tcell_agent 0.4.0 → 1.0.0

data/spec/lib/tcell_agent/policies/command_injection_policy_spec.rb

@@ -2,735 +2,865 @@ require 'spec_helper'
 
 module TCellAgent
   module Policies
+    describe RustPolicies do
+      before(:each) do
+        allow(TCellAgent).to receive(:is_it_safe_to_send_cmdi_events?).and_return(true)
+        @rust_policies = RustPolicies.new
+      end
+
+      describe '#update_policies' do
+        context 'with a nil policy' do
+          it 'should return nil' do
+            expect(TCellAgent).to_not receive(:logger)
+
+            @rust_policies.update_policies(nil)
 
-    describe CommandInjectionPolicy do
-      describe "#from_json" do
-        context "with a nil policy" do
-          it "should return nil" do
-            expect(CommandInjectionPolicy.from_json(nil)).to be_nil
+            expect(@rust_policies.cmdi_enabled).to eq(false)
           end
         end
 
-        context "with an empty policy" do
-          it "should raise a policy missing error" do
-            expect {
-              CommandInjectionPolicy.from_json({})
-            }.to raise_error(RuntimeError)
+        context 'with an empty policy' do
+          it 'should raise a policy missing error' do
+            expect(TCellAgent).to_not receive(:logger)
+            @rust_policies.update_policies({})
+
+            expect(@rust_policies.cmdi_enabled).to eq(false)
           end
         end
 
-        context "with an empty version" do
-          it "should have empty version" do
-            cmdi = CommandInjectionPolicy.from_json({ "policy_id" => "policy_id" })
-            expect(cmdi.policy_id).to eq("policy_id")
-            expect(cmdi.version).to be_nil
-            expect(cmdi.enabled).to eq(false)
-            expect(cmdi.overall_action).to be_nil
-            expect(cmdi.compound_statement_rule).to be_nil
-            expect(cmdi.command_rules).to eq({})
-            expect(cmdi.collect_full_commandline).to eq(false)
+        context 'with an empty version' do
+          it 'should have empty version' do
+            logger = double('logger')
+
+            expect(TCellAgent).to receive(:logger).and_return(logger)
+            expect(logger).to receive(:error).with(
+              'Error updating policies: Failed to decode cmdi policy: missing field `version`'
+            )
+            @rust_policies.update_policies(
+              {
+                'cmdi' => { 'policy_id' => 'policy_id' }
+              }
+            )
+
+            expect(@rust_policies.cmdi_enabled).to eq(false)
           end
         end
 
-        context "with no data" do
-          it "should have disabled ip blocking" do
-            cmdi = CommandInjectionPolicy.from_json({
-              "policy_id" => "policy_id",
-              "version" => 1
-            })
-            expect(cmdi.policy_id).to eq("policy_id")
-            expect(cmdi.version).to eq(1)
-            expect(cmdi.enabled).to eq(false)
-            expect(cmdi.overall_action).to be_nil
-            expect(cmdi.compound_statement_rule).to be_nil
-            expect(cmdi.command_rules).to eq({})
-            expect(cmdi.collect_full_commandline).to eq(false)
+        context 'with no data' do
+          it 'should have disabled ip blocking' do
+            expect(TCellAgent).to_not receive(:logger)
+
+            @rust_policies.update_policies(
+              {
+                'cmdi' => {
+                  'policy_id' => 'policy_id',
+                  'version' => 1
+                }
+              }
+            )
+            expect(@rust_policies.cmdi_enabled).to eq(false)
           end
         end
 
-        context "with empty data" do
-          it "should have default values" do
-            cmdi = CommandInjectionPolicy.from_json({
-              "policy_id" => "policy_id",
-              "version" => 1,
-              "data" => {}
-            })
-            expect(cmdi.policy_id).to eq("policy_id")
-            expect(cmdi.version).to eq(1)
-            expect(cmdi.enabled).to eq(false)
-            expect(cmdi.overall_action).to be_nil
-            expect(cmdi.compound_statement_rule).to be_nil
-            expect(cmdi.command_rules).to eq({})
-            expect(cmdi.collect_full_commandline).to eq(false)
+        context 'with empty data' do
+          it 'should have default values' do
+            expect(TCellAgent).to_not receive(:logger)
+            @rust_policies.update_policies(
+              {
+                'cmdi' => {
+                  'policy_id' => 'policy_id',
+                  'version' => 1,
+                  'data' => {}
+                }
+              }
+            )
+            expect(@rust_policies.cmdi_enabled).to eq(false)
           end
         end
 
-        context "with empty command rules" do
-          it "should have default values" do
-            cmdi = CommandInjectionPolicy.from_json({
-              "policy_id" => "policy_id",
-              "version" => 1,
-              "data" => {
-                "command_rules" => []
+        context 'with empty command rules' do
+          it 'should have default values' do
+            expect(TCellAgent).to_not receive(:logger)
+            @rust_policies.update_policies(
+              {
+                'cmdi' => {
+                  'policy_id' => 'policy_id',
+                  'version' => 1,
+                  'data' => {
+                    'command_rules' => []
+                  }
+                }
               }
-            })
-            expect(cmdi.policy_id).to eq("policy_id")
-            expect(cmdi.version).to eq(1)
-            expect(cmdi.enabled).to eq(false)
-            expect(cmdi.overall_action).to be_nil
-            expect(cmdi.compound_statement_rule).to be_nil
-            expect(cmdi.command_rules).to eq({})
-            expect(cmdi.collect_full_commandline).to eq(false)
+            )
+            expect(@rust_policies.cmdi_enabled).to eq(false)
           end
         end
 
-        context "with empty compount statement rules" do
-          it "should have default values" do
-            cmdi = CommandInjectionPolicy.from_json({
-              "policy_id" => "policy_id",
-              "version" => 1,
-              "data" => {
-                "compound_statement_rules" => []
+        context 'with empty compount statement rules' do
+          it 'should have default values' do
+            expect(TCellAgent).to_not receive(:logger)
+            @rust_policies.update_policies(
+              {
+                'cmdi' => {
+                  'policy_id' => 'policy_id',
+                  'version' => 1,
+                  'data' => {
+                    'compound_statement_rules' => []
+                  }
+                }
               }
-            })
-            expect(cmdi.policy_id).to eq("policy_id")
-            expect(cmdi.version).to eq(1)
-            expect(cmdi.enabled).to eq(false)
-            expect(cmdi.overall_action).to be_nil
-            expect(cmdi.compound_statement_rule).to be_nil
-            expect(cmdi.command_rules).to eq({})
-            expect(cmdi.collect_full_commandline).to eq(false)
+            )
+            expect(@rust_policies.cmdi_enabled).to eq(false)
           end
         end
 
-        context "with populated command rules" do
-          it "should have default values" do
-            cmdi = CommandInjectionPolicy.from_json({
-              "policy_id" => "policy_id",
-              "version" => 1,
-              "data" => {
-                "command_rules" => [
-                  {"rule_id" => "1", "action" => "block"},
-                  {"rule_id" => "2", "command" => "nc", "action" => "ignore"}
-                ]
+        context 'with populated command rules' do
+          it 'should have default values' do
+            expect(TCellAgent).to_not receive(:logger)
+            @rust_policies.update_policies(
+              {
+                'cmdi' => {
+                  'policy_id' => 'policy_id',
+                  'version' => 1,
+                  'data' => {
+                    'command_rules' => [
+                      { 'rule_id' => '1', 'action' => 'block' },
+                      { 'rule_id' => '2', 'command' => 'nc', 'action' => 'ignore' }
+                    ]
+                  }
+                }
               }
-            })
-
-            expect(cmdi.policy_id).to eq("policy_id")
-            expect(cmdi.version).to eq(1)
-            expect(cmdi.enabled).to eq(true)
-            expect(cmdi.overall_action).to_not be_nil
-            expect(cmdi.overall_action.rule_id).to eq("1")
-            expect(cmdi.overall_action.action).to eq(CommandRule::BLOCK)
-            expect(cmdi.overall_action.command).to be_nil
-            expect(cmdi.command_rules.size).to eq(1)
-            expect(cmdi.command_rules["nc"]).to_not be_nil
-            expect(cmdi.command_rules["nc"].rule_id).to eq("2")
-            expect(cmdi.command_rules["nc"].action).to eq(CommandRule::IGNORE)
-            expect(cmdi.command_rules["nc"].command).to eq("nc")
-            expect(cmdi.compound_statement_rule).to be_nil
-            expect(cmdi.collect_full_commandline).to eq(false)
+            )
+
+            expect(@rust_policies.cmdi_enabled).to eq(true)
           end
         end
 
-        context "with populated compound statement rules" do
-          it "should have default values" do
-            cmdi = CommandInjectionPolicy.from_json({
-              "policy_id" => "policy_id",
-              "version" => 1,
-              "data" => {
-                "compound_statement_rules" => [
-                  {"rule_id" => "3", "action" => "block"}
-                ]
+        context 'with populated compound statement rules' do
+          it 'should have default values' do
+            expect(TCellAgent).to_not receive(:logger)
+            @rust_policies.update_policies(
+              {
+                'cmdi' => {
+                  'policy_id' => 'policy_id',
+                  'version' => 1,
+                  'data' => {
+                    'compound_statement_rules' => [
+                      { 'rule_id' => '3', 'action' => 'block' }
+                    ]
+                  }
+                }
               }
-            })
-
-            expect(cmdi.policy_id).to eq("policy_id")
-            expect(cmdi.version).to eq(1)
-            expect(cmdi.enabled).to eq(true)
-            expect(cmdi.overall_action).to be_nil
-            expect(cmdi.command_rules).to eq({})
-            expect(cmdi.compound_statement_rule).to_not be_nil
-            expect(cmdi.compound_statement_rule.rule_id).to eq("3")
-            expect(cmdi.compound_statement_rule.action).to eq(CommandRule::BLOCK)
-            expect(cmdi.compound_statement_rule.command).to be_nil
-            expect(cmdi.collect_full_commandline).to eq(false)
+            )
+
+            expect(@rust_policies.cmdi_enabled).to eq(true)
           end
         end
 
-        context "with populated collect_full_commandline" do
-          context "as nil" do
-            it "should have collect_full_commandline disabled" do
-              cmdi = CommandInjectionPolicy.from_json({
-                "policy_id" => "policy_id",
-                "version" => 1,
-                "data" => {
-                  "collect_full_commandline" => nil,
-                  "compound_statement_rules" => [
-                    {"rule_id" => "3", "action" => "block"}
-                  ]
+        context 'with populated collect_full_commandline' do
+          context 'as nil' do
+            it 'should have collect_full_commandline disabled' do
+              expect(TCellAgent).to_not receive(:logger)
+              @rust_policies.update_policies(
+                {
+                  'cmdi' => {
+                    'policy_id' => 'policy_id',
+                    'version' => 1,
+                    'data' => {
+                      'collect_full_commandline' => nil,
+                      'compound_statement_rules' => [
+                        { 'rule_id' => '3', 'action' => 'block' }
+                      ]
+                    }
+                  }
                 }
-              })
-
-              expect(cmdi.policy_id).to eq("policy_id")
-              expect(cmdi.version).to eq(1)
-              expect(cmdi.enabled).to eq(true)
-              expect(cmdi.overall_action).to be_nil
-              expect(cmdi.command_rules).to eq({})
-              expect(cmdi.compound_statement_rule).to_not be_nil
-              expect(cmdi.compound_statement_rule.rule_id).to eq("3")
-              expect(cmdi.compound_statement_rule.action).to eq(CommandRule::BLOCK)
-              expect(cmdi.compound_statement_rule.command).to be_nil
-              expect(cmdi.collect_full_commandline).to eq(false)
+              )
+
+              expect(@rust_policies.cmdi_enabled).to eq(true)
             end
           end
 
-          context "as false" do
-            it "should have collect_full_commandline disabled" do
-              cmdi = CommandInjectionPolicy.from_json({
-                "policy_id" => "policy_id",
-                "version" => 1,
-                "data" => {
-                  "collect_full_commandline" => false,
-                  "compound_statement_rules" => [
-                    {"rule_id" => "3", "action" => "block"}
-                  ]
+          context 'as false' do
+            it 'should have collect_full_commandline disabled' do
+              @rust_policies.update_policies(
+                {
+                  'cmdi' => {
+                    'policy_id' => 'policy_id',
+                    'version' => 1,
+                    'data' => {
+                      'collect_full_commandline' => false,
+                      'compound_statement_rules' => [
+                        { 'rule_id' => '3', 'action' => 'block' }
+                      ]
+                    }
+                  }
                 }
-              })
-
-              expect(cmdi.policy_id).to eq("policy_id")
-              expect(cmdi.version).to eq(1)
-              expect(cmdi.enabled).to eq(true)
-              expect(cmdi.overall_action).to be_nil
-              expect(cmdi.command_rules).to eq({})
-              expect(cmdi.compound_statement_rule).to_not be_nil
-              expect(cmdi.compound_statement_rule.rule_id).to eq("3")
-              expect(cmdi.compound_statement_rule.action).to eq(CommandRule::BLOCK)
-              expect(cmdi.compound_statement_rule.command).to be_nil
-              expect(cmdi.collect_full_commandline).to eq(false)
+              )
+
+              expect(@rust_policies.cmdi_enabled).to eq(true)
             end
           end
 
-          context "as true" do
-            it "should have collect_full_commandline enabled" do
-              cmdi = CommandInjectionPolicy.from_json({
-                "policy_id" => "policy_id",
-                "version" => 1,
-                "data" => {
-                  "collect_full_commandline" => true,
-                  "compound_statement_rules" => [
-                    {"rule_id" => "3", "action" => "block"}
-                  ]
+          context 'as true' do
+            it 'should have collect_full_commandline enabled' do
+              @rust_policies.update_policies(
+                {
+                  'cmdi' => {
+                    'policy_id' => 'policy_id',
+                    'version' => 1,
+                    'data' => {
+                      'collect_full_commandline' => true,
+                      'compound_statement_rules' => [
+                        { 'rule_id' => '3', 'action' => 'block' }
+                      ]
+                    }
+                  }
                 }
-              })
-
-              expect(cmdi.policy_id).to eq("policy_id")
-              expect(cmdi.version).to eq(1)
-              expect(cmdi.enabled).to eq(true)
-              expect(cmdi.overall_action).to be_nil
-              expect(cmdi.command_rules).to eq({})
-              expect(cmdi.compound_statement_rule).to_not be_nil
-              expect(cmdi.compound_statement_rule.rule_id).to eq("3")
-              expect(cmdi.compound_statement_rule.action).to eq(CommandRule::BLOCK)
-              expect(cmdi.compound_statement_rule.command).to be_nil
-              expect(cmdi.collect_full_commandline).to eq(true)
+              )
+
+              expect(@rust_policies.cmdi_enabled).to eq(true)
             end
           end
         end
-
       end
 
-      describe "#block?" do
-        context "with command rules" do
-          context "that are blank" do
-            it "should not block" do
-              cmdi = CommandInjectionPolicy.from_json({
-                "policy_id" => "policy_id",
-                "version" => 1,
-                "data" => {
-                  "collect_full_commandline" => true,
-                  "command_rules" => []
+      describe '#block_command?' do
+        context 'with command rules' do
+          context 'that are blank' do
+            it 'should not block' do
+              @rust_policies.update_policies(
+                {
+                  'cmdi' => {
+                    'policy_id' => 'policy_id',
+                    'version' => 1,
+                    'data' => {
+                      'collect_full_commandline' => true,
+                      'command_rules' => []
+                    }
+                  }
                 }
-              })
+              )
 
               expect(TCellAgent).to_not receive(:send_event)
 
               expect(
-                cmdi.block?("cat /etc/passwd | grep root", nil)
+                @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
               ).to eq(false)
             end
           end
 
-          context "that ignore all" do
-            it "should not block" do
-              cmdi = CommandInjectionPolicy.from_json({
-                "policy_id" => "policy_id",
-                "version" => 1,
-                "data" => {
-                  "collect_full_commandline" => true,
-                  "command_rules" => [{"rule_id" => "1", "action" => "ignore"}]
+          context 'that ignore all' do
+            it 'should not block' do
+              @rust_policies.update_policies(
+                {
+                  'cmdi' => {
+                    'policy_id' => 'policy_id',
+                    'version' => 1,
+                    'data' => {
+                      'collect_full_commandline' => true,
+                      'command_rules' => [{ 'rule_id' => '1', 'action' => 'ignore' }]
+                    }
+                  }
                 }
-              })
+              )
 
               expect(TCellAgent).to_not receive(:send_event)
 
               expect(
-                cmdi.block?("cat /etc/passwd | grep root", nil)
+                @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
               ).to eq(false)
             end
 
-            context "and ignore cat" do
-              it "should not send an event" do
-                cmdi = CommandInjectionPolicy.from_json({
-                  "policy_id" => "policy_id",
-                  "version" => 1,
-                  "data" => {
-                    "collect_full_commandline" => true,
-                    "command_rules" => [
-                      {"rule_id" => "1", "action" => "ignore"},
-                      {"rule_id" => "2", "action" => "ignore", "command" => "cat"}
-                    ]
+            context 'and ignore cat' do
+              it 'should not send an event' do
+                @rust_policies.update_policies(
+                  {
+                    'cmdi' => {
+                      'policy_id' => 'policy_id',
+                      'version' => 1,
+                      'data' => {
+                        'collect_full_commandline' => true,
+                        'command_rules' => [
+                          { 'rule_id' => '1', 'action' => 'ignore' },
+                          { 'rule_id' => '2', 'action' => 'ignore', 'command' => 'cat' }
+                        ]
+                      }
+                    }
                   }
-                })
+                )
 
                 expect(TCellAgent).to_not receive(:send_event)
 
                 expect(
-                  cmdi.block?("cat /etc/passwd | grep root", nil)
+                  @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
                 ).to eq(false)
               end
             end
 
-            context "and report cat" do
-              it "should send an event" do
-                cmdi = CommandInjectionPolicy.from_json({
-                  "policy_id" => "policy_id",
-                  "version" => 1,
-                  "data" => {
-                    "collect_full_commandline" => true,
-                    "command_rules" => [
-                      {"rule_id" => "1", "action" => "ignore"},
-                      {"rule_id" => "2", "action" => "report", "command" => "cat"}
-                    ]
+            context 'and report cat' do
+              it 'should send an event' do
+                @rust_policies.update_policies(
+                  {
+                    'cmdi' => {
+                      'policy_id' => 'policy_id',
+                      'version' => 1,
+                      'data' => {
+                        'collect_full_commandline' => true,
+                        'command_rules' => [
+                          { 'rule_id' => '1', 'action' => 'ignore' },
+                          { 'rule_id' => '2', 'action' => 'report', 'command' => 'cat' }
+                        ]
+                      }
+                    }
                   }
-                })
-
-                expect(TCellAgent).to receive(:send_event).with({
-                  "event_type" => "cmdi",
-                  "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
-                  "blocked" => false,
-                  "matches" => [{"rule_id" => "2", "command" => "cat"}],
-                  "full_commandline" => "cat /etc/passwd | grep root"
-                })
+                )
+
+                expect(TCellAgent).to receive(:send_event).with(
+                  {
+                    'event_type' => 'cmdi',
+                    'commands' => [
+                      { 'command' => 'cat', 'arg_count' => 1 },
+                      { 'command' => 'grep', 'arg_count' => 1 }
+                    ],
+                    'blocked' => false,
+                    'matches' => [{ 'rule_id' => '2', 'command' => 'cat' }],
+                    'full_commandline' => 'cat /etc/passwd | grep root'
+                  }
+                )
 
                 expect(
-                  cmdi.block?("cat /etc/passwd | grep root", nil)
+                  @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
                 ).to eq(false)
               end
             end
 
-            context "and block cat" do
-              it "should send an event and block" do
-                cmdi = CommandInjectionPolicy.from_json({
-                  "policy_id" => "policy_id",
-                  "version" => 1,
-                  "data" => {
-                    "collect_full_commandline" => true,
-                    "command_rules" => [
-                      {"rule_id" => "1", "action" => "ignore"},
-                      {"rule_id" => "2", "action" => "block", "command" => "cat"}
-                    ]
+            context 'and block cat' do
+              it 'should send an event and block' do
+                @rust_policies.update_policies(
+                  {
+                    'cmdi' => {
+                      'policy_id' => 'policy_id',
+                      'version' => 1,
+                      'data' => {
+                        'collect_full_commandline' => true,
+                        'command_rules' => [
+                          { 'rule_id' => '1', 'action' => 'ignore' },
+                          { 'rule_id' => '2', 'action' => 'block', 'command' => 'cat' }
+                        ]
+                      }
+                    }
                   }
-                })
-
-                expect(TCellAgent).to receive(:send_event).with({
-                  "event_type" => "cmdi",
-                  "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
-                  "blocked" => true,
-                  "matches" => [{"rule_id" => "2", "command" => "cat"}],
-                  "full_commandline"=>"cat /etc/passwd | grep root"
-                })
+                )
+
+                expect(TCellAgent).to receive(:send_event).with(
+                  {
+                    'event_type' => 'cmdi',
+                    'commands' => [
+                      { 'command' => 'cat', 'arg_count' => 1 },
+                      { 'command' => 'grep', 'arg_count' => 1 }
+                    ],
+                    'blocked' => true,
+                    'matches' => [{ 'rule_id' => '2', 'command' => 'cat' }],
+                    'full_commandline' => 'cat /etc/passwd | grep root'
+                  }
+                )
 
                 expect(
-                  cmdi.block?("cat /etc/passwd | grep root", nil)
+                  @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
                 ).to eq(true)
               end
             end
           end
 
-          context "that report all" do
-            it "should send an event" do
-              cmdi = CommandInjectionPolicy.from_json({
-                "policy_id" => "policy_id",
-                "version" => 1,
-                "data" => {
-                  "command_rules" => [{"rule_id" => "1", "action" => "report"}]
+          context 'that report all' do
+            it 'should send an event' do
+              @rust_policies.update_policies(
+                {
+                  'cmdi' => {
+                    'policy_id' => 'policy_id',
+                    'version' => 1,
+                    'data' => {
+                      'command_rules' => [{ 'rule_id' => '1', 'action' => 'report' }]
+                    }
+                  }
                 }
-              })
-
-              expect(TCellAgent).to receive(:send_event).with({
-                "event_type" => "cmdi",
-                "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
-                "blocked" => false,
-                "matches" => [{"rule_id" => "1", "command" => "cat"}, {"rule_id" => "1", "command" => "grep"}]
-              })
+              )
+
+              expect(TCellAgent).to receive(:send_event).with(
+                {
+                  'event_type' => 'cmdi',
+                  'commands' => [
+                    { 'command' => 'cat', 'arg_count' => 1 },
+                    { 'command' => 'grep', 'arg_count' => 1 }
+                  ],
+                  'blocked' => false,
+                  'matches' => [
+                    { 'rule_id' => '1', 'command' => 'cat' },
+                    { 'rule_id' => '1', 'command' => 'grep' }
+                  ]
+                }
+              )
 
               expect(
-                cmdi.block?("cat /etc/passwd | grep root", nil)
+                @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
               ).to eq(false)
             end
 
-            context "and ignore cat" do
-              it "should send an event for grep not cat" do
-                cmdi = CommandInjectionPolicy.from_json({
-                  "policy_id" => "policy_id",
-                  "version" => 1,
-                  "data" => {
-                    "command_rules" => [
-                      {"rule_id" => "1", "action" => "report"},
-                      {"rule_id" => "2", "action" => "ignore", "command" => "cat"}
-                    ]
+            context 'and ignore cat' do
+              it 'should send an event for grep not cat' do
+                @rust_policies.update_policies(
+                  {
+                    'cmdi' => {
+                      'policy_id' => 'policy_id',
+                      'version' => 1,
+                      'data' => {
+                        'command_rules' => [
+                          { 'rule_id' => '1', 'action' => 'report' },
+                          { 'rule_id' => '2', 'action' => 'ignore', 'command' => 'cat' }
+                        ]
+                      }
+                    }
                   }
-                })
-
-                expect(TCellAgent).to receive(:send_event).with({
-                  "event_type" => "cmdi",
-                  "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
-                  "blocked" => false,
-                  "matches" => [{"rule_id" => "1", "command" => "grep"}]
-                })
+                )
+
+                expect(TCellAgent).to receive(:send_event).with(
+                  {
+                    'event_type' => 'cmdi',
+                    'commands' => [
+                      { 'command' => 'cat', 'arg_count' => 1 },
+                      { 'command' => 'grep', 'arg_count' => 1 }
+                    ],
+                    'blocked' => false,
+                    'matches' => [{ 'rule_id' => '1', 'command' => 'grep' }]
+                  }
+                )
 
                 expect(
-                  cmdi.block?("cat /etc/passwd | grep root", nil)
+                  @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
                 ).to eq(false)
               end
             end
 
-            context "and report cat" do
-              it "should send an event for grep and cat" do
-                cmdi = CommandInjectionPolicy.from_json({
-                  "policy_id" => "policy_id",
-                  "version" => 1,
-                  "data" => {
-                    "command_rules" => [
-                      {"rule_id" => "1", "action" => "report"},
-                      {"rule_id" => "2", "action" => "report", "command" => "cat"}
+            context 'and report cat' do
+              it 'should send an event for grep and cat' do
+                @rust_policies.update_policies(
+                  {
+                    'cmdi' => {
+                      'policy_id' => 'policy_id',
+                      'version' => 1,
+                      'data' => {
+                        'command_rules' => [
+                          { 'rule_id' => '1', 'action' => 'report' },
+                          { 'rule_id' => '2', 'action' => 'report', 'command' => 'cat' }
+                        ]
+                      }
+                    }
+                  }
+                )
+
+                expect(TCellAgent).to receive(:send_event).with(
+                  {
+                    'event_type' => 'cmdi',
+                    'commands' => [
+                      { 'command' => 'cat', 'arg_count' => 1 },
+                      { 'command' => 'grep', 'arg_count' => 1 }
+                    ],
+                    'blocked' => false,
+                    'matches' => [
+                      { 'rule_id' => '2', 'command' => 'cat' },
+                      { 'rule_id' => '1', 'command' => 'grep' }
                     ]
                   }
-                })
-
-                expect(TCellAgent).to receive(:send_event).with({
-                  "event_type" => "cmdi",
-                  "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
-                  "blocked" => false,
-                  "matches" => [{"rule_id" => "2", "command" => "cat"}, {"rule_id" => "1", "command" => "grep"}]
-                })
+                )
 
                 expect(
-                  cmdi.block?("cat /etc/passwd | grep root", nil)
+                  @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
                 ).to eq(false)
               end
             end
 
-            context "and block cat" do
-              it "should send an event for grep and cat and block" do
-                cmdi = CommandInjectionPolicy.from_json({
-                  "policy_id" => "policy_id",
-                  "version" => 1,
-                  "data" => {
-                    "command_rules" => [
-                      {"rule_id" => "1", "action" => "report"},
-                      {"rule_id" => "2", "action" => "block", "command" => "cat"}
+            context 'and block cat' do
+              it 'should send an event for grep and cat and block' do
+                @rust_policies.update_policies(
+                  {
+                    'cmdi' => {
+                      'policy_id' => 'policy_id',
+                      'version' => 1,
+                      'data' => {
+                        'command_rules' => [
+                          { 'rule_id' => '1', 'action' => 'report' },
+                          { 'rule_id' => '2', 'action' => 'block', 'command' => 'cat' }
+                        ]
+                      }
+                    }
+                  }
+                )
+
+                expect(TCellAgent).to receive(:send_event).with(
+                  {
+                    'event_type' => 'cmdi',
+                    'commands' => [
+                      { 'command' => 'cat', 'arg_count' => 1 },
+                      { 'command' => 'grep', 'arg_count' => 1 }
+                    ],
+                    'blocked' => true,
+                    'matches' => [
+                      { 'rule_id' => '2', 'command' => 'cat' },
+                      { 'rule_id' => '1', 'command' => 'grep' }
                     ]
                   }
-                })
-
-                expect(TCellAgent).to receive(:send_event).with({
-                  "event_type" => "cmdi",
-                  "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
-                  "blocked" => true,
-                  "matches" => [{"rule_id" => "2", "command" => "cat"}, {"rule_id" => "1", "command" => "grep"}]
-                })
+                )
 
                 expect(
-                  cmdi.block?("cat /etc/passwd | grep root", nil)
+                  @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
                 ).to eq(true)
               end
             end
           end
 
-          context "that block all" do
-            it "should send an event and block" do
-              cmdi = CommandInjectionPolicy.from_json({
-                "policy_id" => "policy_id",
-                "version" => 1,
-                "data" => {
-                  "command_rules" => [{"rule_id" => "1", "action" => "block"}]
+          context 'that block all' do
+            it 'should send an event and block' do
+              @rust_policies.update_policies(
+                {
+                  'cmdi' => {
+                    'policy_id' => 'policy_id',
+                    'version' => 1,
+                    'data' => {
+                      'command_rules' => [{ 'rule_id' => '1', 'action' => 'block' }]
+                    }
+                  }
                 }
-              })
-
-              expect(TCellAgent).to receive(:send_event).with({
-                "event_type" => "cmdi",
-                "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
-                "blocked" => true,
-                "matches" => [{"rule_id" => "1", "command" => "cat"}, {"rule_id" => "1", "command" => "grep"}]
-              })
+              )
+
+              expect(TCellAgent).to receive(:send_event).with(
+                {
+                  'event_type' => 'cmdi',
+                  'commands' => [
+                    { 'command' => 'cat', 'arg_count' => 1 },
+                    { 'command' => 'grep', 'arg_count' => 1 }
+                  ],
+                  'blocked' => true,
+                  'matches' => [
+                    { 'rule_id' => '1', 'command' => 'cat' },
+                    { 'rule_id' => '1', 'command' => 'grep' }
+                  ]
+                }
+              )
 
               expect(
-                cmdi.block?("cat /etc/passwd | grep root", nil)
+                @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
               ).to eq(true)
             end
 
-            context "and ignore cat" do
-              it "should send an event for grep not cat and block" do
-                cmdi = CommandInjectionPolicy.from_json({
-                  "policy_id" => "policy_id",
-                  "version" => 1,
-                  "data" => {
-                    "command_rules" => [
-                      {"rule_id" => "1", "action" => "block"},
-                      {"rule_id" => "2", "action" => "ignore", "command" => "cat"}
-                    ]
+            context 'and ignore cat' do
+              it 'should send an event for grep not cat and block' do
+                @rust_policies.update_policies(
+                  {
+                    'cmdi' => {
+                      'policy_id' => 'policy_id',
+                      'version' => 1,
+                      'data' => {
+                        'command_rules' => [
+                          { 'rule_id' => '1', 'action' => 'block' },
+                          { 'rule_id' => '2', 'action' => 'ignore', 'command' => 'cat' }
+                        ]
+                      }
+                    }
                   }
-                })
-
-                expect(TCellAgent).to receive(:send_event).with({
-                  "event_type" => "cmdi",
-                  "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
-                  "blocked" => true,
-                  "matches" => [{"rule_id" => "1", "command" => "grep"}]
-                })
+                )
+
+                expect(TCellAgent).to receive(:send_event).with(
+                  {
+                    'event_type' => 'cmdi',
+                    'commands' => [
+                      { 'command' => 'cat', 'arg_count' => 1 },
+                      { 'command' => 'grep', 'arg_count' => 1 }
+                    ],
+                    'blocked' => true,
+                    'matches' => [{ 'rule_id' => '1', 'command' => 'grep' }]
+                  }
+                )
 
                 expect(
-                  cmdi.block?("cat /etc/passwd | grep root", nil)
+                  @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
                 ).to eq(true)
               end
             end
 
-            context "and report cat" do
-              it "should send an event for grep and cat and block" do
-                cmdi = CommandInjectionPolicy.from_json({
-                  "policy_id" => "policy_id",
-                  "version" => 1,
-                  "data" => {
-                    "command_rules" => [
-                      {"rule_id" => "1", "action" => "block"},
-                      {"rule_id" => "2", "action" => "report", "command" => "cat"}
+            context 'and report cat' do
+              it 'should send an event for grep and cat and block' do
+                @rust_policies.update_policies(
+                  {
+                    'cmdi' => {
+                      'policy_id' => 'policy_id',
+                      'version' => 1,
+                      'data' => {
+                        'command_rules' => [
+                          { 'rule_id' => '1', 'action' => 'block' },
+                          { 'rule_id' => '2', 'action' => 'report', 'command' => 'cat' }
+                        ]
+                      }
+                    }
+                  }
+                )
+
+                expect(TCellAgent).to receive(:send_event).with(
+                  {
+                    'event_type' => 'cmdi',
+                    'commands' => [
+                      { 'command' => 'cat', 'arg_count' => 1 },
+                      { 'command' => 'grep', 'arg_count' => 1 }
+                    ],
+                    'blocked' => true,
+                    'matches' => [
+                      { 'rule_id' => '2', 'command' => 'cat' },
+                      { 'rule_id' => '1', 'command' => 'grep' }
                     ]
                   }
-                })
-
-                expect(TCellAgent).to receive(:send_event).with({
-                  "event_type" => "cmdi",
-                  "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
-                  "blocked" => true,
-                  "matches" => [{"rule_id" => "2", "command" => "cat"}, {"rule_id" => "1", "command" => "grep"}]
-                })
+                )
 
                 expect(
-                  cmdi.block?("cat /etc/passwd | grep root", nil)
+                  @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
                 ).to eq(true)
               end
             end
 
-            context "and block cat" do
-              it "should send an event for grep and cat and block" do
-                cmdi = CommandInjectionPolicy.from_json({
-                  "policy_id" => "policy_id",
-                  "version" => 1,
-                  "data" => {
-                    "command_rules" => [
-                      {"rule_id" => "1", "action" => "block"},
-                      {"rule_id" => "2", "action" => "block", "command" => "cat"}
+            context 'and block cat' do
+              it 'should send an event for grep and cat and block' do
+                @rust_policies.update_policies(
+                  {
+                    'cmdi' => {
+                      'policy_id' => 'policy_id',
+                      'version' => 1,
+                      'data' => {
+                        'command_rules' => [
+                          { 'rule_id' => '1', 'action' => 'block' },
+                          { 'rule_id' => '2', 'action' => 'block', 'command' => 'cat' }
+                        ]
+                      }
+                    }
+                  }
+                )
+
+                expect(TCellAgent).to receive(:send_event).with(
+                  {
+                    'event_type' => 'cmdi',
+                    'commands' => [
+                      { 'command' => 'cat', 'arg_count' => 1 },
+                      { 'command' => 'grep', 'arg_count' => 1 }
+                    ],
+                    'blocked' => true,
+                    'matches' => [
+                      { 'rule_id' => '2', 'command' => 'cat' },
+                      { 'rule_id' => '1', 'command' => 'grep' }
                     ]
                   }
-                })
-
-                expect(TCellAgent).to receive(:send_event).with({
-                  "event_type" => "cmdi",
-                  "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
-                  "blocked" => true,
-                  "matches" => [{"rule_id" => "2", "command" => "cat"}, {"rule_id" => "1", "command" => "grep"}]
-                })
+                )
 
                 expect(
-                  cmdi.block?("cat /etc/passwd | grep root", nil)
+                  @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
                 ).to eq(true)
               end
             end
           end
         end
 
-        context "with compound statement rules" do
+        context 'with compound statement rules' do
           before(:each) do
             @tcell_context = TCellAgent::Instrumentation::TCellData.new
-            @tcell_context.request_method = "GET"
-            @tcell_context.ip_address = "1.1.1.1"
-            @tcell_context.route_id = "12345"
-            @tcell_context.hmac_session_id = "sldfjk2343"
-            @tcell_context.user_id = "user_id"
+            @tcell_context.request_method = 'GET'
+            @tcell_context.ip_address = '1.1.1.1'
+            @tcell_context.route_id = '12345'
+            @tcell_context.hmac_session_id = 'sldfjk2343'
+            @tcell_context.user_id = 'user_id'
           end
 
-          context "set to ignore" do
+          context 'set to ignore' do
             before(:each) do
-              @cmdi = CommandInjectionPolicy.from_json({
-                "policy_id" => "policy_id",
-                "version" => 1,
-                "data" => {
-                  "compound_statement_rules" => [
-                    {"rule_id" => "1", "action" => "ignore"}
-                  ]
+              @rust_policies.update_policies(
+                {
+                  'cmdi' => {
+                    'policy_id' => 'policy_id',
+                    'version' => 1,
+                    'data' => {
+                      'compound_statement_rules' => [
+                        { 'rule_id' => '1', 'action' => 'ignore' }
+                      ]
+                    }
+                  }
                 }
-              })
+              )
             end
 
-            context "one parsed command" do
-              it "should not send events or block" do
+            context 'one parsed command' do
+              it 'should not send events or block' do
                 expect(TCellAgent).to_not receive(:send_event)
 
                 expect(
-                  @cmdi.block?("cat /etc/passwd", @tcell_context)
+                  @rust_policies.block_command?('cat /etc/passwd', @tcell_context)
                 ).to eq(false)
               end
             end
 
-            context "two parsed commands" do
-              it "should not send events or block" do
+            context 'two parsed commands' do
+              it 'should not send events or block' do
                 expect(TCellAgent).to_not receive(:send_event)
 
                 expect(
-                  @cmdi.block?("cat /etc/passwd | grep root", @tcell_context)
+                  @rust_policies.block_command?('cat /etc/passwd | grep root', @tcell_context)
                 ).to eq(false)
               end
             end
           end
 
-          context "set to report" do
+          context 'set to report' do
             before(:each) do
-              @cmdi = CommandInjectionPolicy.from_json({
-                "policy_id" => "policy_id",
-                "version" => 1,
-                "data" => {
-                  "compound_statement_rules" => [
-                    {"rule_id" => "1", "action" => "report"}
-                  ]
+              @rust_policies.update_policies(
+                {
+                  'cmdi' => {
+                    'policy_id' => 'policy_id',
+                    'version' => 1,
+                    'data' => {
+                      'compound_statement_rules' => [
+                        { 'rule_id' => '1', 'action' => 'report' }
+                      ]
+                    }
+                  }
                 }
-              })
+              )
             end
 
-            context "one parsed command" do
-              it "should not send events or block" do
+            context 'one parsed command' do
+              it 'should not send events or block' do
                 expect(TCellAgent).to_not receive(:send_event)
 
                 expect(
-                  @cmdi.block?("cat /etc/passwd", @tcell_context)
+                  @rust_policies.block_command?('cat /etc/passwd', @tcell_context)
                 ).to eq(false)
               end
             end
 
-            context "two parsed commands" do
-              it "should send an event but not block" do
-                expect(TCellAgent).to receive(:send_event).with({
-                  "event_type" => "cmdi",
-                  "commands" => [
-                    {"command" => "cat", "arg_count" => 1},
-                    {"command" => "grep", "arg_count" => 1}
-                  ],
-                  "blocked" => false,
-                  "matches" => [{"rule_id" => "1"}],
-                  "method" => "GET",
-                  "remote_address" => "1.1.1.1",
-                  "route_id" => "12345",
-                  "session_id" => "sldfjk2343",
-                  "user_id" => "user_id"
-                })
+            context 'two parsed commands' do
+              it 'should send an event but not block' do
+                expect(TCellAgent).to receive(:send_event).with(
+                  {
+                    'event_type' => 'cmdi',
+                    'commands' => [
+                      { 'command' => 'cat', 'arg_count' => 1 },
+                      { 'command' => 'grep', 'arg_count' => 1 }
+                    ],
+                    'blocked' => false,
+                    'matches' => [{ 'rule_id' => '1' }],
+                    'm' => 'GET',
+                    'remote_addr' => '1.1.1.1',
+                    'rid' => '12345',
+                    'sid' => 'sldfjk2343',
+                    'uid' => 'user_id'
+                  }
+                )
 
                 expect(
-                  @cmdi.block?("cat /etc/passwd | grep root", @tcell_context)
+                  @rust_policies.block_command?('cat /etc/passwd | grep root', @tcell_context)
                 ).to eq(false)
               end
             end
           end
 
-          context "set to block" do
+          context 'set to block' do
             before(:each) do
-              @cmdi = CommandInjectionPolicy.from_json({
-                "policy_id" => "policy_id",
-                "version" => 1,
-                "data" => {
-                  "compound_statement_rules" => [
-                    {"rule_id" => "1", "action" => "block"}
-                  ]
+              @rust_policies.update_policies(
+                {
+                  'cmdi' => {
+                    'policy_id' => 'policy_id',
+                    'version' => 1,
+                    'data' => {
+                      'compound_statement_rules' => [
+                        { 'rule_id' => '1', 'action' => 'block' }
+                      ]
+                    }
+                  }
                 }
-              })
+              )
             end
 
-            context "one parsed command" do
-              it "should not send events or block" do
+            context 'one parsed command' do
+              it 'should not send events or block' do
                 expect(TCellAgent).to_not receive(:send_event)
 
                 expect(
-                  @cmdi.block?("cat /etc/passwd", @tcell_context)
+                  @rust_policies.block_command?('cat /etc/passwd', @tcell_context)
                 ).to eq(false)
               end
             end
 
-            context "two parsed commands" do
-              it "should send an event and block" do
-                expect(TCellAgent).to receive(:send_event).with({
-                  "event_type" => "cmdi",
-                  "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
-                  "blocked" => true,
-                  "matches" => [{"rule_id" => "1"}],
-                  "method" => "GET",
-                  "remote_address" => "1.1.1.1",
-                  "route_id" => "12345",
-                  "session_id" => "sldfjk2343",
-                  "user_id" => "user_id"
-                })
+            context 'two parsed commands' do
+              it 'should send an event and block' do
+                expect(TCellAgent).to receive(:send_event).with(
+                  {
+                    'event_type' => 'cmdi',
+                    'commands' => [
+                      { 'command' => 'cat', 'arg_count' => 1 },
+                      { 'command' => 'grep', 'arg_count' => 1 }
+                    ],
+                    'blocked' => true,
+                    'matches' => [{ 'rule_id' => '1' }],
+                    'm' => 'GET',
+                    'remote_addr' => '1.1.1.1',
+                    'rid' => '12345',
+                    'sid' => 'sldfjk2343',
+                    'uid' => 'user_id'
+                  }
+                )
 
                 expect(
-                  @cmdi.block?("cat /etc/passwd | grep root", @tcell_context)
+                  @rust_policies.block_command?('cat /etc/passwd | grep root', @tcell_context)
                 ).to eq(true)
               end
             end
           end
 
-          context "that conflict" do
-            it "only take the first one and ignore the rest" do
+          context 'that conflict' do
+            it 'only take the first one and ignore the rest' do
               ## multiple compound statements present only first one is taken
-              cmdi = CommandInjectionPolicy.from_json({
-                "policy_id" => "policy_id",
-                "version" => 1,
-                "data" => {
-                  "compound_statement_rules" => [
-                    {"rule_id" => "1", "action" => "block"},
-                    {"rule_id" => "2", "action" => "ignore"}
-                  ]
+              @rust_policies.update_policies(
+                {
+                  'cmdi' => {
+                    'policy_id' => 'policy_id',
+                    'version' => 1,
+                    'data' => {
+                      'compound_statement_rules' => [
+                        { 'rule_id' => '1', 'action' => 'block' },
+                        { 'rule_id' => '2', 'action' => 'ignore' }
+                      ]
+                    }
+                  }
+                }
+              )
+
+              expect(TCellAgent).to receive(:send_event).with(
+                {
+                  'event_type' => 'cmdi',
+                  'commands' => [
+                    { 'command' => 'cat', 'arg_count' => 1 },
+                    { 'command' => 'grep', 'arg_count' => 1 }
+                  ],
+                  'blocked' => true,
+                  'matches' => [{ 'rule_id' => '1' }],
+                  'm' => 'GET',
+                  'remote_addr' => '1.1.1.1',
+                  'rid' => '12345',
+                  'sid' => 'sldfjk2343',
+                  'uid' => 'user_id'
                 }
-              })
-
-              expect(TCellAgent).to receive(:send_event).with({
-                "event_type" => "cmdi",
-                "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
-                "blocked" => true,
-                "matches" => [{"rule_id" => "1"}],
-                "method" => "GET",
-                "remote_address" => "1.1.1.1",
-                "route_id" => "12345",
-                "session_id" => "sldfjk2343",
-                "user_id" => "user_id"
-              })
+              )
 
               expect(
-                cmdi.block?("cat /etc/passwd | grep root", @tcell_context)
+                @rust_policies.block_command?('cat /etc/passwd | grep root', @tcell_context)
               ).to eq(true)
             end
-
           end
         end
       end
-
     end
   end
 end