tcell_agent 0.2.21 → 0.2.22

data/spec/lib/tcell_agent/policies/content_security_policy_spec.rb

@@ -2,105 +2,176 @@ require 'spec_helper'
 
 module TCellAgent
   module Policies
+
     describe ContentSecurityPolicy do
-      policy_json_empty = {
-        "policy_id"=>"01a1",
-        "data"=>{
-          "options"=>{
+      context "test empty agent" do
+        it "enabled is false" do
+          policy_json_empty = {
+            "policy_id"=>"01a1",
+            "data"=>{
+              "options"=>{
 
+              }
+            }
           }
-        }
-      }
-
-      policy_json_one = {
-        "policy_id"=>"01a1",
-        "data"=>{
-          "options"=>{
-            "js_agent_api_key"=>"000-000-1"
-          }
-        }
-      }
 
-      empty_policy = ContentSecurityPolicy.from_json(policy_json_empty)
-      context "test empty agent" do
-        it "enabled is false" do
+          empty_policy = ContentSecurityPolicy.from_json(policy_json_empty)
+
           expect(empty_policy.policy_id).to eq("01a1")
           expect(empty_policy.js_agent_api_key).to eq(nil)
         end
       end
 
-      from_json = ContentSecurityPolicy.from_json(policy_json_one)
       context "tests xss is true and enabled true" do
         it "returns true" do
+          policy_json_one = {
+            "policy_id"=>"01a1",
+            "data"=>{
+              "options"=>{
+                "js_agent_api_key"=>"000-000-1"
+              }
+            }
+          }
+
+          from_json = ContentSecurityPolicy.from_json(policy_json_one)
+
           expect(from_json.policy_id).to eq("01a1")
           expect(from_json.js_agent_api_key).to eq("000-000-1")
         end
       end
-    end
-    describe ContentSecurityPolicy do
-      content_security_policy_json = {
-        "policy_id"=>"00a1",
-        "headers"=>[
-          {"name"=>"csp", "value"=>"csp header value"}
-        ]
-      }
-      csp_from_json = ContentSecurityPolicy.from_json(content_security_policy_json)
+
       context "initialized with 3 items" do
         it "returns true" do
+          content_security_policy_json = {
+            "policy_id"=>"00a1",
+            "headers"=>[
+              {"name"=>"csp", "value"=>"csp header value"}
+            ]
+          }
+
+          csp_from_json = ContentSecurityPolicy.from_json(content_security_policy_json)
+
           expect(csp_from_json.policy_id).to eq("00a1")
           expect(csp_from_json.headers[0].type).to eq("csp")
           expect(csp_from_json.headers[0].value).to eq("csp header value")
         end
       end
+
       context "headers match up appropriately" do
         it "returns content-security-policy headers" do
           expect(ContentSecurityPolicy.cspHeadersForType("csp")).to match_array(["Content-Security-Policy"])
         end
       end
-    end
-    describe ContentSecurityPolicy do
-      content_security_policy_json = {
-        "policy_id"=>"01a1",
-        "headers"=>[
-          {"name"=>"csp-header-is-bad", "value"=>"csp header value"}
-        ]
-      }
-      csp_policy = ContentSecurityPolicy.from_json(content_security_policy_json)
+
       context "csp header example, invalid header" do
         it "returns false" do
+          content_security_policy_json = {
+            "policy_id"=>"01a1",
+            "headers"=>[
+              {"name"=>"csp-header-is-bad", "value"=>"csp header value"}
+            ]
+          }
+
+          csp_policy = ContentSecurityPolicy.from_json(content_security_policy_json)
+
           expect(csp_policy.headers.length).to eq(0)
         end
       end
-    end
-    describe ContentSecurityPolicy do
-      content_security_policy_json = {
-        "policy_id"=>"01a1",
-        "headers"=>[
-          {"name"=>"csp", "value"=>"value123\\nabc"}
-        ]
-      }
-      csp_policy = ContentSecurityPolicy.from_json(content_security_policy_json)
+
       context "secure header, value is bad" do
         it "returns false" do
+          content_security_policy_json = {
+            "policy_id"=>"01a1",
+            "headers"=>[
+              {"name"=>"csp", "value"=>"value123\\nabc"}
+            ]
+          }
+          csp_policy = ContentSecurityPolicy.from_json(content_security_policy_json)
           expect(csp_policy.headers.length).to eq(0)
         end
       end
-    end
-    describe ContentSecurityPolicy do
-      content_security_policy_json = {
-        "policy_id"=>"01a1",
-        "headers"=>[
-          {"name"=>"csp", "value"=>"value normal", "report-uri"=>"https://example.com/abcdde"}
-        ]
-      }
-      csp_policy = ContentSecurityPolicy.from_json(content_security_policy_json)
+
       context "secure header, report-uri seperate" do
         it "returns false" do
+          content_security_policy_json = {
+            "policy_id"=>"01a1",
+            "headers"=>[
+              {"name"=>"csp", "value"=>"value normal", "report-uri"=>"https://example.com/abcdde"}
+            ]
+          }
+
+          csp_policy = ContentSecurityPolicy.from_json(content_security_policy_json)
+
           expect(csp_policy.headers.length).to eq(1)
           expect(csp_policy.headers[0].value).to eq("value normal; report-uri https://example.com/abcdde?c=-815891691")
           expect(csp_policy.headers[0].value("1","2","3")).to eq("value normal; report-uri https://example.com/abcdde?tid=1&sid=3&rid=2&c=1777384531")
         end
       end
+
+      context "modifying js_agent_url" do
+
+        context "csp header value does not include new js agent url" do
+          it "should have the configuration set to the default js_agent_url value" do
+            expect(TCellAgent.configuration.js_agent_url).to eq("https://api.tcell.io/tcellagent.min.js")
+
+            content_security_policy_json = {
+              "policy_id"=>"01a1",
+              "headers"=>[
+                {"name"=>"csp", "value"=>"script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.tcell.io/"}
+              ]
+            }
+
+            csp_policy = ContentSecurityPolicy.from_json(content_security_policy_json)
+
+            expect(csp_policy.headers.length).to eq(1)
+            expect(csp_policy.headers[0].value).to eq("script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.tcell.io/")
+            expect(TCellAgent.configuration.js_agent_url).to eq("https://api.tcell.io/tcellagent.min.js")
+          end
+        end
+
+        context "csp header value includes new js agent url" do
+          it "should have the configuration set to the default js_agent_url value" do
+            expect(TCellAgent.configuration.js_agent_url).to eq("https://api.tcell.io/tcellagent.min.js")
+
+            content_security_policy_json = {
+              "policy_id"=>"01a1",
+              "headers"=>[
+                {"name"=>"csp", "value"=>"script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.tcell.io/ https://jsagent.tcell.io/"}
+              ]
+            }
+
+            csp_policy = ContentSecurityPolicy.from_json(content_security_policy_json)
+
+            expect(csp_policy.headers.length).to eq(1)
+            expect(csp_policy.headers[0].value).to eq("script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.tcell.io/ https://jsagent.tcell.io/")
+            expect(TCellAgent.configuration.js_agent_url).to eq("https://jsagent.tcell.io/tcellagent.min.js")
+          end
+
+          context "but js_agent_url was not default" do
+            it "should not modify js_agent_url" do
+              TCellAgent.configuration.startup_js_agent_url = "https://www.customer-website.com/tcellagent.min.js"
+              TCellAgent.configuration.js_agent_url = "https://www.customer-website.com/tcellagent.min.js"
+              expect(TCellAgent.configuration.js_agent_url).to eq("https://www.customer-website.com/tcellagent.min.js")
+
+              content_security_policy_json = {
+                "policy_id"=>"01a1",
+                "headers"=>[
+                  {"name"=>"csp", "value"=>"script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.tcell.io/ https://jsagent.tcell.io/"}
+                ]
+              }
+
+              csp_policy = ContentSecurityPolicy.from_json(content_security_policy_json)
+
+              expect(csp_policy.headers.length).to eq(1)
+              expect(csp_policy.headers[0].value).to eq("script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.tcell.io/ https://jsagent.tcell.io/")
+              expect(TCellAgent.configuration.js_agent_url).to eq("https://www.customer-website.com/tcellagent.min.js")
+
+              TCellAgent.configuration.startup_js_agent_url = "https://api.tcell.io/tcellagent.min.js"
+              TCellAgent.configuration.js_agent_url = "https://api.tcell.io/tcellagent.min.js"
+            end
+          end
+        end
+      end
     end
   end
 end

data/spec/lib/tcell_agent/policies/patches_policy_spec.rb

@@ -26,8 +26,8 @@ module TCellAgent
             patches = PatchesPolicy.from_json({ "policy_id" => "policy_id" })
             expect(patches.policy_id).to eq("policy_id")
             expect(patches.version).to be_nil
-            expect(patches.ip_blocking_enabled).to eq(false)
-            expect(patches.blocked_ips).to eq({})
+            expect(patches.enabled).to eq(false)
+            expect(patches.block_rules).to eq([])
           end
         end
 
@@ -39,12 +39,12 @@ module TCellAgent
             })
             expect(patches.policy_id).to eq("policy_id")
             expect(patches.version).to eq(1)
-            expect(patches.ip_blocking_enabled).to eq(false)
-            expect(patches.blocked_ips).to eq({})
+            expect(patches.enabled).to eq(false)
+            expect(patches.block_rules).to eq([])
           end
         end
 
-        context "with an empty blocked_ips" do
+        context "with an empty block_rules" do
           it "should have disabled ip blocking" do
             patches = PatchesPolicy.from_json({
               "policy_id" => "policy_id",
@@ -53,8 +53,8 @@ module TCellAgent
             })
             expect(patches.policy_id).to eq("policy_id")
             expect(patches.version).to eq(1)
-            expect(patches.ip_blocking_enabled).to eq(false)
-            expect(patches.blocked_ips).to eq({})
+            expect(patches.enabled).to eq(false)
+            expect(patches.block_rules).to eq([])
           end
         end
 
@@ -70,8 +70,8 @@ module TCellAgent
               })
               expect(patches.policy_id).to eq("policy_id")
               expect(patches.version).to eq(1)
-              expect(patches.ip_blocking_enabled).to eq(false)
-              expect(patches.blocked_ips).to eq({})
+              expect(patches.enabled).to eq(false)
+              expect(patches.block_rules).to eq([])
             end
           end
 
@@ -87,28 +87,116 @@ module TCellAgent
                   ]
                 }
               })
+
+              expect(patches.policy_id).to eq("policy_id")
+              expect(patches.version).to eq(1)
+              expect(patches.enabled).to eq(true)
+              expect(patches.block_rules.size).to eq(1)
+              expect(patches.block_rules[0].ips).to eq(Set.new(["0.0.0.0", "1.1.1.1"]))
+              expect(patches.block_rules[0].rids).to eq(Set.new)
+              expect(patches.block_rules[0].action).to eq("block_403s")
+            end
+          end
+        end
+
+        context "with block_rules" do
+          context "as an empty list" do
+            it "should have ip blocking disabled" do
+              patches = PatchesPolicy.from_json({
+                "policy_id" => "policy_id",
+                "version" => 1,
+                "data" => {
+                  "block_rules" => []
+                }
+              })
               expect(patches.policy_id).to eq("policy_id")
               expect(patches.version).to eq(1)
-              expect(patches.ip_blocking_enabled).to eq(true)
-              expect(patches.blocked_ips).to eq({"0.0.0.0"=>true, "1.1.1.1"=>true})
+              expect(patches.enabled).to eq(false)
+              expect(patches.block_rules).to eq([])
+            end
+          end
+
+          context "a non empty list" do
+            it "should have ip blocking enabled" do
+              block_rule_one = double("block_rule_one")
+              block_rule_dos = double("block_rule_dos")
+
+              expect(TCellAgent::Patches::BlockRule).to receive(:from_json).with(
+                {"assume_this_is_well_formed" => "well_formed"}
+              ).and_return(block_rule_one)
+
+              expect(TCellAgent::Patches::BlockRule).to receive(:from_json).with(
+                {"assume_this_is_well_formed_dos" => "well_formed_dos"}
+              ).and_return(block_rule_dos)
+
+              patches = PatchesPolicy.from_json({
+                "policy_id" => "policy_id",
+                "version" => 1,
+                "data" => {
+                  "block_rules" => [
+                    {"assume_this_is_well_formed" => "well_formed"},
+                    {"assume_this_is_well_formed_dos" => "well_formed_dos"}
+                  ]
+                }
+              })
+
+              expect(patches.policy_id).to eq("policy_id")
+              expect(patches.version).to eq(1)
+              expect(patches.enabled).to eq(true)
+              expect(patches.block_rules).to eq([block_rule_one, block_rule_dos])
+            end
+
+            context "with a malformed block rule" do
+              it "should ignore the block rule" do
+                expect(TCellAgent::Patches::BlockRule).to receive(:from_json).with(
+                  {"assume_this_is_ill_formed" => "ill_formed"}
+                ).and_return(nil)
+
+                patches = PatchesPolicy.from_json({
+                  "policy_id" => "policy_id",
+                  "version" => 1,
+                  "data" => {
+                    "block_rules" => [
+                      {"assume_this_is_ill_formed" => "ill_formed"}
+                    ]
+                  }
+                })
+
+                expect(patches.policy_id).to eq("policy_id")
+                expect(patches.version).to eq(1)
+                expect(patches.enabled).to eq(false)
+                expect(patches.block_rules).to eq([])
+              end
             end
 
-            context "with incorrect key names" do
-              it "should skip bad keys" do
+            context "with a malformed block rule and a well formed block rule" do
+              it "should ignore the block rule" do
+                block_rule = double("block_rule")
+
+                expect(TCellAgent::Patches::BlockRule).to receive(:from_json).with(
+                  {"assume_this_is_ill_formed" => "ill_formed"}
+                ).and_return(nil)
+
+                expect(TCellAgent::Patches::BlockRule).to receive(:from_json).with(
+                  {"assume_this_is_well_formed" => "well_formed"}
+                ).and_return(block_rule)
+
                 patches = PatchesPolicy.from_json({
                   "policy_id" => "policy_id",
                   "version" => 1,
                   "data" => {
-                    "blocked_ips" => [
-                      {"ip_wrong" => "0.0.0.0"},
-                      {"ip" => "1.1.1.1"}
+                    "block_rules" => [
+                      {"assume_this_is_ill_formed" => "ill_formed"},
+                      {"assume_this_is_well_formed" => "well_formed"}
                     ]
                   }
                 })
+
+
                 expect(patches.policy_id).to eq("policy_id")
                 expect(patches.version).to eq(1)
-                expect(patches.ip_blocking_enabled).to eq(true)
-                expect(patches.blocked_ips).to eq({"1.1.1.1"=>true})
+                expect(patches.enabled).to eq(true)
+                expect(patches.block_rules).to eq([block_rule])
               end
             end
 
@@ -116,27 +204,400 @@ module TCellAgent
               it "should have ip blocking disabled" do
                 logger = double("logger")
                 expect(TCellAgent).to receive(:logger).and_return(logger)
-                expect(logger).to receive(:warn).with("Patches Policy not supported: 2")
+                expect(logger).to receive(:error).with("Patches Policy not supported: 2")
+
+                expect(TCellAgent::Patches::BlockRule).to_not receive(:from_json)
 
                 patches = PatchesPolicy.from_json({
                   "policy_id" => "policy_id",
                   "version" => 2,
                   "data" => {
-                    "blocked_ips" => [
-                      {"ip" => "0.0.0.0"},
-                      {"ip" => "1.1.1.1"}
+                    "block_rules" => [
+                      {"assume_this_is_well_formed" => "well_formed"}
                     ]
                   }
                 })
+
                 expect(patches.policy_id).to eq("policy_id")
                 expect(patches.version).to eq(2)
-                expect(patches.ip_blocking_enabled).to eq(false)
-                expect(patches.blocked_ips).to eq({})
+                expect(patches.enabled).to eq(false)
+                expect(patches.block_rules).to eq([])
               end
             end
           end
         end
+
+        context "with wiki examples" do
+          context "with example one" do
+            it "should be enabled" do
+              patches = TCellAgent::Policies::PatchesPolicy.from_json({
+                "version" => 1,
+                "policy_id" => "some uuid",
+                "data" => {
+                  "block_rules" => [
+                    {
+                      "ips" => ["1.3.3.4"]
+                    }
+                  ]
+                }
+              })
+
+              expect(patches.enabled).to eq(true)
+              expect(patches.block_rules.size).to eq(1)
+              expect(patches.block_rules[0].ips).to eq(Set.new(["1.3.3.4"]))
+              expect(patches.block_rules[0].rids).to eq(Set.new)
+
+              injections_matcher = patches.block_rules[0].sensors_matcher.injections_matcher
+              expect(injections_matcher.enabled).to eq(false)
+              expect(injections_matcher.sensors.size).to eq(0)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "1.3.3.4"
+              expect(patches.apply(meta_data)).to eq(403)
+            end
+          end
+
+          context "with example two" do
+            it "should be enabled" do
+              patches = TCellAgent::Policies::PatchesPolicy.from_json({
+                "version" => 1,
+                "policy_id" => "some uuid",
+                "data" => {
+                  "block_rules" => [
+                    {
+                      "rids" => ["123213","-3328888"]
+                    }
+                  ]
+                }
+              })
+
+              expect(patches.enabled).to eq(true)
+              expect(patches.block_rules.size).to eq(1)
+              expect(patches.block_rules[0].ips).to eq(Set.new)
+              expect(patches.block_rules[0].rids).to eq(Set.new(["123213", "-3328888"]))
+
+              injections_matcher = patches.block_rules[0].sensors_matcher.injections_matcher
+              expect(injections_matcher.enabled).to eq(false)
+              expect(injections_matcher.sensors.size).to eq(0)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "1.3.3.4"
+              expect(patches.apply(meta_data)).to eq(false)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "1.3.3.4"
+              meta_data.route_id = "123213"
+              expect(patches.apply(meta_data)).to eq(403)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "1.3.3.4"
+              meta_data.route_id = "-3328888"
+              expect(patches.apply(meta_data)).to eq(403)
+            end
+          end
+
+          context "with example three" do
+            it "should be enabled" do
+              patches = TCellAgent::Policies::PatchesPolicy.from_json({
+                "version" => 1,
+                "policy_id" => "some uuid",
+                "data" => {
+                  "block_rules" => [
+                    {
+                      "ips" => ["1.3.3.4"],
+                      "sensor_matches" => {
+                        "xss" => {
+                          "libinjection" => false,
+                          "patterns" => ["1","2","8"],
+                          "exclusions" => {
+                            "bob" => ["*"]
+                          }
+                        }
+                      }
+                    }
+                  ]
+                }
+              })
+
+              expect(patches.enabled).to eq(true)
+              expect(patches.block_rules.size).to eq(1)
+              expect(patches.block_rules[0].ips).to eq(Set.new(["1.3.3.4"]))
+              expect(patches.block_rules[0].rids).to eq(Set.new)
+
+              injections_matcher = patches.block_rules[0].sensors_matcher.injections_matcher
+              expect(injections_matcher.enabled).to eq(true)
+              expect(injections_matcher.sensors.size).to eq(1)
+              expect(injections_matcher.sensors[0].enabled).to eq(true)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "1.3.3.4"
+              expect(patches.apply(meta_data)).to eq(false)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "1.3.3.4"
+              meta_data.get_dict = {"xss_param" => "<script>"}
+              expect(patches.apply(meta_data)).to eq(403)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "1.3.3.4"
+              meta_data.get_dict = {"sqli_param" => "Erwin' OR '1'='1"}
+              expect(patches.apply(meta_data)).to eq(false)
+            end
+          end
+
+          context "with example four" do
+            it "should be enabled" do
+              patches = TCellAgent::Policies::PatchesPolicy.from_json({
+                "version" => 1,
+                "policy_id" => "some uuid",
+                "data" => {
+                  "block_rules" => [
+                    {
+                      "ips" => ["1.3.3.4"],
+                      "rids" => ["123213","-3328888"]
+                    }
+                  ]
+                }
+              })
+
+              expect(patches.enabled).to eq(true)
+              expect(patches.block_rules.size).to eq(1)
+              expect(patches.block_rules[0].ips).to eq(Set.new(["1.3.3.4"]))
+              expect(patches.block_rules[0].rids).to eq(Set.new(["123213", "-3328888"]))
+
+              injections_matcher = patches.block_rules[0].sensors_matcher.injections_matcher
+              expect(injections_matcher.enabled).to eq(false)
+              expect(injections_matcher.sensors.size).to eq(0)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "1.3.3.4"
+              meta_data.route_id = "111111"
+              expect(patches.apply(meta_data)).to eq(false)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "1.1.1.1"
+              meta_data.route_id = "123213"
+              expect(patches.apply(meta_data)).to eq(false)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "1.3.3.4"
+              meta_data.route_id = "123213"
+              expect(patches.apply(meta_data)).to eq(403)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "1.3.3.4"
+              meta_data.route_id = "-3328888"
+              expect(patches.apply(meta_data)).to eq(403)
+            end
+          end
+
+          context "with example five" do
+            it "should be enabled" do
+              patches = TCellAgent::Policies::PatchesPolicy.from_json({
+                "version" => 1,
+                "policy_id" => "some uuid",
+                "data" => {
+                  "block_rules" => [
+                    {
+                      "ips" => ["1.3.3.4"],
+                      "sensor_matches" => {
+                        "xss" => {},
+                        "sqli" => {}
+                      }
+                    }
+                  ]
+                }
+              })
+
+              expect(patches.enabled).to eq(true)
+              expect(patches.block_rules.size).to eq(1)
+              expect(patches.block_rules[0].ips).to eq(Set.new(["1.3.3.4"]))
+              expect(patches.block_rules[0].rids).to eq(Set.new)
+
+              injections_matcher = patches.block_rules[0].sensors_matcher.injections_matcher
+              expect(injections_matcher.enabled).to eq(true)
+              expect(injections_matcher.sensors.size).to eq(2)
+              expect(injections_matcher.sensors[0].enabled).to eq(true)
+              expect(injections_matcher.sensors[1].enabled).to eq(true)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "1.3.3.4"
+              expect(patches.apply(meta_data)).to eq(false)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "1.3.3.4"
+              meta_data.get_dict = {"xss_param" => "<script>"}
+              expect(patches.apply(meta_data)).to eq(false)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "1.3.3.4"
+              meta_data.get_dict = {"sqli_param" => "Erwin' OR '1'='1"}
+              expect(patches.apply(meta_data)).to eq(false)
+            end
+          end
+
+          context "with example six" do
+            it "should be disabled" do
+              patches = TCellAgent::Policies::PatchesPolicy.from_json({
+                "version" => 1,
+                "policy_id" => "some uuid",
+                "data" => {
+                  "block_rules" => [
+                    {
+                      "sensor_matches" => {
+                        "xss" => {},
+                        "sqli" => {}
+                      }
+                    }
+                  ]
+                }
+              })
+
+              expect(patches.enabled).to eq(false)
+              expect(patches.block_rules.size).to eq(0)
+            end
+          end
+
+          context "with example seven" do
+            it "should be enabled" do
+              patches = TCellAgent::Policies::PatchesPolicy.from_json({
+                "version" => 1,
+                "policy_id" => "some uuid",
+                "data" => {
+                  "blocked_ips" => [{"ip" => "1.1.1.1"}, {"ip" => "2.2.2.2"}],
+                  "block_rules" => [
+                    {
+                      "ips" => ["3.3.3.3"]
+                    }
+                  ]
+                }
+              })
+
+              expect(patches.enabled).to eq(true)
+              expect(patches.block_rules.size).to eq(2)
+              expect(patches.block_rules[0].ips).to eq(Set.new(["1.1.1.1", "2.2.2.2"]))
+              expect(patches.block_rules[0].rids).to eq(Set.new)
+              expect(patches.block_rules[1].ips).to eq(Set.new(["3.3.3.3"]))
+              expect(patches.block_rules[1].rids).to eq(Set.new)
+
+              injections_matcher = patches.block_rules[0].sensors_matcher.injections_matcher
+              expect(injections_matcher.enabled).to eq(false)
+              expect(injections_matcher.sensors.size).to eq(0)
+
+              injections_matcher = patches.block_rules[1].sensors_matcher.injections_matcher
+              expect(injections_matcher.enabled).to eq(false)
+              expect(injections_matcher.sensors.size).to eq(0)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "1.1.1.1"
+              expect(patches.apply(meta_data)).to eq(403)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "2.2.2.2"
+              expect(patches.apply(meta_data)).to eq(403)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "3.3.3.3"
+              expect(patches.apply(meta_data)).to eq(403)
+            end
+          end
+
+          context "with example eight" do
+            it "should be enabled" do
+              patches = TCellAgent::Policies::PatchesPolicy.from_json({
+                "version" => 1,
+                "policy_id" => "some uuid",
+                "data" => {
+                  "block_rules" => [
+                    {
+                      "ips" => ["1.3.3.4"]
+                    },
+                    {
+                      "rids" => ["123213","-3328888"]
+                    }
+                  ]
+                }
+              })
+
+              expect(patches.enabled).to eq(true)
+              expect(patches.block_rules.size).to eq(2)
+              expect(patches.block_rules[0].ips).to eq(Set.new(["1.3.3.4"]))
+              expect(patches.block_rules[0].rids).to eq(Set.new)
+              expect(patches.block_rules[1].ips).to eq(Set.new())
+              expect(patches.block_rules[1].rids).to eq(Set.new(["123213", "-3328888"]))
+
+              injections_matcher = patches.block_rules[0].sensors_matcher.injections_matcher
+              expect(injections_matcher.enabled).to eq(false)
+              expect(injections_matcher.sensors.size).to eq(0)
+
+              injections_matcher = patches.block_rules[1].sensors_matcher.injections_matcher
+              expect(injections_matcher.enabled).to eq(false)
+              expect(injections_matcher.sensors.size).to eq(0)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "1.3.3.4"
+              meta_data.route_id = "11111"
+              expect(patches.apply(meta_data)).to eq(403)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "1.1.1.1"
+              meta_data.route_id = "123213"
+              expect(patches.apply(meta_data)).to eq(403)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "1.1.1.1"
+              meta_data.route_id = "-3328888"
+              expect(patches.apply(meta_data)).to eq(403)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "1.3.3.4"
+              meta_data.route_id = "-3328888"
+              expect(patches.apply(meta_data)).to eq(403)
+            end
+          end
+
+          context "with example nine" do
+            it "should be enabled" do
+              patches = TCellAgent::Policies::PatchesPolicy.from_json({
+                "version" => 1,
+                "policy_id" => "some uuid",
+                "data" => {
+                  "blocked_ips" => [{"ip" => "1.1.1.1"}, {"ip" => "2.2.2.2"}],
+                  "block_rules" => [
+                    {
+                      "ips" => ["1.1.1.1", "2.2.2.2"]
+                    }
+                  ]
+                }
+              })
+
+              expect(patches.enabled).to eq(true)
+              expect(patches.block_rules.size).to eq(2)
+              expect(patches.block_rules[0].ips).to eq(Set.new(["1.1.1.1", "2.2.2.2"]))
+              expect(patches.block_rules[0].rids).to eq(Set.new)
+              expect(patches.block_rules[1].ips).to eq(Set.new(["1.1.1.1", "2.2.2.2"]))
+              expect(patches.block_rules[1].rids).to eq(Set.new)
+
+              injections_matcher = patches.block_rules[0].sensors_matcher.injections_matcher
+              expect(injections_matcher.enabled).to eq(false)
+              expect(injections_matcher.sensors.size).to eq(0)
+
+              injections_matcher = patches.block_rules[1].sensors_matcher.injections_matcher
+              expect(injections_matcher.enabled).to eq(false)
+              expect(injections_matcher.sensors.size).to eq(0)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "1.1.1.1"
+              expect(patches.apply(meta_data)).to eq(403)
+
+              meta_data = TCellAgent::Patches::MetaData.new
+              meta_data.remote_address = "2.2.2.2"
+              expect(patches.apply(meta_data)).to eq(403)
+            end
+          end
+        end
       end
+
     end
 
   end