["sqli"].enabled).to eq(false)
+              expect(empty_policy.options["cmdi"].enabled).to eq(false)
+              expect(empty_policy.options["fpt"].enabled).to eq(false)
+              expect(empty_policy.options["nullbyte"].enabled).to eq(false)
+              expect(empty_policy.options["retr"].enabled).to eq(false)
+              expect(empty_policy.options["login"].enabled).to eq(false)
+
+              expect(empty_policy.options["xss"].v1_compatability_enabled).to eq(false)
+              expect(empty_policy.options["sqli"].v1_compatability_enabled).to eq(false)
+              expect(empty_policy.options["cmdi"].v1_compatability_enabled).to eq(false)
+              expect(empty_policy.options["fpt"].v1_compatability_enabled).to eq(false)
+              expect(empty_policy.options["nullbyte"].v1_compatability_enabled).to eq(false)
+              expect(empty_policy.options["retr"].v1_compatability_enabled).to eq(false)
+            end
+          end
+
+          context "that only has null enabled" do
+            it "should only have null enabled" do
+              expect_any_instance_of(AppSensorRuleManager).to receive(:load_default_rules_file)
+
+              policy_json = {
+                "policy_id" => "01a1",
+                "version" => 2,
+                "data" => {
+                  "sensors" => {
+                    "nullbyte" => {
+                       "patterns" => ["1","2"]
+                    }
+                  }
+                }
+              }
+
+              policy = AppSensorPolicy.from_json(policy_json)
+
+              expect(policy.policy_id).to eq("01a1")
+              expect(policy.options["req_size"]).to_not be_nil
+              expect(policy.options["resp_size"]).to_not be_nil
+              expect(policy.options["resp_codes"]).to_not be_nil
+              expect(policy.options["xss"]).to_not be_nil
+              expect(policy.options["sqli"]).to_not be_nil
+              expect(policy.options["cmdi"]).to_not be_nil
+              expect(policy.options["fpt"]).to_not be_nil
+              expect(policy.options["nullbyte"]).to_not be_nil
+              expect(policy.options["retr"]).to_not be_nil
+              expect(policy.options["login"]).to_not be_nil
+
+              expect(policy.options["req_size"].enabled).to eq(false)
+              expect(policy.options["resp_size"].enabled).to eq(false)
+              expect(policy.options["resp_codes"].enabled).to eq(false)
+              expect(policy.options["xss"].enabled).to eq(false)
+              expect(policy.options["sqli"].enabled).to eq(false)
+              expect(policy.options["cmdi"].enabled).to eq(false)
+              expect(policy.options["fpt"].enabled).to eq(false)
+              expect(policy.options["nullbyte"].enabled).to eq(true)
+              expect(policy.options["retr"].enabled).to eq(false)
+              expect(policy.options["login"].enabled).to eq(false)
+
+              expect(policy.options["xss"].v1_compatability_enabled).to eq(false)
+              expect(policy.options["sqli"].v1_compatability_enabled).to eq(false)
+              expect(policy.options["cmdi"].v1_compatability_enabled).to eq(false)
+              expect(policy.options["fpt"].v1_compatability_enabled).to eq(false)
+              expect(policy.options["nullbyte"].v1_compatability_enabled).to eq(false)
+              expect(policy.options["retr"].v1_compatability_enabled).to eq(false)
+            end
+          end
+
+          context "that only has xss enabled" do
+            it "should only have xss enabled" do
+              expect_any_instance_of(AppSensorRuleManager).to receive(:load_default_rules_file)
+
+              policy_json = {
+                "policy_id" => "01a1",
+                "version" => 2,
+                "data" => {
+                  "sensors" => {
+                    "xss" => {
+                      "libinjection" => true,
+                      "patterns" => ["1","2","8"],
+                      "exclusions" => {
+                          "bob" => ["*"]
+                      }
+                    }
+                  }
+                }
+              }
+
+              policy = AppSensorPolicy.from_json(policy_json)
+
+              expect(policy.policy_id).to eq("01a1")
+              expect(policy.options["req_size"]).to_not be_nil
+              expect(policy.options["resp_size"]).to_not be_nil
+              expect(policy.options["resp_codes"]).to_not be_nil
+              expect(policy.options["xss"]).to_not be_nil
+              expect(policy.options["sqli"]).to_not be_nil
+              expect(policy.options["cmdi"]).to_not be_nil
+              expect(policy.options["fpt"]).to_not be_nil
+              expect(policy.options["nullbyte"]).to_not be_nil
+              expect(policy.options["retr"]).to_not be_nil
+              expect(policy.options["login"]).to_not be_nil
+
+              expect(policy.options["req_size"].enabled).to eq(false)
+              expect(policy.options["resp_size"].enabled).to eq(false)
+              expect(policy.options["resp_codes"].enabled).to eq(false)
+              expect(policy.options["xss"].enabled).to eq(true)
+              expect(policy.options["sqli"].enabled).to eq(false)
+              expect(policy.options["cmdi"].enabled).to eq(false)
+              expect(policy.options["fpt"].enabled).to eq(false)
+              expect(policy.options["nullbyte"].enabled).to eq(false)
+              expect(policy.options["retr"].enabled).to eq(false)
+              expect(policy.options["login"].enabled).to eq(false)
+
+              expect(policy.options["xss"].v1_compatability_enabled).to eq(false)
+              expect(policy.options["sqli"].v1_compatability_enabled).to eq(false)
+              expect(policy.options["cmdi"].v1_compatability_enabled).to eq(false)
+              expect(policy.options["fpt"].v1_compatability_enabled).to eq(false)
+              expect(policy.options["nullbyte"].v1_compatability_enabled).to eq(false)
+              expect(policy.options["retr"].v1_compatability_enabled).to eq(false)
+            end
+          end
+
+          context "that has everything enabled" do
+            it "should have all sensors enabled" do
+              expect_any_instance_of(AppSensorRuleManager).to receive(:load_default_rules_file)
+
+              policy_json = {
+                "policy_id" => "01a1",
+                "version" => 2,
+                "data" => {
+                  "sensors" => {
+                    "req_size" => {
+                        "limit" => 1024,
+                        "exclude_routes" => ["2300"]
+                    },
+                    "resp_size" => {
+                        "limit" => 2048,
+                        "exclude_routes" => ["2323"]
+                    },
+                    "resp_codes" => {
+                        "series_400_enabled" => true,
+                        "series_500_enabled" => true
+                    },
+                    "xss" => {
+                        "libinjection" => true,
+                        "patterns" => ["1","2","8"],
+                        "exclusions" => {
+                            "bob" => ["*"]
+                        }
+                    },
+                    "sqli" => {
+                        "libinjection" => true,
+                        "exclude_headers" => true,
+                        "patterns" => ["1"]
+                    },
+                    "fpt" => {
+                        "patterns" => ["1","2"],
+                        "exclude_forms" => true,
+                        "exclude_cookies" => true,
+                        "exclusions" => {
+                            "somethingcommon" => ["form"]
+                        }
+                    },
+                    "cmdi" => {
+                         "patterns" => ["1","2"]
+                    },
+                    "nullbyte" => {
+                         "patterns" => ["1","2"]
+                    },
+                    "retr" => {
+                         "patterns" => ["1","2"]
+                    },
+                    "login" => {
+                        "lgnSccss_enabled" => true,
+                        "lgnFlr_enabled" => true,
+                        "psswdRstReq" => true,
+                        "psswdRstAttmpt" => true,
+                        "psswdRst" => true
+                    }
+                  }
+                }
+              }
+
+              policy = AppSensorPolicy.from_json(policy_json)
+
+              expect(policy.policy_id).to eq("01a1")
+              expect(policy.options["req_size"]).to_not be_nil
+              expect(policy.options["resp_size"]).to_not be_nil
+              expect(policy.options["resp_codes"]).to_not be_nil
+              expect(policy.options["xss"]).to_not be_nil
+              expect(policy.options["sqli"]).to_not be_nil
+              expect(policy.options["cmdi"]).to_not be_nil
+              expect(policy.options["fpt"]).to_not be_nil
+              expect(policy.options["nullbyte"]).to_not be_nil
+              expect(policy.options["retr"]).to_not be_nil
+              expect(policy.options["login"]).to_not be_nil
+
+              expect(policy.options["req_size"].enabled).to eq(true)
+              expect(policy.options["resp_size"].enabled).to eq(true)
+              expect(policy.options["resp_codes"].enabled).to eq(true)
+              expect(policy.options["xss"].enabled).to eq(true)
+              expect(policy.options["sqli"].enabled).to eq(true)
+              expect(policy.options["cmdi"].enabled).to eq(true)
+              expect(policy.options["fpt"].enabled).to eq(true)
+              expect(policy.options["nullbyte"].enabled).to eq(true)
+              expect(policy.options["retr"].enabled).to eq(true)
+              expect(policy.options["login"].enabled).to eq(true)
+
+              expect(policy.options["xss"].v1_compatability_enabled).to eq(false)
+              expect(policy.options["sqli"].v1_compatability_enabled).to eq(false)
+              expect(policy.options["cmdi"].v1_compatability_enabled).to eq(false)
+              expect(policy.options["fpt"].v1_compatability_enabled).to eq(false)
+              expect(policy.options["nullbyte"].v1_compatability_enabled).to eq(false)
+              expect(policy.options["retr"].v1_compatability_enabled).to eq(false)
+            end
+          end
         end
       end
     end