tcell_agent 0.2.2 → 0.2.4

data/lib/tcell_agent/logger.rb

@@ -4,6 +4,7 @@ require 'logger'
 require 'tcell_agent/configuration'
 
 module TCellAgent
+  @@logger_pid = Process.pid
   def self.loggingLevelFromString(levelString)
     if (levelString == "DEBUG")
       return Logger::DEBUG
@@ -19,11 +20,13 @@ module TCellAgent
     return Logger::ERROR
   end
   def self.logger
-    if defined?(@logger)
+    if defined?(@logger) and @logger_pid == Process.pid
         return @logger
     end
+    @logger_pid = Process.pid
     logging_options = TCellAgent.configuration.logging_options
     if logging_options && logging_options["enabled"]
+      FileUtils.mkdir_p 'tcell/logs'
       level = loggingLevelFromString(logging_options["level"])
       logging_file = logging_options["filename"] || TCellAgent.configuration.default_log_filename
       # limit the total log file to about 9 * 5 = 45 mb

data/lib/tcell_agent/policies/content_security_policy.rb

@@ -3,6 +3,7 @@
 
 require 'uri'
 require 'tcell_agent/sensor_events/util/sanitizer_utilities'
+require 'tcell_agent/configuration'
 
 module TCellAgent
     module Policies
@@ -15,7 +16,8 @@ module TCellAgent
                 attr_accessor :type
                 attr_accessor :raw_value
                 attr_accessor :report_uri
-                def initialize(type, value, report_uri=nil)
+                attr_accessor :policy_id
+                def initialize(type, value, report_uri=nil, policy_id=nil)
                     if !(type && value)
                         raise "Type and value were not set"
                     end
@@ -30,11 +32,19 @@ module TCellAgent
                     if value != value.gsub(/[^\p{L}\w\d\-_\ :\/,;.'\*"%?@#=$]/,'')
                         raise "Value is not valid"
                     end
+                    if policy_id
+                        self.policy_id = policy_id
+                    end
                     self.type = type
                     self.raw_value = value
                     self.report_uri = report_uri
                 end
-                def value(transaction_id=nil, session_id=nil, user_id=nil)
+                def self.jhash(str)
+                  str.each_char.reduce(0) do |result, char|
+                    [((result << 5) - result) + char.ord].pack('L').unpack('l').first
+                  end 
+                end
+                def value(transaction_id=nil, route_id=nil, session_id=nil, user_id=nil)
                     if !self.report_uri
                         return self.raw_value
                     end
@@ -44,16 +54,25 @@ module TCellAgent
                         if transaction_id
                             new_query_ar << ["tid", transaction_id]
                         end
-                        if session_id
+                        if session_id and session_id.length > 0
                             new_query_ar << ["sid", session_id]
                         end
-                        if user_id
-                            new_query_ar << ["uid", user_id.to_s]
+                        if route_id
+                            new_query_ar << ["rid", route_id]
                         end
                         if new_query_ar != []
                             uri.query = URI.encode_www_form(new_query_ar)
                         end
                         report_uri = uri.to_s
+                        if self.policy_id
+                            checksum = ContentSecurityPolicyHeader.jhash(self.policy_id + report_uri)
+                            if new_query_ar != []
+                                report_uri = report_uri + "&"
+                            else
+                                report_uri = report_uri + "?"
+                            end
+                            report_uri = report_uri + "c=" + checksum.to_s
+                        end
                         return "#{self.raw_value}; report-uri #{report_uri}"
                     rescue Exception=>e
                         return self.raw_value
@@ -63,11 +82,12 @@ module TCellAgent
 
             attr_accessor :headers
             attr_accessor :policy_id
+            attr_accessor :js_agent_api_key
 
-            def each(transaction_id=nil, hmac_session_id=nil, user_id=nil, &block)
+            def each(transaction_id=nil, route_id=nil, hmac_session_id=nil, user_id=nil, &block)
                 result = []
                 headers.each do | header |
-                  header_value = header.value(transaction_id, hmac_session_id, user_id)
+                  header_value = header.value(transaction_id, route_id, hmac_session_id)
                   header_names = ContentSecurityPolicy.cspHeadersForType(header.type)
                   header_names.each do | header_name |
                     result.push( {"name"=>header_name, "value"=>header_value} )
@@ -85,13 +105,20 @@ module TCellAgent
                 else
                     raise "Policy ID missing"
                 end
+                if policy_json.has_key?("data")
+                    data_json = policy_json["data"]
+                    if data_json.has_key?("options")
+                        options_json = data_json["options"]
+                        csp.js_agent_api_key = options_json.fetch("js_agent_api_key", nil)
+                    end
+                end
                 if policy_json.has_key?("headers")
                     headers = policy_json["headers"]
                     csp_headers = []
                     headers.each do |header|
                         if header.has_key?("name") && header.has_key?("value")
                             begin
-                                csp_header = ContentSecurityPolicyHeader.new(header["name"], header["value"], header["report-uri"])
+                                csp_header = ContentSecurityPolicyHeader.new(header["name"], header["value"], header["report-uri"], csp.policy_id)
                                 csp_headers.push(csp_header)
                             rescue Exception => secure_header_exception
                                 #pass
@@ -114,6 +141,15 @@ module TCellAgent
                     return []
                 end
             end
+            def js_agent_app_id
+                return TCellAgent.configuration.app_id
+            end
+            def js_agent_api_base_url
+                return TCellAgent.configuration.js_agent_api_base_url
+            end
+            def js_agent_url
+                return TCellAgent.configuration.js_agent_url
+            end
         end
     end
 end

data/lib/tcell_agent/policies/dataloss_policy.rb

@@ -11,6 +11,8 @@ module TCellAgent
                 attr_accessor :log_event
                 attr_accessor :log_redact
                 attr_accessor :log_hash
+
+                attr_accessor :action_id
             end
 
             attr_accessor :session_id_filter_actions
@@ -25,6 +27,9 @@ module TCellAgent
 
             attr_accessor :table_field_actions
             attr_accessor :session_id_actions
+            attr_accessor :database_actions
+
+            attr_accessor :database_discovery_enabled
 
             attr_accessor :field_redact_body
             attr_accessor :field_alerts
@@ -38,6 +43,8 @@ module TCellAgent
                 @table_field_actions = {}
                 @session_id_actions = []
 
+                @database_discovery_enabled = false
+
                 @field_redact_body = Set.new #["work_infos.SSN"].to_set #
                 @field_alerts = Set.new
 
@@ -47,6 +54,8 @@ module TCellAgent
                     "cookie"=>Hash.new{|h,k| h[k] = FilterActions.new},
                     "header"=>Hash.new{|h,k| h[k] = FilterActions.new}
                 }
+                @database_actions = Hash.new{|h,k| h[k] = Hash.new{|h,k| h[k] = Hash.new{|h,k| h[k] = Hash.new{|h,k| h[k] = Hash.new{|h,k| h[k] = Set.new}}}}}
+
                 @log_actions = nil
             end
             def get_actions_for_session_id(route_id=nil)
@@ -55,6 +64,44 @@ module TCellAgent
             def get_actions_for_request(context, route_id=nil)
                 return @request_filter_actions.fetch(context)
             end
+            def get_actions_for_table(database, schema, table, field, route_id="*")
+                if route_id == nil
+                    route_id = "*"
+                end
+                actions = Set.new
+                [database, "*"].each do |d|
+                    if (@database_actions.has_key?(d) == false)
+                        next
+                    end
+                    [schema, "*"].each do |s|
+                        if (@database_actions[d].has_key?(s) == false)
+                            next
+                        end
+                        [table, "*"].each do |t|
+                            if (@database_actions[d][s].has_key?(t) == false)
+                                next
+                            end
+                            [field, "*"].each do |f|
+                                if (@database_actions[d][s][t].has_key?(f) == false)
+                                    next
+                                end
+                                route_id_rules = @database_actions[d][s][t][f]
+                                if (route_id_rules.has_key?(route_id))  
+                                    actions.merge(@database_actions[d][s][t][f][route_id])
+                                end
+                                if (route_id != "*" && route_id_rules.has_key?("*"))
+                                    actions.merge(@database_actions[d][s][t][f]["*"])
+                                end
+                            end
+                        end
+                    end
+                end
+                if (actions.size == 0)
+                    return nil
+                end
+                actions
+            end
+                
             def get_actions_for(table, field)
                 actions = Set.new
                 key = "#{table}.#{field}"
@@ -67,6 +114,38 @@ module TCellAgent
                 #end
                 return actions
             end 
+            def self.actions_from_json(options)
+                actions = nil
+                if options.has_key?("log")
+                    if (options["log"].include? "redact")
+                        actions ||= FilterActions.new
+                        actions.log_redact = true
+                    end
+                    if (options["log"].include? "event")
+                        actions ||= FilterActions.new
+                        actions.log_event = true
+                    end
+                    if (options["log"].include? "hash")
+                        actions ||= FilterActions.new
+                        actions.log_hash = true
+                    end
+                end
+                if options.has_key?("body")
+                    if (options["body"].include? "redact")
+                        actions ||= FilterActions.new
+                        actions.body_redact = true
+                    end
+                    if (options["body"].include? "event")
+                        actions ||= FilterActions.new
+                        actions.body_event = true
+                    end
+                    if (options["body"].include? "hash")
+                        actions ||= FilterActions.new
+                        actions.body_hash = true
+                    end
+                end
+                actions
+            end
             def self.fromJson(policy_json)
                 if (!policy_json)
                     return nil
@@ -79,35 +158,15 @@ module TCellAgent
                 end
                 if policy_json.has_key?("data")
                     data_json = policy_json["data"]
+                    if data_json.has_key?("data_discovery")
+                        data_discovery_json = data_json["data_discovery"]
+                        policy.database_discovery_enabled = data_discovery_json.fetch('database_enabled', false)
+                    end
                     if data_json.has_key?("session_id_protection")
                         session_id_protection = data_json["session_id_protection"]
-                        if session_id_protection.fetch("body",nil)
-                            if (session_id_protection["body"].include? "redact")
-                                policy.session_id_filter_actions ||= FilterActions.new
-                                policy.session_id_filter_actions.body_redact = true
-                            end
-                            if (session_id_protection["body"].include? "event")
-                                policy.session_id_filter_actions ||= FilterActions.new
-                                policy.session_id_filter_actions.body_event = true
-                            end
-                            if (session_id_protection["body"].include? "hash")
-                                policy.session_id_filter_actions ||= FilterActions.new
-                                policy.session_id_filter_actions.body_hash = true
-                            end
-                        end
-                        if session_id_protection.fetch("log",nil)
-                            if (session_id_protection["log"].include? "redact")
-                                policy.session_id_filter_actions ||= FilterActions.new
-                                policy.session_id_filter_actions.log_redact = true
-                            end
-                            if (session_id_protection["log"].include? "event")
-                                policy.session_id_filter_actions ||= FilterActions.new
-                                policy.session_id_filter_actions.log_event = true
-                            end
-                            if (session_id_protection["log"].include? "hash")
-                                policy.session_id_filter_actions ||= FilterActions.new
-                                policy.session_id_filter_actions.log_hash = true
-                            end
+                        filter_actions = DataLossPolicy.actions_from_json(session_id_protection)
+                        if filter_actions != nil
+                            policy.session_id_filter_actions = filter_actions
                         end
                     end
                     if data_json.has_key?("request_protections")
@@ -115,53 +174,51 @@ module TCellAgent
                             context = protection.fetch('context', nil)
                             variable = protection.fetch('variable', nil)
                             scope = protection.fetch('scope', "global")
-                            options = protection.fetch('options', nil)
+                            options = protection.fetch('actions', nil)
                             if scope != "global"
                                 next
-                            end
+                            end                            
                             if context && policy.request_filter_actions.has_key?(context) && variable && options
-                                if options.has_key?("log")
-                                    if (options["log"].include? "redact")
-                                        policy.request_filter_actions[context][variable].log_redact = true
-                                    end
-                                    if (options["log"].include? "event")
-                                        policy.request_filter_actions[context][variable].log_event = true
-                                    end
-                                    if (options["log"].include? "hash")
-                                        policy.request_filter_actions[context][variable].log_hash = true
-                                    end
-                                end
-                                if options.has_key?("body")
-                                    if (options["body"].include? "redact")
-                                        policy.request_filter_actions[context][variable].body_redact = true
-                                    end
-                                    if (options["body"].include? "event")
-                                        policy.request_filter_actions[context][variable].body_event = true
-                                    end
-                                    if (options["body"].include? "hash")
-                                        policy.request_filter_actions[context][variable].body_hash = true
-                                    end
+                                filter_actions = DataLossPolicy.actions_from_json(options)
+                                if filter_actions != nil
+                                    policy.request_filter_actions[context][variable] = filter_actions
                                 end
                             end
                         end
                     end
-                    if data_json.has_key?("protections")
-                        protections_json = data_json["protections"]
-                        protections_json.each do |protection| 
-                            _table = protection.fetch("table", nil)
-                            _field = protection.fetch("field", nil)
-                            actions = protection.fetch("actions", {})
-                            if actions.fetch("body",nil)
-                                if (actions["body"].include? "redact")
-                                    if (_table && _field)
-                                        (policy.table_field_actions["#{_table}.#{_field}"] ||= []) << "body_redact"
+                    if data_json.has_key?("db_protections")                        
+                        protections = data_json["db_protections"]
+                        if protections
+                            protections.each do |protection_json|
+                                scope = protection_json.fetch("scope",nil)
+                                _databases = protection_json.fetch("databases",["*"])
+                                _schemas = protection_json.fetch("schemas",["*"])
+                                _tables = protection_json.fetch("tables",["*"])
+                                _fields = protection_json.fetch("fields",nil)
+                                rule_id = protection_json.fetch("rule_id",nil)
+                                actions = protection_json.fetch("actions",{})
+                                filter_actions = DataLossPolicy.actions_from_json(actions)
+                                _route_ids = ["*"]
+                                if (scope != nil and scope != "global")
+                                    if scope=="route"
+                                        _route_ids = protection_json.fetch("route_ids",[])
                                     end
                                 end
-                            end
-                            if actions.fetch("log",nil)
-                                if (actions["log"].include? "redact")
-                                    if (_table && _field)
-                                        (policy.table_field_actions["#{_table}.#{_field}"] ||= []) << "log_redact"
+                                if _fields == nil
+                                    next
+                                elsif filter_actions == nil
+                                    next
+                                end
+                                filter_actions.action_id = rule_id
+                                _databases.each do |_database|
+                                    _schemas.each do |_schema|
+                                        _tables.each do |_table|
+                                            _fields.each do |_field|
+                                                _route_ids.each do |_route_id|
+                                                    policy.database_actions[_database][_schema][_table][_field][_route_id].add(filter_actions)
+                                                end
+                                            end
+                                        end
                                     end
                                 end
                             end

data/lib/tcell_agent/rails.rb

@@ -28,7 +28,25 @@ require 'tcell_agent/userinfo'
 require 'cgi'
 require 'thread'
 
+
+
 # ensure ActiveRecord's version has been required already
+module TCellAgent
+  class MyRailtie < Rails::Railtie
+    initializer 'activeservice.autoload', :after => :set_autoload_paths do |app|
+      if (TCellAgent.configuration.enabled)
+        Rails.application.config.to_prepare do
+          require 'tcell_agent/rails/auth/devise'
+          require 'tcell_agent/rails/auth/authlogic'
+        end
+        Rails.application.config.after_initialize do
+          TCellAgent::Instrumentation::Rails.send_framework_info    
+          TCellAgent::Instrumentation::Rails.send_settings(Rails.application)
+        end
+      end
+    end
+  end
+end
 
 module TCellAgent
   class Railtie < Rails::Railtie
@@ -38,16 +56,8 @@ module TCellAgent
       app.config.middleware.use "TCellAgent::Instrumentation::Rails::Middleware::BodyFilterMiddleware"
       app.config.middleware.use "TCellAgent::Instrumentation::Rails::Middleware::GlobalMiddleware"
     end
-    config.after_initialize do
-      TCellAgent::Instrumentation::Rails.send_framework_info    
-      TCellAgent::Instrumentation::Rails.send_settings(Rails.application)
-    end
-  end
-  class Engine < Rails::Engine
-    config.after_initialize do
-      TCellAgent::Instrumentation::Rails.get_routes()
-    end
   end
+end
   #   # if (Rails::VERSION::MAJOR == 3)
   #   #   config.after_initialize do
   #   #     Rails.application.reload_routes!
@@ -143,4 +153,3 @@ module TCellAgent
   #     end #ac classeval
   #   end #as onload
   # end #class
-end #module

data/{config/initializers/authlogic_auth.rb → lib/tcell_agent/rails/auth/authlogic.rb}

@@ -17,6 +17,7 @@ module TCellAgent
                 success = original_save
                 user_logged_in_after = (user != nil)
                 TCellAgent::Instrumentation.safe_block("Authlogic login info") {
+
                     login_fraud_policy = TCellAgent.policy(TCellAgent::PolicyTypes::LoginFraud)
                     if (login_fraud_policy && login_fraud_policy.enabled)
                         user_id = nil