tcell_agent 0.2.13 → 0.2.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e5ccc67c1c1611e9a2824184b1b89693dc6d0c95
-  data.tar.gz: 7722062a8bd1a12cda449ce20645ec11fbf024cf
+  metadata.gz: 91eb80e7d8e32d4eb83b3db2724492c1bcfa6151
+  data.tar.gz: e89d78bc66aa69410ca00dfac6217982a9e36ebf
 SHA512:
-  metadata.gz: 11be4d4e2e569c6edbcf737944410aa9c9c7f90e12e585e90026ca539330f3debe7667bcd5db02ee4f402528d92166089f225579d5dd075320118b6f481b15c5
-  data.tar.gz: ed0b1023516c6122b585774908acf5dbb13243619b3c1822ff55e4701616716f1d33acae60a2d5eee7dbdc416f21eb11792caa3ba59214f6d533ac1dc2038ac7
+  metadata.gz: d1ef60b09773240dec59b976c283867ae5a7d5789ac3e109016916b23a9bb208de9e2c220dafd81a805da5be86e70ac4bc77683b55cd3316da909a3229eee9f4
+  data.tar.gz: 019839aec44771e5b8702024c9acbf2a33ab668200681315161105e7d66340bab25d187e1ce12eef45b67bd257064c81b7ed76dc75117c26be37bbd131b15036

data/lib/tcell_agent.rb

@@ -1,5 +1,7 @@
 # See the file "LICENSE" for the full license governing this code.
 
+require "tcell_agent/utils/strings"
+require "tcell_agent/utils/io"
 require 'tcell_agent/logger'
 require 'tcell_agent/configuration'
 

data/lib/tcell_agent/agent.rb

@@ -121,8 +121,8 @@ module TCellAgent
     end
 
     def start
-      if (TCellAgent.configuration.api_key == nil || 
-          TCellAgent.configuration.app_id == nil) 
+      if (TCellAgent::Utils::Strings.blank?(TCellAgent.configuration.api_key) ||
+          TCellAgent::Utils::Strings.blank?(TCellAgent.configuration.app_id))
         puts " ********* ********* ********* *********"
         puts "* tCell.io                               *"
         puts "* Configuration info is missing, you may  *"

data/lib/tcell_agent/agent/policy_manager.rb

@@ -34,7 +34,7 @@ module TCellAgent
       return if TCellAgent.configuration.should_start_policy_poll? == false
       @policy_polling_worker_mutex.synchronize do
         return if policy_polling_running?
-        start_policy_polling
+        start_policy_polling_loop
       end
     end
 
@@ -49,55 +49,98 @@ module TCellAgent
       end
     end
 
-    def start_policy_polling
-      if TCellAgent.configuration.should_start_policy_poll? == true
+    def start_policy_polling_loop
+      if TCellAgent.configuration.should_start_policy_poll?
+
+        if TCellAgent::Utils::Strings.blank?(TCellAgent.configuration.tcell_api_url)
+          TCellAgent.logger.error("tCell.io tcell_api_url is missing. Disabling policy polling.")
+          return
+        end
+
+        if TCellAgent::Utils::Strings.blank?(TCellAgent.configuration.app_id)
+          TCellAgent.logger.error("tCell.io app_id is missing. Disabling policy polling.")
+          return
+        end
+
         TCellAgent.logger.debug("Starting policy polling thread")
+
         @policy_polling_thread = Thread.new do
+          failure_sleep_time = 30
           last_poll_time = 0
           last_run = Time.now
+
           loop do
-            begin
-              policy_jsons = @@policy_tapi.pollAPI(last_poll_time)
-              if policy_jsons == nil
-                TCellAgent.logger.error("Policy was nil")
-                sleep(10.0)
-                next
-              elsif policy_jsons.key?("last_timestamp")
-                if policy_jsons["last_timestamp"] != 0
-                  last_poll_time = policy_jsons["last_timestamp"]
-                end
-              elsif policy_jsons.key?("last_id")
-                if policy_jsons["last_id"] != 0
-                  last_poll_time = policy_jsons["last_id"]
-                end
-              end
-              processPolicyJson(policy_jsons)
-            rescue Exception => e 
-              TCellAgent.logger.error("exception while handling connection: #{e.message}")
-              TCellAgent.logger.debug(e.backtrace)
-              TCellAgent.logger.debug("Sleeping 30 seconds because the tCell.io request failed...")
-              sleep(30) #wait a minute before trying again
-            end
-            if (Time.now - last_run) < 1
-              TCellAgent.logger.debug("Rate limiting: sleeping 10 seconds")
-              sleep(10)
+            failure_sleep_time, last_poll_time = policy_polling_iteration(failure_sleep_time, last_poll_time)
+
+            if (Time.now - last_run) < 5
+              random = Random.new
+              sleeptime = sleep(random.rand(5..20))
+              TCellAgent.logger.debug("Rate limiting: sleeping #{sleeptime} seconds")
+              sleep(sleeptime)
             end
+
             last_run = Time.now
           end
         end
-      end  
+      end
     end
 
-    def processPolicyJson(policy_jsons, cache_the_policy=true)
+    def policy_polling_iteration(failure_sleep_time, last_poll_time)
+      begin
+        policy_jsons = @@policy_tapi.pollAPI(last_poll_time)
 
-      if policy_jsons == nil
-        return
-      end
+        if policy_jsons == nil
+          TCellAgent.logger.error("Policy was nil. Sleeping for #{failure_sleep_time}")
+
+          sleep(failure_sleep_time)
+
+          if failure_sleep_time < 480
+            failure_sleep_time *= 2
+          end
+
+          return
+
+        elsif policy_jsons.key?("last_timestamp")
+          if policy_jsons["last_timestamp"] != 0
+            last_poll_time = policy_jsons["last_timestamp"]
+          end
+        elsif policy_jsons.key?("last_id")
+          if policy_jsons["last_id"] != 0
+            last_poll_time = policy_jsons["last_id"]
+          end
+        end
+
+        failure_sleep_time = 30
+
+        processPolicyJson(policy_jsons)
+
+      rescue RestClient::Exception => rce
+        TCellAgent.logger.error("Received error response while contacting api [#{rce.http_code}]: #{rce.message}")
+        TCellAgent.logger.debug(rce.backtrace)
+        TCellAgent.logger.debug("Sleeping #{failure_sleep_time} seconds because the request failed...")
+        sleep(failure_sleep_time)
+
+        if failure_sleep_time < 480
+          failure_sleep_time *= 2
+        end
+
+      rescue Exception => e
+        TCellAgent.logger.error("exception while handling connection: #{e.message}")
+        TCellAgent.logger.debug(e.backtrace)
+        TCellAgent.logger.debug("Sleeping 30 seconds because the tCell.io request failed...")
+        sleep(failure_sleep_time)
 
-      if policy_jsons.key?("data")
-        policy_data = policy_jsons["data"]
+        if failure_sleep_time < 480
+          failure_sleep_time *= 2
+        end
       end
 
+      [failure_sleep_time, last_poll_time]
+    end
+
+    def processPolicyJson(policy_jsons, cache_the_policy=true)
+      return if policy_jsons.nil?
+
       TCellAgent::PolicyTypes::ClassMap.each do | policy_type, policy_class |
         if (policy_jsons.key?(policy_type))
           new_policy = policy_class.from_json(policy_jsons[policy_type])
@@ -111,15 +154,18 @@ module TCellAgent
           end
         end
       end
-
-    end # end of processPolicyJson
+    end
 
     def cache(policy_name, policy)
       cache_filename = TCellAgent.configuration.cache_filename_with_app_id
 
       begin
 
-        FileUtils.mkdir_p(File.dirname(cache_filename))
+        TCellAgent::Utils::IO.create_directory(
+          File.dirname(cache_filename),
+          TCellAgent.configuration.agent_home_owner
+        )
+
         f1 = open(cache_filename, File::RDWR|File::CREAT)
 
         Timeout::timeout(0.100) { f1.flock(File::LOCK_EX) }
@@ -151,6 +197,11 @@ module TCellAgent
         f1.write( JSON.dump(policy_cache) )
         f1.flush
         f1.truncate(f1.pos)
+
+        TCellAgent::Utils::IO.set_owner(
+          cache_filename,
+          TCellAgent.configuration.agent_home_owner
+        )
       rescue Exception => e
         TCellAgent.logger.warn(e.message)
 
@@ -162,11 +213,8 @@ module TCellAgent
 
     def policies_from_cachefile
       cache_filename = TCellAgent.configuration.cache_filename_with_app_id
-      cache_exists = File.exist?(cache_filename)
 
-      if !cache_exists
-        return nil
-      end
+      return nil unless File.exist?(cache_filename)
 
       begin
         f1 = File.open(cache_filename, File::RDONLY)

data/lib/tcell_agent/api.rb

@@ -13,43 +13,23 @@ module TCellAgent
     end
 
     def pollAPI(last_timestamp=nil)
-      if !TCellAgent.configuration || !TCellAgent.configuration.tcell_api_url || !TCellAgent.configuration.app_id
-        raise "Config Information Not Found, can't poll tCell service"
-      end
       full_url = TCellAgent.configuration.tcell_api_url + "/app/" + TCellAgent.configuration.app_id + "/update"
       if (last_timestamp && last_timestamp != "")
         full_url = full_url + "?last_timestamp=" + last_timestamp.to_s
       end
+
       TCellAgent.logger.debug "tCell.io API Request: " + full_url
       request_headers = {
         :Authorization => 'Bearer ' + TCellAgent.configuration.api_key
       }
+
       begin
         request_headers[:TCellAgent] = "RubyAgent " + TCellAgent::VERSION
       rescue Exception => e
         TCellAgent.logger.debug("tCell.io Could not add agent string: " + e.message)
       end
-      response = RestClient.get full_url,request_headers
-      TCellAgent.logger.debug "tCell.io API Response: " + response
-      response_json = JSON.parse(response)
-      if (response_json && response_json.has_key?("result"))
-        return response_json["result"]
-      end
-      # else result was null and no new information exists...
-      return nil
-    end
 
-    def pollOldAPI(last_timestamp=nil)
-      if !TCellAgent.configuration || !TCellAgent.configuration.tcell_api_url || !TCellAgent.configuration.app_id
-        raise "Config Information Not Found, can't poll tCell service"
-      end
-      full_url = TCellAgent.configuration.tcell_api_url + "/api/" + TCellAgent.configuration.app_id + "/csp/poll"
-      TCellAgent.logger.debug "tCell.io API Request: " + full_url
-      full_url = full_url + "/" + TCellAgent.configuration.api_key
-      if (last_timestamp && last_timestamp != "")
-        full_url = full_url + "?last_timestamp=" + last_timestamp.to_s
-      end
-      response = RestClient.get full_url
+      response = RestClient.get full_url,request_headers
       TCellAgent.logger.debug "tCell.io API Response: " + response
       response_json = JSON.parse(response)
       if (response_json && response_json.has_key?("result"))
@@ -99,4 +79,4 @@ module TCellAgent
         return false
     end
   end
-end
+end

data/lib/tcell_agent/configuration.rb

@@ -26,21 +26,21 @@ module TCellAgent
       :uuid,
       :company,
       :event_batch_size_limit, :event_time_limit_seconds,
-      :log_filename,
       :base_dir,
       :cache_filename,
       :js_agent_api_base_url,
       :js_agent_url,
       :raise_exceptions,
-      :allow_unencrypted_appsensor_payloads,
+      :allow_unencrypted_appfirewall_payloads,
       :blacklisted_params,
       :whitelisted_params,
       :whitelist_present,
       :config_filename,
       :agent_log_dir,
       :max_data_ex_db_records_per_request,
-      :log_appfirewall_events,
-      :appfirewall_payloads_log_filename
+      :allow_unencrypted_appfirewall_payloads_logging,
+      :agent_home_dir,
+      :agent_home_owner
 
     attr_accessor :disable_all,
       :enabled,
@@ -73,6 +73,11 @@ module TCellAgent
     end
 
     def initialize(filename="config/tcell_agent.config", useapp=nil)
+      # These will be set when the agent starts up, to give rails initializers
+      # a chance to run
+      @cache_filename = nil
+      @agent_log_dir = nil
+
       @version = 0
       @exp_config_settings = true
       @demomode = false
@@ -90,9 +95,9 @@ module TCellAgent
 
 
       @agent_home_dir = File.join(Dir.getwd, "tcell")
-      @agent_log_dir = File.join(@agent_home_dir, "logs")
       @config_filename = File.join(Dir.getwd, filename)
 
+
       @event_batch_size_limit = 50
       @event_time_limit_seconds = 15
 
@@ -103,21 +108,16 @@ module TCellAgent
       read_config_using_env
       read_config_from_file(@config_filename)
 
-      @cache_filename = File.join(@agent_home_dir, "cache", "tcell_agent.cache")
-      @log_filename = File.join(@agent_log_dir, "tcell_agent.log")
-
-
       # Because ENV can override this one
       env_unencrypted_firewall = 
       if (ENV["TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS"] != nil)
-        @allow_unencrypted_appsensor_payloads = [true, "true", "yes", "1"].include?(ENV["TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS"])
+        @allow_unencrypted_appfirewall_payloads = [true, "true", "yes", "1"].include?(ENV["TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS"])
       end
       if (ENV["TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS"] != nil)
-        @allow_unencrypted_appsensor_payloads = [true, "true", "yes", "1"].include?(ENV["TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS"])
+        @allow_unencrypted_appfirewall_payloads = [true, "true", "yes", "1"].include?(ENV["TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS"])
       end
 
-      @log_appfirewall_events = [true, "true", "yes", "1"].include?(ENV["TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS_LOGGING"])
-      @appfirewall_payloads_log_filename = File.join(@agent_log_dir, "tcell_agent_payloads.log")
+      @allow_unencrypted_appfirewall_payloads_logging = [true, "true", "yes", "1"].include?(ENV["TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS_LOGGING"])
 
       @tcell_api_url ||= "https://api.tcell.io/api/v1"
       @tcell_input_url ||= "https://input.tcell.io/api/v1"
@@ -134,17 +134,12 @@ module TCellAgent
 
       @uuid = SecureRandom.uuid
 
-      FileUtils::mkdir_p File.dirname(@cache_filename)
-      if @logging_options && @logging_options["filename"]
-        FileUtils::mkdir_p File.dirname(@logging_options["filename"])
-      else
-        FileUtils::mkdir_p File.dirname(@log_filename)
-      end
-
       load_app_sensor_restrictions
     end
 
     def cache_filename_with_app_id
+      @cache_filename ||= File.join(@agent_home_dir, "cache", "tcell_agent.cache")
+
       if @app_id
         "#{@cache_filename}.#{@app_id}"
       else
@@ -162,7 +157,8 @@ module TCellAgent
       @demomode = ENV["TCELL_DEMOMODE"] || @demomode
 
       @agent_home_dir = ENV["TCELL_AGENT_HOME"] || @agent_home_dir
-      @agent_log_dir = ENV["TCELL_AGENT_LOG_DIR"] || File.join(@agent_home_dir, "logs")
+      @agent_home_owner = ENV["TCELL_AGENT_HOME_OWNER"]
+      @agent_log_dir = ENV["TCELL_AGENT_LOG_DIR"]
       @config_filename = ENV["TCELL_AGENT_CONFIG"] || @config_filename
 
       if @demomode
@@ -212,16 +208,15 @@ module TCellAgent
 
             @use_websockets = app_data["use_websockets"]
 
-            @allow_unencrypted_appsensor_payloads = app_data.fetch('allow_unencrypted_appsensor_payloads', @allow_unencrypted_appsensor_payloads) 
-            @allow_unencrypted_appsensor_payloads = app_data.fetch('allow_unencrypted_appfirewall_payloads', @allow_unencrypted_appsensor_payloads) 
+            @allow_unencrypted_appfirewall_payloads =
+              app_data.fetch('allow_unencrypted_appsensor_payloads', @allow_unencrypted_appfirewall_payloads)
+            @allow_unencrypted_appfirewall_payloads =
+              app_data.fetch('allow_unencrypted_appfirewall_payloads', @allow_unencrypted_appfirewall_payloads)
 
             data_exposure = app_data.fetch('data_exposure', {})
             @max_data_ex_db_records_per_request = data_exposure.fetch('max_data_ex_db_records_per_request', @max_data_ex_db_records_per_request)
 
             @host_identifier = @host_identifier || app_data.fetch("host_identifier", @host_identifier)
-            if (@host_identifier == nil)
-              @host_identifier = (Socket.gethostname() || "localhost")
-            end
             @hmac_key ||= app_data["hmac_key"] # if not already set
             @session_cookie_names = app_data["session_cookie_names"]
             @uuid = SecureRandom.uuid
@@ -294,7 +289,7 @@ module TCellAgent
           end
 
         rescue Exception => e
-          @allow_unencrypted_appsensor_payloads = false
+          @allow_unencrypted_appfirewall_payloads = false
 
           puts " ********* ********* ********* **********"
           puts "* tCell.io                               *"
@@ -305,6 +300,15 @@ module TCellAgent
       end
     end
 
+    def log_filename
+      @agent_log_dir ||= File.join(@agent_home_dir, "logs")
+      File.join(@agent_log_dir, "tcell_agent.log")
+    end
+
+    def appfirewall_payloads_log_filename
+      @agent_log_dir ||= File.join(@agent_home_dir, "logs")
+      File.join(@agent_log_dir, "tcell_agent_payloads.log")
+    end
   end # class
 
   TCellAgent.configuration ||= TCellAgent::Configuration.new

data/lib/tcell_agent/logger.rb

@@ -5,6 +5,16 @@ require 'tcell_agent/configuration'
 
 module TCellAgent
 
+  class TCellLogDevice < Logger::LogDevice
+    def create_logfile(filename)
+      logdev = super
+
+      TCellAgent::Utils::IO.set_owner(filename, TCellAgent.configuration.agent_home_owner)
+
+      logdev
+    end
+  end
+
   @@logger_pid = Process.pid
 
   def self.loggingLevelFromString(levelString)
@@ -28,9 +38,17 @@ module TCellAgent
       return @payloads_logger
     end
 
-    if TCellAgent.configuration.log_appfirewall_events
-      FileUtils.mkdir_p TCellAgent.configuration.agent_log_dir
-      @payloads_logger = Logger.new(TCellAgent.configuration.appfirewall_payloads_log_filename, 9, 5242880)
+    TCellAgent::Utils::IO.create_directory(
+      File.dirname(TCellAgent.configuration.appfirewall_payloads_log_filename),
+      TCellAgent.configuration.agent_home_owner
+    )
+
+    log_device = TCellLogDevice.new(
+      TCellAgent.configuration.appfirewall_payloads_log_filename,
+      shift_age: 9, shift_size: 5242880
+    )
+    if TCellAgent.configuration.allow_unencrypted_appfirewall_payloads_logging
+      @payloads_logger = Logger.new(log_device)
       @payloads_logger.level = Logger::INFO
       @payloads_logger.formatter = proc do |severity, datetime, progname, msg|
         date_format = datetime.strftime("%Y-%m-%dT%H:%M:%S.%L%:z")
@@ -40,7 +58,7 @@ module TCellAgent
       return @payloads_logger
     end
 
-    logger = Logger.new(TCellAgent.configuration.appfirewall_payloads_log_filename)
+    logger = Logger.new(log_device)
     logger.level = Logger::ERROR
     return logger
   end
@@ -53,12 +71,15 @@ module TCellAgent
     @logger_pid = Process.pid
     logging_options = TCellAgent.configuration.logging_options
 
+    logging_file = TCellAgent.configuration.log_filename
+    logging_directory = File.dirname(logging_file)
+    TCellAgent::Utils::IO.create_directory(logging_directory, TCellAgent.configuration.agent_home_owner)
+
+    log_device = TCellLogDevice.new(logging_file, shift_age: 9, shift_size: 5242880)
     if logging_options && logging_options["enabled"]
-      FileUtils.mkdir_p TCellAgent.configuration.agent_log_dir
       level = loggingLevelFromString(logging_options["level"])
-      logging_file = logging_options["filename"] || TCellAgent.configuration.log_filename
       # limit the total log file to about 9 * 5 = 45 mb
-      @logger = Logger.new(logging_file, shift_age=9, shift_size=5242880)
+      @logger = Logger.new(log_device)
       @logger.level = level
       @logger.formatter = proc do |severity, datetime, progname, msg|
         # ISO 8601 format
@@ -69,7 +90,7 @@ module TCellAgent
       return @logger
     end
 
-    logger = Logger.new(TCellAgent.configuration.log_filename)
+    logger = Logger.new(log_device)
     logger.level = Logger::ERROR
     return logger
   end

data/lib/tcell_agent/policies/appsensor/injection_sensor.rb

@@ -71,7 +71,7 @@ module TCellAgent
           vuln_param = vuln_results["param"]
           payload = nil
 
-          if TCellAgent.configuration.allow_unencrypted_appsensor_payloads
+          if TCellAgent.configuration.allow_unencrypted_appfirewall_payloads
             payload = vuln_results["value"]
           end
 
@@ -105,7 +105,7 @@ module TCellAgent
       end
 
       def log_appsensor_events(type_of_param, appsensor_meta, vuln_param, vuln_value)
-        if TCellAgent.configuration.log_appfirewall_events
+        if TCellAgent.configuration.allow_unencrypted_appfirewall_payloads_logging
           event = TCellAgent::SensorEvents::TCellAppSensorEvent.new(
             appsensor_meta.location,
             @detection_point,

data/lib/tcell_agent/rails/auth/devise.rb

@@ -1,8 +1,6 @@
 module TCellAgent
   if defined?(Devise)
 
-    TCellAgent.logger.debug("Instrumenting Devise")
-
     require 'tcell_agent/agent'
     require 'tcell_agent/sensor_events/login_fraud'
     require 'tcell_agent/policies/appsensor_policy'

data/lib/tcell_agent/servers/rails_server.rb

@@ -4,8 +4,8 @@
 
 Rails::Server.class_eval do
 
-  alias_method :tcell_start, :start
-  def start(&blk)
+  alias_method :tcell_build_app, :build_app
+  def build_app(app)
     require("tcell_agent/servers/unicorn") if defined?(Unicorn::HttpServer)
     require("tcell_agent/servers/webrick") if defined?(Rack::Handler::WEBrick)
     require("tcell_agent/servers/thin") if defined?(Thin::Server)
@@ -23,7 +23,7 @@ Rails::Server.class_eval do
       end
     end
 
-    tcell_start(&blk)
+    tcell_build_app(app)
   end
 
 end

data/lib/tcell_agent/servers/unicorn.rb

@@ -1,10 +1,9 @@
 Unicorn::HttpServer.class_eval do
 
-  # This will be true when preload_app is false (when preload app is true, the master won't have any
-  # listeners at this point). This means the initial app load is for each worker. This check
-  # also ensures that a server is running as opposed to a different command such
+  # - This will be false when preload_app is false (even when unicorn is sent USR2 SIGNAL)
+  # - This check also ensures that a server is running as opposed to a different command such
   # as `bundle exec rails runner User.count`.
-  if Unicorn::HttpServer::LISTENERS != nil && Unicorn::HttpServer::LISTENERS.length > 0
+  unless Unicorn::HttpServer::START_CTX && Unicorn::HttpServer::START_CTX[0]
     TCellAgent.run_instrumentation("Unicorn")
   end
 

data/lib/tcell_agent/start_background_thread.rb

@@ -13,11 +13,9 @@ if (TCellAgent.configuration.disable_all == false)
 
       require 'tcell_agent/rails/on_start' if defined?(Rails)
 
-      begin
+      TCellAgent::Instrumentation.safe_block("Starting thread agent") do
         TCellAgent.logger.debug("Instrumenting: #{server_name}")
         TCellAgent.thread_agent.start
-      rescue Exception => e
-        TCellAgent.logger.error("Could not start thread agent. #{e.message}")
       end
 
       if TCellAgent.configuration.should_instrument?

data/lib/tcell_agent/utils/io.rb

@@ -0,0 +1,27 @@
+module TCellAgent
+  module Utils
+    module IO
+
+      def self.create_directory(dir, owner=nil)
+        unless File.directory?(dir)
+          FileUtils.mkdir_p(dir)
+
+          if TCellAgent::Utils::Strings.present?(owner)
+            TCellAgent::Instrumentation.safe_block("Ignoring agent_home_owner value, insufficient privileges") do
+              FileUtils.chown( owner, nil, dir )
+            end
+          end
+        end
+      end
+
+      def self.set_owner(filename, owner=nil)
+        TCellAgent::Instrumentation.safe_block("Ignoring agent_home_owner value, insufficient privileges") do
+          if TCellAgent::Utils::Strings.present?(owner) && File.exists?(filename)
+            FileUtils.chown( owner, nil, filename )
+          end
+        end
+      end
+
+    end
+  end
+end

data/lib/tcell_agent/utils/strings.rb

@@ -0,0 +1,15 @@
+module TCellAgent
+  module Utils
+    module Strings
+      BLANK_RE = /\A[[:space:]]*\z/
+
+      def self.blank?(str)
+        str.nil? || str.empty? || BLANK_RE === str
+      end
+
+      def self.present?(str)
+        !self.blank?(str)
+      end
+    end
+  end
+end

data/lib/tcell_agent/version.rb

@@ -1,5 +1,5 @@
 # See the file "LICENSE" for the full license governing this code.
 
 module TCellAgent
-  VERSION = "0.2.13"
+  VERSION = "0.2.14"
 end

data/spec/lib/tcell_agent/agent/policy_manager_spec.rb

@@ -5,6 +5,194 @@ module TCellAgent
 
     describe Agent do
 
+      describe "#start_policy_polling_loop" do
+        context "should_start_policy_poll disabled" do
+          it "should not start the policy polling loop" do
+            configuration = double(
+              "configuration",
+              {
+                should_start_policy_poll?: false,
+                event_time_limit_seconds: nil,
+                event_batch_size_limit: nil,
+                preload_policy_filename: nil,
+                cache_filename_with_app_id: "cache-file.app_id"
+              }
+            )
+
+            expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
+            agent = TCellAgent::Agent.new
+
+            expect(Thread).to_not receive(:new)
+            agent.start_policy_polling_loop
+          end
+        end
+
+        context "should_start_policy_poll enabled" do
+          context "tcell_api_url" do
+            context "is nil " do
+              it "should not start the policy polling loop" do
+                configuration = double(
+                  "configuration",
+                  {
+                    tcell_api_url: nil,
+                    should_start_policy_poll?: true,
+                    event_time_limit_seconds: nil,
+                    event_batch_size_limit: nil,
+                    preload_policy_filename: nil,
+                    cache_filename_with_app_id: "cache-file.app_id"
+                  }
+                )
+
+                expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
+                agent = TCellAgent::Agent.new
+
+                logger = double("logger")
+
+                expect(TCellAgent).to receive(:logger).and_return(logger)
+                expect(logger).to receive(:error).with("tCell.io tcell_api_url is missing. Disabling policy polling.")
+                expect(Thread).to_not receive(:new)
+                agent.start_policy_polling_loop
+              end
+            end
+
+            context "is empty" do
+              it "should not start the policy polling loop" do
+                configuration = double(
+                  "configuration",
+                  {
+                    tcell_api_url: "",
+                    should_start_policy_poll?: true,
+                    event_time_limit_seconds: nil,
+                    event_batch_size_limit: nil,
+                    preload_policy_filename: nil,
+                    cache_filename_with_app_id: "cache-file.app_id"
+                  }
+                )
+
+                expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
+                agent = TCellAgent::Agent.new
+
+                logger = double("logger")
+
+                expect(TCellAgent).to receive(:logger).and_return(logger)
+                expect(logger).to receive(:error).with("tCell.io tcell_api_url is missing. Disabling policy polling.")
+                expect(Thread).to_not receive(:new)
+                agent.start_policy_polling_loop
+              end
+            end
+
+            context "is blank space" do
+              it "should not start the policy polling loop" do
+                configuration = double(
+                  "configuration",
+                  {
+                    tcell_api_url: "    ",
+                    should_start_policy_poll?: true,
+                    event_time_limit_seconds: nil,
+                    event_batch_size_limit: nil,
+                    preload_policy_filename: nil,
+                    cache_filename_with_app_id: "cache-file.app_id"
+                  }
+                )
+
+                expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
+                agent = TCellAgent::Agent.new
+
+                logger = double("logger")
+
+                expect(TCellAgent).to receive(:logger).and_return(logger)
+                expect(logger).to receive(:error).with("tCell.io tcell_api_url is missing. Disabling policy polling.")
+                expect(Thread).to_not receive(:new)
+                agent.start_policy_polling_loop
+              end
+            end
+          end
+
+          context "app_id" do
+            context "is nil " do
+              it "should not start the policy polling loop" do
+                configuration = double(
+                  "configuration",
+                  {
+                    tcell_api_url: "present",
+                    app_id: nil,
+                    should_start_policy_poll?: true,
+                    event_time_limit_seconds: nil,
+                    event_batch_size_limit: nil,
+                    preload_policy_filename: nil,
+                    cache_filename_with_app_id: "cache-file.app_id"
+                  }
+                )
+
+                expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
+                agent = TCellAgent::Agent.new
+
+                logger = double("logger")
+
+                expect(TCellAgent).to receive(:logger).and_return(logger)
+                expect(logger).to receive(:error).with("tCell.io app_id is missing. Disabling policy polling.")
+                expect(Thread).to_not receive(:new)
+                agent.start_policy_polling_loop
+              end
+            end
+
+            context "is empty" do
+              it "should not start the policy polling loop" do
+                configuration = double(
+                  "configuration",
+                  {
+                    tcell_api_url: "present",
+                    app_id: "",
+                    should_start_policy_poll?: true,
+                    event_time_limit_seconds: nil,
+                    event_batch_size_limit: nil,
+                    preload_policy_filename: nil,
+                    cache_filename_with_app_id: "cache-file.app_id"
+                  }
+                )
+
+                expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
+                agent = TCellAgent::Agent.new
+
+                logger = double("logger")
+
+                expect(TCellAgent).to receive(:logger).and_return(logger)
+                expect(logger).to receive(:error).with("tCell.io app_id is missing. Disabling policy polling.")
+                expect(Thread).to_not receive(:new)
+                agent.start_policy_polling_loop
+              end
+            end
+
+            context "is blank space" do
+              it "should not start the policy polling loop" do
+                configuration = double(
+                  "configuration",
+                  {
+                    tcell_api_url: "present",
+                    app_id: "    ",
+                    should_start_policy_poll?: true,
+                    event_time_limit_seconds: nil,
+                    event_batch_size_limit: nil,
+                    preload_policy_filename: nil,
+                    cache_filename_with_app_id: "cache-file.app_id"
+                  }
+                )
+
+                expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
+                agent = TCellAgent::Agent.new
+
+                logger = double("logger")
+
+                expect(TCellAgent).to receive(:logger).and_return(logger)
+                expect(logger).to receive(:error).with("tCell.io app_id is missing. Disabling policy polling.")
+                expect(Thread).to_not receive(:new)
+                agent.start_policy_polling_loop
+              end
+            end
+          end
+        end
+      end
+
       describe "#cache" do
         context "with an existing cached file" do
 

data/spec/lib/tcell_agent/configuration_spec.rb

@@ -29,7 +29,7 @@ module TCellAgent
           expect(File).to_not receive(:open)
           configuration = TCellAgent::Configuration.new
 
-          expect(configuration.allow_unencrypted_appsensor_payloads).to eq(true)
+          expect(configuration.allow_unencrypted_appfirewall_payloads).to eq(true)
           expect(configuration.blacklisted_params).to eq({
             "token" => true,
             "client_secret" => true,
@@ -58,7 +58,7 @@ module TCellAgent
             expect(File).to receive(:open).with("config/tcell_agent_payloads.config").and_return(payloads_file)
             configuration = TCellAgent::Configuration.new
 
-            expect(configuration.allow_unencrypted_appsensor_payloads).to eq(false)
+            expect(configuration.allow_unencrypted_appfirewall_payloads).to eq(false)
             expect(configuration.blacklisted_params).to eq({
               "token" => true,
               "client_secret" => true,
@@ -87,7 +87,7 @@ module TCellAgent
               expect(File).to receive(:open).with("config/tcell_agent_payloads.config").and_return(payloads_file)
               configuration = TCellAgent::Configuration.new
 
-              expect(configuration.allow_unencrypted_appsensor_payloads).to eq(true)
+              expect(configuration.allow_unencrypted_appfirewall_payloads).to eq(true)
               expect(configuration.blacklisted_params).to eq({
                 "token" => true,
                 "client_secret" => true,
@@ -115,7 +115,7 @@ module TCellAgent
               expect(File).to receive(:open).with("config/tcell_agent_payloads.config").and_return(payloads_file)
               configuration = TCellAgent::Configuration.new
 
-              expect(configuration.allow_unencrypted_appsensor_payloads).to eq(true)
+              expect(configuration.allow_unencrypted_appfirewall_payloads).to eq(true)
               expect(configuration.blacklisted_params).to eq({"passwd" => true})
               expect(configuration.whitelisted_params).to eq({})
               expect(configuration.whitelist_present).to eq(false)
@@ -135,7 +135,7 @@ module TCellAgent
               expect(File).to receive(:open).with("config/tcell_agent_payloads.config").and_return(payloads_file)
               configuration = TCellAgent::Configuration.new
 
-              expect(configuration.allow_unencrypted_appsensor_payloads).to eq(true)
+              expect(configuration.allow_unencrypted_appfirewall_payloads).to eq(true)
               expect(configuration.blacklisted_params).to eq({
                 "token" => true,
                 "client_secret" => true,
@@ -163,7 +163,7 @@ module TCellAgent
               expect(File).to receive(:open).with("config/tcell_agent_payloads.config").and_return(payloads_file)
               configuration = TCellAgent::Configuration.new
 
-              expect(configuration.allow_unencrypted_appsensor_payloads).to eq(true)
+              expect(configuration.allow_unencrypted_appfirewall_payloads).to eq(true)
               expect(configuration.blacklisted_params).to eq({"ssn" => true})
               expect(configuration.whitelisted_params).to eq({"passwd" => true})
               expect(configuration.whitelist_present).to eq(true)
@@ -179,8 +179,8 @@ module TCellAgent
         it "should set cache file, config, and log file to defaults" do
           configuration = Configuration.new
 
-          expect(configuration.cache_filename).to eq(
-            File.join(Dir.getwd, "tcell/cache/tcell_agent.cache")
+          expect(configuration.cache_filename_with_app_id).to match(
+            /tcell\/cache\/tcell_agent.cache/
           )
           expect(configuration.log_filename).to eq(
             File.join(Dir.getwd, "tcell/logs/tcell_agent.log")
@@ -197,13 +197,10 @@ module TCellAgent
 
           ENV["TCELL_AGENT_HOME"] = "spec_tcell_home"
 
-          expect(FileUtils).to receive(:mkdir_p).with("spec_tcell_home/cache")
-          expect(FileUtils).to receive(:mkdir_p).with("spec_tcell_home/logs")
-
           configuration = Configuration.new
 
-          expect(configuration.cache_filename).to eq(
-            "spec_tcell_home/cache/tcell_agent.cache"
+          expect(configuration.cache_filename_with_app_id).to match(
+            /spec_tcell_home\/cache\/tcell_agent.cache/
           )
           expect(configuration.log_filename).to eq(
             "spec_tcell_home/logs/tcell_agent.log"
@@ -224,13 +221,10 @@ module TCellAgent
           ENV["TCELL_AGENT_HOME"] = "spec_tcell_home"
           ENV["TCELL_AGENT_LOG_DIR"] = "spec_tcell_log_dir"
 
-          expect(FileUtils).to receive(:mkdir_p).with("spec_tcell_home/cache")
-          expect(FileUtils).to receive(:mkdir_p).with("spec_tcell_log_dir")
-
           configuration = Configuration.new
 
-          expect(configuration.cache_filename).to eq(
-            "spec_tcell_home/cache/tcell_agent.cache"
+          expect(configuration.cache_filename_with_app_id).to match(
+            /spec_tcell_home\/cache\/tcell_agent.cache/
           )
           expect(configuration.log_filename).to eq(
             "spec_tcell_log_dir/tcell_agent.log"
@@ -254,13 +248,10 @@ module TCellAgent
           ENV["TCELL_AGENT_LOG_DIR"] = "spec_tcell_log_dir"
           ENV["TCELL_AGENT_CONFIG"] = "spec_config/tcell_agent.config"
 
-          expect(FileUtils).to receive(:mkdir_p).with("spec_tcell_log_dir")
-          expect(FileUtils).to receive(:mkdir_p).with("spec_tcell_home/cache")
-
           configuration = Configuration.new
 
-          expect(configuration.cache_filename).to eq(
-            "spec_tcell_home/cache/tcell_agent.cache"
+          expect(configuration.cache_filename_with_app_id).to match(
+            /spec_tcell_home\/cache\/tcell_agent.cache/
           )
           expect(configuration.log_filename).to eq(
             "spec_tcell_log_dir/tcell_agent.log"

data/spec/lib/tcell_agent/policies/appsensor/xss_sensor_spec.rb

@@ -243,8 +243,8 @@ module TCellAgent
                   @sensor.exclude_cookies = true
                   configuration = double(
                     "configuration",
-                    log_appfirewall_events: false,
-                    allow_unencrypted_appsensor_payloads: true,
+                    allow_unencrypted_appfirewall_payloads_logging: false,
+                    allow_unencrypted_appfirewall_payloads: true,
                     blacklisted_params: {},
                     whitelist_present: false
                   )
@@ -267,7 +267,7 @@ module TCellAgent
                   expect(result).to eq(true)
                 end
 
-                context "allow_unencrypted_appsensor_payloads is false" do
+                context "allow_unencrypted_appfirewall_payloads is false" do
                    context "param is blacklisted" do
                      it "should return true" do
                        @sensor.exclude_forms = false
@@ -275,8 +275,8 @@ module TCellAgent
 
                        configuration = double(
                          "configuration",
-                         log_appfirewall_events: false,
-                         allow_unencrypted_appsensor_payloads: false,
+                         allow_unencrypted_appfirewall_payloads_logging: false,
+                         allow_unencrypted_appfirewall_payloads: false,
                          blacklisted_params: {"vuln_param" => true},
                          whitelist_present: false
                        )
@@ -307,8 +307,8 @@ module TCellAgent
 
                        configuration = double(
                          "configuration",
-                         log_appfirewall_events: false,
-                         allow_unencrypted_appsensor_payloads: false,
+                         allow_unencrypted_appfirewall_payloads_logging: false,
+                         allow_unencrypted_appfirewall_payloads: false,
                          blacklisted_params: {},
                          whitelist_present: true,
                          whitelisted_params: {"vuln_param" => true}
@@ -340,8 +340,8 @@ module TCellAgent
 
                        configuration = double(
                          "configuration",
-                         log_appfirewall_events: false,
-                         allow_unencrypted_appsensor_payloads: false,
+                         allow_unencrypted_appfirewall_payloads_logging: false,
+                         allow_unencrypted_appfirewall_payloads: false,
                          blacklisted_params: {},
                          whitelist_present: false
                        )
@@ -366,7 +366,7 @@ module TCellAgent
                    end
                 end
 
-                context "allow_unencrypted_appsensor_payloads is true" do
+                context "allow_unencrypted_appfirewall_payloads is true" do
                    context "params is blacklisted" do
                      it "should return true" do
                        @sensor.exclude_forms = false
@@ -374,8 +374,8 @@ module TCellAgent
 
                        configuration = double(
                          "configuration",
-                         log_appfirewall_events: false,
-                         allow_unencrypted_appsensor_payloads: true,
+                         allow_unencrypted_appfirewall_payloads_logging: false,
+                         allow_unencrypted_appfirewall_payloads: true,
                          blacklisted_params: {"vuln_param" => true},
                          whitelist_present: false
                        )
@@ -406,8 +406,8 @@ module TCellAgent
 
                        configuration = double(
                          "configuration",
-                         log_appfirewall_events: false,
-                         allow_unencrypted_appsensor_payloads: true,
+                         allow_unencrypted_appfirewall_payloads_logging: false,
+                         allow_unencrypted_appfirewall_payloads: true,
                          blacklisted_params: {},
                          whitelist_present: true,
                          whitelisted_params: {"vuln_param" => true}
@@ -439,8 +439,8 @@ module TCellAgent
 
                        configuration = double(
                          "configuration",
-                         log_appfirewall_events: false,
-                         allow_unencrypted_appsensor_payloads: true,
+                         allow_unencrypted_appfirewall_payloads_logging: false,
+                         allow_unencrypted_appfirewall_payloads: true,
                          blacklisted_params: {"vuln_param" => true},
                          whitelist_present: true,
                          whitelisted_params: {"vuln_param" => true}
@@ -472,8 +472,8 @@ module TCellAgent
 
                        configuration = double(
                          "configuration",
-                         log_appfirewall_events: false,
-                         allow_unencrypted_appsensor_payloads: true,
+                         allow_unencrypted_appfirewall_payloads_logging: false,
+                         allow_unencrypted_appfirewall_payloads: true,
                          blacklisted_params: {},
                          whitelist_present: false
                        )
@@ -522,8 +522,8 @@ module TCellAgent
                   @sensor.exclude_cookies = true
                   configuration = double(
                     "configuration",
-                    log_appfirewall_events: false,
-                    allow_unencrypted_appsensor_payloads: true,
+                    allow_unencrypted_appfirewall_payloads_logging: false,
+                    allow_unencrypted_appfirewall_payloads: true,
                     blacklisted_params: {},
                     whitelist_present: false
                   )
@@ -570,8 +570,8 @@ module TCellAgent
                   @sensor.exclude_cookies = true
                   configuration = double(
                     "configuration",
-                    log_appfirewall_events: false,
-                    allow_unencrypted_appsensor_payloads: true,
+                    allow_unencrypted_appfirewall_payloads_logging: false,
+                    allow_unencrypted_appfirewall_payloads: true,
                     blacklisted_params: {},
                     whitelist_present: false
                   )
@@ -603,8 +603,8 @@ module TCellAgent
                   @sensor.exclude_cookies = false
                   configuration = double(
                     "configuration",
-                    log_appfirewall_events: false,
-                    allow_unencrypted_appsensor_payloads: true,
+                    allow_unencrypted_appfirewall_payloads_logging: false,
+                    allow_unencrypted_appfirewall_payloads: true,
                     blacklisted_params: {},
                     whitelist_present: false
                   )

data/spec/lib/tcell_agent/rails/middleware/appsensor_middleware_spec.rb

@@ -103,8 +103,8 @@ module TCellAgent
                 expect(TCellAgent.event_queue).to include(expected_as)
               end
               it "checks that payload is sent in xss with route_id" do
-                old_uap = TCellAgent.configuration.allow_unencrypted_appsensor_payloads
-                TCellAgent.configuration.allow_unencrypted_appsensor_payloads = true
+                old_uap = TCellAgent.configuration.allow_unencrypted_appfirewall_payloads
+                TCellAgent.configuration.allow_unencrypted_appfirewall_payloads = true
                 response = request2.get("/foo?xyz=%3Cscript%3Ealert(1)%3C%2Fscript%3E")
                 expected_as = {
                   "event_type"=>"as",
@@ -117,7 +117,7 @@ module TCellAgent
                   "loc"=>"http://example.org/foo?xyz=",
                   "tid"=>"a-b-c-d-e-f",
                   "payload"=>"<script>alert(1)</script>"}
-                TCellAgent.configuration.allow_unencrypted_appsensor_payloads = old_uap
+                TCellAgent.configuration.allow_unencrypted_appfirewall_payloads= old_uap
                 expect(TCellAgent.event_queue).to include(expected_as)
               end
 
@@ -179,8 +179,8 @@ module TCellAgent
                 expect(TCellAgent.event_queue).to include(expected_as)
               end
               it "checks that payload is sent" do
-                old_uap = TCellAgent.configuration.allow_unencrypted_appsensor_payloads
-                TCellAgent.configuration.allow_unencrypted_appsensor_payloads = true
+                old_uap = TCellAgent.configuration.allow_unencrypted_appfirewall_payloads
+                TCellAgent.configuration.allow_unencrypted_appfirewall_payloads = true
                 response = request.get("/foo?xyz=/etc/passwd", 'REMOTE_ADDR' => '1.3.3.4,3.4.5.6')
                 expected_as = {
                   "event_type"=>"as",
@@ -192,7 +192,7 @@ module TCellAgent
                   "loc"=>"http://example.org/foo?xyz=",
                   "tid"=>"a-b-c-d-e-f",
                   "payload"=>"/etc/passwd"}
-                TCellAgent.configuration.allow_unencrypted_appsensor_payloads = old_uap
+                TCellAgent.configuration.allow_unencrypted_appfirewall_payloads = old_uap
                 expect(TCellAgent.event_queue).to include(expected_as)
               end
             end #/conext

data/spec/lib/tcell_agent/utils/strings_spec.rb

@@ -0,0 +1,31 @@
+require 'spec_helper'
+
+module TCellAgent
+  module Utils
+    describe ".blank?" do
+      context "with nil" do
+        it "should return true" do
+          expect(Strings.blank?(nil)).to be(true)
+        end
+      end
+
+      context "with empty string" do
+        it "should return true" do
+          expect(Strings.blank?("")).to be(true)
+        end
+      end
+
+      context "with white space string" do
+        it "should return true" do
+          expect(Strings.blank?("\t \r\n \s\s")).to be(true)
+        end
+      end
+
+      context "with a string containing non whitespace chars" do
+        it "should return false" do
+          expect(Strings.blank?("A\t \r\n \s\s")).to be(false)
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tcell_agent
 version: !ruby/object:Gem::Version
-  version: 0.2.13
+  version: 0.2.14
 platform: ruby
 authors:
 - Garrett
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-05-04 00:00:00.000000000 Z
+date: 2016-05-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rest-client
@@ -190,8 +190,10 @@ files:
 - lib/tcell_agent/start_background_thread.rb
 - lib/tcell_agent/system_info.rb
 - lib/tcell_agent/userinfo.rb
+- lib/tcell_agent/utils/io.rb
 - lib/tcell_agent/utils/params.rb
 - lib/tcell_agent/utils/queue_with_timeout.rb
+- lib/tcell_agent/utils/strings.rb
 - lib/tcell_agent/version.rb
 - lib/tcell_agent.rb
 - spec/apps/rails-3.2/app/assets/images/rails.png
@@ -279,6 +281,7 @@ files:
 - spec/lib/tcell_agent/sensor_events/util/sanitizer_utilities_spec.rb
 - spec/lib/tcell_agent/utils/bounded_queue_spec.rb
 - spec/lib/tcell_agent/utils/params_spec.rb
+- spec/lib/tcell_agent/utils/strings_spec.rb
 - spec/lib/tcell_agent_spec.rb
 - spec/spec_helper.rb
 - spec/support/middleware_helper.rb
@@ -401,6 +404,7 @@ test_files:
 - spec/lib/tcell_agent/sensor_events/util/sanitizer_utilities_spec.rb
 - spec/lib/tcell_agent/utils/bounded_queue_spec.rb
 - spec/lib/tcell_agent/utils/params_spec.rb
+- spec/lib/tcell_agent/utils/strings_spec.rb
 - spec/lib/tcell_agent_spec.rb
 - spec/spec_helper.rb
 - spec/support/middleware_helper.rb