tcell_agent 0.4.0 → 1.0.0

data/spec/lib/tcell_agent/policies/patches_policy_spec.rb

@@ -2,627 +2,299 @@ require 'spec_helper'
 
 module TCellAgent
   module Policies
+    describe RustPolicies do
+      before(:each) do
+        @rust_policies = RustPolicies.new
+      end
 
-    describe PatchesPolicy do
+      describe '#update_policies' do
+        context 'with a nil policy' do
+          it 'should return nil' do
+            expect(TCellAgent).to_not receive(:logger)
 
-      describe "#from_json" do
+            @rust_policies.update_policies(nil)
 
-        context "with a nil policy" do
-          it "should return nil" do
-            expect(PatchesPolicy.from_json(nil)).to be_nil
+            expect(@rust_policies.patches_enabled).to eq(false)
           end
         end
 
-        context "with an empty policy" do
-          it "should raise a policy missing error" do
-            expect {
-              PatchesPolicy.from_json({})
-            }.to raise_error(RuntimeError)
-          end
-        end
+        context 'with an empty policy' do
+          it 'should raise a policy missing error' do
+            expect(TCellAgent).to_not receive(:logger)
 
-        context "with an empty version" do
-          it "should have empty version" do
-            patches = PatchesPolicy.from_json({ "policy_id" => "policy_id" })
-            expect(patches.policy_id).to eq("policy_id")
-            expect(patches.version).to be_nil
-            expect(patches.enabled).to eq(false)
-            expect(patches.block_rules).to eq([])
-          end
-        end
+            @rust_policies.update_policies({})
 
-        context "with an empty data" do
-          it "should have disabled ip blocking" do
-            patches = PatchesPolicy.from_json({
-              "policy_id" => "policy_id",
-              "version" => 1
-            })
-            expect(patches.policy_id).to eq("policy_id")
-            expect(patches.version).to eq(1)
-            expect(patches.enabled).to eq(false)
-            expect(patches.block_rules).to eq([])
+            expect(@rust_policies.patches_enabled).to eq(false)
           end
         end
 
-        context "with an empty block_rules" do
-          it "should have disabled ip blocking" do
-            patches = PatchesPolicy.from_json({
-              "policy_id" => "policy_id",
-              "version" => 1,
-              "data" => {}
-            })
-            expect(patches.policy_id).to eq("policy_id")
-            expect(patches.version).to eq(1)
-            expect(patches.enabled).to eq(false)
-            expect(patches.block_rules).to eq([])
-          end
-        end
-
-        context "with blocked_ips" do
-          context "as an empty list" do
-            it "should have ip blocking disabled" do
-              patches = PatchesPolicy.from_json({
-                "policy_id" => "policy_id",
-                "version" => 1,
-                "data" => {
-                  "blocked_ips" => []
+        context 'with an empty version' do
+          it 'should have empty version' do
+            logger = double('logger')
+
+            expect(TCellAgent).to receive(:logger).and_return(logger)
+            expect(logger).to receive(:error).with(
+              'Error updating policies: Failed to decode patches policy: missing field `version`'
+            )
+            @rust_policies.update_policies(
+              {
+                'patches' => {
+                  'policy_id' => 'policy_id'
                 }
-              })
-              expect(patches.policy_id).to eq("policy_id")
-              expect(patches.version).to eq(1)
-              expect(patches.enabled).to eq(false)
-              expect(patches.block_rules).to eq([])
-            end
-          end
+              }
+            )
 
-          context "a non empty list" do
-            it "should have ip blocking enabled" do
-              patches = PatchesPolicy.from_json({
-                "policy_id" => "policy_id",
-                "version" => 1,
-                "data" => {
-                  "blocked_ips" => [
-                    {"ip" => "0.0.0.0"},
-                    {"ip" => "1.1.1.1"}
-                  ]
-                }
-              })
-
-              expect(patches.policy_id).to eq("policy_id")
-              expect(patches.version).to eq(1)
-              expect(patches.enabled).to eq(true)
-              expect(patches.block_rules.size).to eq(1)
-              expect(patches.block_rules[0].ips).to eq(Set.new(["0.0.0.0", "1.1.1.1"]))
-              expect(patches.block_rules[0].rids).to eq(Set.new)
-              expect(patches.block_rules[0].action).to eq("block_403s")
-            end
+            expect(@rust_policies.patches_enabled).to eq(false)
           end
         end
 
-        context "with block_rules" do
-          context "as an empty list" do
-            it "should have ip blocking disabled" do
-              patches = PatchesPolicy.from_json({
-                "policy_id" => "policy_id",
-                "version" => 1,
-                "data" => {
-                  "block_rules" => []
-                }
-              })
-              expect(patches.policy_id).to eq("policy_id")
-              expect(patches.version).to eq(1)
-              expect(patches.enabled).to eq(false)
-              expect(patches.block_rules).to eq([])
-            end
-          end
+        context 'with an empty data' do
+          it 'should have disabled ip blocking' do
+            expect(TCellAgent).to_not receive(:logger)
 
-          context "a non empty list" do
-            it "should have ip blocking enabled" do
-              block_rule_one = double("block_rule_one")
-              block_rule_dos = double("block_rule_dos")
-
-              expect(TCellAgent::Patches::BlockRule).to receive(:from_json).with(
-                {"assume_this_is_well_formed" => "well_formed"}
-              ).and_return(block_rule_one)
-
-              expect(TCellAgent::Patches::BlockRule).to receive(:from_json).with(
-                {"assume_this_is_well_formed_dos" => "well_formed_dos"}
-              ).and_return(block_rule_dos)
-
-              patches = PatchesPolicy.from_json({
-                "policy_id" => "policy_id",
-                "version" => 1,
-                "data" => {
-                  "block_rules" => [
-                    {"assume_this_is_well_formed" => "well_formed"},
-                    {"assume_this_is_well_formed_dos" => "well_formed_dos"}
-                  ]
+            @rust_policies.update_policies(
+              {
+                'patches' => {
+                  'policy_id' => 'policy_id',
+                  'version' => 1
                 }
-              })
-
-              expect(patches.policy_id).to eq("policy_id")
-              expect(patches.version).to eq(1)
-              expect(patches.enabled).to eq(true)
-              expect(patches.block_rules).to eq([block_rule_one, block_rule_dos])
-            end
+              }
+            )
 
-            context "with a malformed block rule" do
-              it "should ignore the block rule" do
-                expect(TCellAgent::Patches::BlockRule).to receive(:from_json).with(
-                  {"assume_this_is_ill_formed" => "ill_formed"}
-                ).and_return(nil)
-
-                patches = PatchesPolicy.from_json({
-                  "policy_id" => "policy_id",
-                  "version" => 1,
-                  "data" => {
-                    "block_rules" => [
-                      {"assume_this_is_ill_formed" => "ill_formed"}
-                    ]
-                  }
-                })
-
-                expect(patches.policy_id).to eq("policy_id")
-                expect(patches.version).to eq(1)
-                expect(patches.enabled).to eq(false)
-                expect(patches.block_rules).to eq([])
-              end
-            end
-
-            context "with a malformed block rule and a well formed block rule" do
-              it "should ignore the block rule" do
-                block_rule = double("block_rule")
-
-                expect(TCellAgent::Patches::BlockRule).to receive(:from_json).with(
-                  {"assume_this_is_ill_formed" => "ill_formed"}
-                ).and_return(nil)
-
-                expect(TCellAgent::Patches::BlockRule).to receive(:from_json).with(
-                  {"assume_this_is_well_formed" => "well_formed"}
-                ).and_return(block_rule)
-
-                patches = PatchesPolicy.from_json({
-                  "policy_id" => "policy_id",
-                  "version" => 1,
-                  "data" => {
-                    "block_rules" => [
-                      {"assume_this_is_ill_formed" => "ill_formed"},
-                      {"assume_this_is_well_formed" => "well_formed"}
-                    ]
-                  }
-                })
+            expect(@rust_policies.patches_enabled).to eq(false)
+          end
+        end
 
+        context 'with an empty block_rules' do
+          it 'should have disabled ip blocking' do
+            expect(TCellAgent).to_not receive(:logger)
 
-                expect(patches.policy_id).to eq("policy_id")
-                expect(patches.version).to eq(1)
-                expect(patches.enabled).to eq(true)
-                expect(patches.block_rules).to eq([block_rule])
-              end
-            end
-
-            context "with a wrong version number" do
-              it "should have ip blocking disabled" do
-                logger = double("logger")
-                expect(TCellAgent).to receive(:logger).and_return(logger)
-                expect(logger).to receive(:error).with("Patches Policy not supported: 2")
-
-                expect(TCellAgent::Patches::BlockRule).to_not receive(:from_json)
-
-                patches = PatchesPolicy.from_json({
-                  "policy_id" => "policy_id",
-                  "version" => 2,
-                  "data" => {
-                    "block_rules" => [
-                      {"assume_this_is_well_formed" => "well_formed"}
-                    ]
-                  }
-                })
+            @rust_policies.update_policies(
+              {
+                'patches' => {
+                  'policy_id' => 'policy_id',
+                  'version' => 1,
+                  'data' => {}
+                }
+              }
+            )
 
-                expect(patches.policy_id).to eq("policy_id")
-                expect(patches.version).to eq(2)
-                expect(patches.enabled).to eq(false)
-                expect(patches.block_rules).to eq([])
-              end
-            end
+            expect(@rust_policies.patches_enabled).to eq(true)
           end
         end
 
-        context "with wiki examples" do
-          context "with example one" do
-            it "should be enabled" do
-              patches = TCellAgent::Policies::PatchesPolicy.from_json({
-                "version" => 1,
-                "policy_id" => "some uuid",
-                "data" => {
-                  "block_rules" => [
-                    {
-                      "ips" => ["1.3.3.4"]
+        context 'with blocked_ips' do
+          context 'as an empty list' do
+            it 'should have ip blocking disabled' do
+              expect(TCellAgent).to_not receive(:logger)
+
+              @rust_policies.update_policies(
+                {
+                  'patches' => {
+                    'policy_id' => 'policy_id',
+                    'version' => 1,
+                    'data' => {
+                      'blocked_ips' => []
                     }
-                  ]
+                  }
                 }
-              })
-
-              expect(patches.enabled).to eq(true)
-              expect(patches.block_rules.size).to eq(1)
-              expect(patches.block_rules[0].ips).to eq(Set.new(["1.3.3.4"]))
-              expect(patches.block_rules[0].rids).to eq(Set.new)
-
-              injections_matcher = patches.block_rules[0].sensors_matcher.injections_matcher
-              expect(injections_matcher.enabled).to eq(false)
-              expect(injections_matcher.sensors.size).to eq(0)
-
-              meta_data = TCellAgent::Patches::MetaData.new(
-                "get",
-                "1.3.3.4",
-                "route_id",
-                "session_id",
-                "user_id",
-                "transaction_id")
-              expect(patches.apply(meta_data)).to eq(403)
+              )
+
+              expect(@rust_policies.patches_enabled).to eq(true)
             end
           end
 
-          context "with example two" do
-            it "should be enabled" do
-              patches = TCellAgent::Policies::PatchesPolicy.from_json({
-                "version" => 1,
-                "policy_id" => "some uuid",
-                "data" => {
-                  "block_rules" => [
-                    {
-                      "rids" => ["123213","-3328888"]
+          context 'a non empty list' do
+            it 'should have ip blocking enabled' do
+              expect(TCellAgent).to_not receive(:logger)
+
+              @rust_policies.update_policies(
+                {
+                  'patches' => {
+                    'policy_id' => 'policy_id',
+                    'version' => 1,
+                    'data' => {
+                      'blocked_ips' => [
+                        { 'ip' => '0.0.0.0' },
+                        { 'ip' => '1.1.1.1' }
+                      ]
                     }
-                  ]
+                  }
                 }
-              })
-
-              expect(patches.enabled).to eq(true)
-              expect(patches.block_rules.size).to eq(1)
-              expect(patches.block_rules[0].ips).to eq(Set.new)
-              expect(patches.block_rules[0].rids).to eq(Set.new(["123213", "-3328888"]))
-
-              injections_matcher = patches.block_rules[0].sensors_matcher.injections_matcher
-              expect(injections_matcher.enabled).to eq(false)
-              expect(injections_matcher.sensors.size).to eq(0)
-
-              meta_data = TCellAgent::Patches::MetaData.new(
-                "get",
-                "1.3.3.4",
-                "route_id",
-                "session_id",
-                "user_id",
-                "transaction_id")
-              meta_data.remote_address = "1.3.3.4"
-              expect(patches.apply(meta_data)).to eq(false)
-
-              meta_data.remote_address = "1.3.3.4"
-              meta_data.route_id = "123213"
-              expect(patches.apply(meta_data)).to eq(403)
-
-              meta_data.remote_address = "1.3.3.4"
-              meta_data.route_id = "-3328888"
-              expect(patches.apply(meta_data)).to eq(403)
+              )
+
+              expect(@rust_policies.patches_enabled).to eq(true)
             end
           end
+        end
 
-          context "with example three" do
-            it "should be enabled" do
-              patches = TCellAgent::Policies::PatchesPolicy.from_json({
-                "version" => 1,
-                "policy_id" => "some uuid",
-                "data" => {
-                  "block_rules" => [
-                    {
-                      "ips" => ["1.3.3.4"],
-                      "sensor_matches" => {
-                        "xss" => {
-                          "libinjection" => false,
-                          "patterns" => ["1","2","8"],
-                          "exclusions" => {
-                            "bob" => ["*"]
-                          }
-                        }
-                      }
+        context 'with block_rules' do
+          context 'as an empty list' do
+            it 'should have ip blocking disabled' do
+              expect(TCellAgent).to_not receive(:logger)
+
+              @rust_policies.update_policies(
+                {
+                  'patches' => {
+                    'policy_id' => 'policy_id',
+                    'version' => 1,
+                    'data' => {
+                      'block_rules' => []
                     }
-                  ]
+                  }
                 }
-              })
-
-              expect(patches.enabled).to eq(true)
-              expect(patches.block_rules.size).to eq(1)
-              expect(patches.block_rules[0].ips).to eq(Set.new(["1.3.3.4"]))
-              expect(patches.block_rules[0].rids).to eq(Set.new)
-
-              injections_matcher = patches.block_rules[0].sensors_matcher.injections_matcher
-              expect(injections_matcher.enabled).to eq(true)
-              expect(injections_matcher.sensors.size).to eq(1)
-              expect(injections_matcher.sensors[0].enabled).to eq(true)
-
-              meta_data = TCellAgent::Patches::MetaData.new(
-                "get",
-                "1.3.3.4",
-                "route_id",
-                "session_id",
-                "user_id",
-                "transaction_id")
-              expect(patches.apply(meta_data)).to eq(false)
-
-              meta_data.remote_address = "1.3.3.4"
-              meta_data.get_dict = {"xss_param" => "<script>"}
-              expect(patches.apply(meta_data)).to eq(403)
-
-              meta_data.remote_address = "1.3.3.4"
-              meta_data.get_dict = {"sqli_param" => "Erwin' OR '1'='1"}
-              expect(patches.apply(meta_data)).to eq(false)
+              )
+
+              expect(@rust_policies.patches_enabled).to eq(true)
             end
           end
 
-          context "with example four" do
-            it "should be enabled" do
-              patches = TCellAgent::Policies::PatchesPolicy.from_json({
-                "version" => 1,
-                "policy_id" => "some uuid",
-                "data" => {
-                  "block_rules" => [
-                    {
-                      "ips" => ["1.3.3.4"],
-                      "rids" => ["123213","-3328888"]
+          context 'a non empty list' do
+            it 'should have ip blocking enabled' do
+              expect(TCellAgent).to_not receive(:logger)
+
+              @rust_policies.update_policies(
+                {
+                  'patches' => {
+                    'policy_id' => 'policy_id',
+                    'version' => 1,
+                    'data' => {
+                      'block_rules' => [
+                        { 'assume_this_is_well_formed' => 'well_formed' },
+                        { 'assume_this_is_well_formed_dos' => 'well_formed_dos' }
+                      ]
                     }
-                  ]
+                  }
                 }
-              })
-
-              expect(patches.enabled).to eq(true)
-              expect(patches.block_rules.size).to eq(1)
-              expect(patches.block_rules[0].ips).to eq(Set.new(["1.3.3.4"]))
-              expect(patches.block_rules[0].rids).to eq(Set.new(["123213", "-3328888"]))
-
-              injections_matcher = patches.block_rules[0].sensors_matcher.injections_matcher
-              expect(injections_matcher.enabled).to eq(false)
-              expect(injections_matcher.sensors.size).to eq(0)
-
-              meta_data = TCellAgent::Patches::MetaData.new(
-                "get",
-                "1.3.3.4",
-                "111111",
-                "session_id",
-                "user_id",
-                "transaction_id")
-              expect(patches.apply(meta_data)).to eq(false)
-
-              meta_data.remote_address = "1.1.1.1"
-              meta_data.route_id = "123213"
-              expect(patches.apply(meta_data)).to eq(false)
-
-              meta_data.remote_address = "1.3.3.4"
-              meta_data.route_id = "123213"
-              expect(patches.apply(meta_data)).to eq(403)
-
-              meta_data.remote_address = "1.3.3.4"
-              meta_data.route_id = "-3328888"
-              expect(patches.apply(meta_data)).to eq(403)
+              )
+
+              expect(@rust_policies.patches_enabled).to eq(true)
             end
-          end
 
-          context "with example five" do
-            it "should be enabled" do
-              patches = TCellAgent::Policies::PatchesPolicy.from_json({
-                "version" => 1,
-                "policy_id" => "some uuid",
-                "data" => {
-                  "block_rules" => [
-                    {
-                      "ips" => ["1.3.3.4"],
-                      "sensor_matches" => {
-                        "xss" => {},
-                        "sqli" => {}
+            context 'with a malformed block rule' do
+              it 'should ignore the block rule' do
+                expect(TCellAgent).to_not receive(:logger)
+
+                @rust_policies.update_policies(
+                  {
+                    'patches' => {
+                      'policy_id' => 'policy_id',
+                      'version' => 1,
+                      'data' => {
+                        'block_rules' => [
+                          { 'assume_this_is_ill_formed' => 'ill_formed' }
+                        ]
                       }
                     }
-                  ]
-                }
-              })
-
-              expect(patches.enabled).to eq(true)
-              expect(patches.block_rules.size).to eq(1)
-              expect(patches.block_rules[0].ips).to eq(Set.new(["1.3.3.4"]))
-              expect(patches.block_rules[0].rids).to eq(Set.new)
-
-              injections_matcher = patches.block_rules[0].sensors_matcher.injections_matcher
-              expect(injections_matcher.enabled).to eq(true)
-              expect(injections_matcher.sensors.size).to eq(2)
-              expect(injections_matcher.sensors[0].enabled).to eq(true)
-              expect(injections_matcher.sensors[1].enabled).to eq(true)
-
-              meta_data = TCellAgent::Patches::MetaData.new(
-                "get",
-                "1.3.3.4",
-                "route_id",
-                "session_id",
-                "user_id",
-                "transaction_id")
-              expect(patches.apply(meta_data)).to eq(false)
-
-              meta_data.remote_address = "1.3.3.4"
-              meta_data.get_dict = {"xss_param" => "<script>"}
-              expect(patches.apply(meta_data)).to eq(false)
-
-              meta_data.remote_address = "1.3.3.4"
-              meta_data.get_dict = {"sqli_param" => "Erwin' OR '1'='1"}
-              expect(patches.apply(meta_data)).to eq(false)
+                  }
+                )
+
+                expect(@rust_policies.patches_enabled).to eq(true)
+              end
             end
-          end
 
-          context "with example six" do
-            it "should be disabled" do
-              patches = TCellAgent::Policies::PatchesPolicy.from_json({
-                "version" => 1,
-                "policy_id" => "some uuid",
-                "data" => {
-                  "block_rules" => [
-                    {
-                      "sensor_matches" => {
-                        "xss" => {},
-                        "sqli" => {}
+            context 'with a malformed block rule and a well formed block rule' do
+              it 'should ignore the block rule' do
+                expect(TCellAgent).to_not receive(:logger)
+
+                @rust_policies.update_policies(
+                  {
+                    'patches' => {
+                      'policy_id' => 'policy_id',
+                      'version' => 1,
+                      'data' => {
+                        'block_rules' => [
+                          { 'assume_this_is_ill_formed' => 'ill_formed' },
+                          { 'assume_this_is_well_formed' => 'well_formed' }
+                        ]
                       }
                     }
-                  ]
-                }
-              })
+                  }
+                )
 
-              expect(patches.enabled).to eq(false)
-              expect(patches.block_rules.size).to eq(0)
+                expect(@rust_policies.patches_enabled).to eq(true)
+              end
             end
-          end
 
-          context "with example seven" do
-            it "should be enabled" do
-              patches = TCellAgent::Policies::PatchesPolicy.from_json({
-                "version" => 1,
-                "policy_id" => "some uuid",
-                "data" => {
-                  "blocked_ips" => [{"ip" => "1.1.1.1"}, {"ip" => "2.2.2.2"}],
-                  "block_rules" => [
-                    {
-                      "ips" => ["3.3.3.3"]
+            context 'with a wrong version number' do
+              xit 'should have ip blocking disabled' do
+                expect(TCellAgent).to_not receive(:logger)
+
+                @rust_policies.update_policies(
+                  {
+                    'patches' => {
+                      'policy_id' => 'policy_id',
+                      'version' => 2,
+                      'data' => {
+                        'block_rules' => [
+                          { 'assume_this_is_well_formed' => 'well_formed' }
+                        ]
+                      }
                     }
-                  ]
-                }
-              })
-
-              expect(patches.enabled).to eq(true)
-              expect(patches.block_rules.size).to eq(2)
-              expect(patches.block_rules[0].ips).to eq(Set.new(["1.1.1.1", "2.2.2.2"]))
-              expect(patches.block_rules[0].rids).to eq(Set.new)
-              expect(patches.block_rules[1].ips).to eq(Set.new(["3.3.3.3"]))
-              expect(patches.block_rules[1].rids).to eq(Set.new)
-
-              injections_matcher = patches.block_rules[0].sensors_matcher.injections_matcher
-              expect(injections_matcher.enabled).to eq(false)
-              expect(injections_matcher.sensors.size).to eq(0)
-
-              injections_matcher = patches.block_rules[1].sensors_matcher.injections_matcher
-              expect(injections_matcher.enabled).to eq(false)
-              expect(injections_matcher.sensors.size).to eq(0)
-
-              meta_data = TCellAgent::Patches::MetaData.new(
-                "get",
-                "1.1.1.1",
-                "route_id",
-                "session_id",
-                "user_id",
-                "transaction_id")
-              expect(patches.apply(meta_data)).to eq(403)
-
-              meta_data.remote_address = "2.2.2.2"
-              expect(patches.apply(meta_data)).to eq(403)
-
-              meta_data.remote_address = "3.3.3.3"
-              expect(patches.apply(meta_data)).to eq(403)
-            end
-          end
+                  }
+                )
 
-          context "with example eight" do
-            it "should be enabled" do
-              patches = TCellAgent::Policies::PatchesPolicy.from_json({
-                "version" => 1,
-                "policy_id" => "some uuid",
-                "data" => {
-                  "block_rules" => [
-                    {
-                      "ips" => ["1.3.3.4"]
-                    },
-                    {
-                      "rids" => ["123213","-3328888"]
-                    }
-                  ]
-                }
-              })
-
-              expect(patches.enabled).to eq(true)
-              expect(patches.block_rules.size).to eq(2)
-              expect(patches.block_rules[0].ips).to eq(Set.new(["1.3.3.4"]))
-              expect(patches.block_rules[0].rids).to eq(Set.new)
-              expect(patches.block_rules[1].ips).to eq(Set.new())
-              expect(patches.block_rules[1].rids).to eq(Set.new(["123213", "-3328888"]))
-
-              injections_matcher = patches.block_rules[0].sensors_matcher.injections_matcher
-              expect(injections_matcher.enabled).to eq(false)
-              expect(injections_matcher.sensors.size).to eq(0)
-
-              injections_matcher = patches.block_rules[1].sensors_matcher.injections_matcher
-              expect(injections_matcher.enabled).to eq(false)
-              expect(injections_matcher.sensors.size).to eq(0)
-
-              meta_data = TCellAgent::Patches::MetaData.new(
-                "get",
-                "1.3.3.4",
-                "11111",
-                "session_id",
-                "user_id",
-                "transaction_id")
-              expect(patches.apply(meta_data)).to eq(403)
-
-              meta_data.remote_address = "1.1.1.1"
-              meta_data.route_id = "123213"
-              expect(patches.apply(meta_data)).to eq(403)
-
-              meta_data.remote_address = "1.1.1.1"
-              meta_data.route_id = "-3328888"
-              expect(patches.apply(meta_data)).to eq(403)
-
-              meta_data.remote_address = "1.3.3.4"
-              meta_data.route_id = "-3328888"
-              expect(patches.apply(meta_data)).to eq(403)
+                expect(@rust_policies.patches_enabled).to eq(false)
+              end
             end
           end
+        end
+      end
 
-          context "with example nine" do
-            it "should be enabled" do
-              patches = TCellAgent::Policies::PatchesPolicy.from_json({
-                "version" => 1,
-                "policy_id" => "some uuid",
-                "data" => {
-                  "blocked_ips" => [{"ip" => "1.1.1.1"}, {"ip" => "2.2.2.2"}],
-                  "block_rules" => [
-                    {
-                      "ips" => ["1.1.1.1", "2.2.2.2"]
-                    }
-                  ]
+      describe '#block_request?' do
+        context 'supports ip blocking' do
+          it 'should block blacklisted ip' do
+            @rust_policies.update_policies(
+              {
+                'patches' => {
+                  'version' => 1,
+                  'policy_id' => 'some uuid',
+                  'data' => {
+                    'rules' => [{
+                      'id' => 'blocked-ips-rule',
+                      'title' => 'Blocked ips rule',
+                      'action' => 'BlockIf',
+                      'destinations' => { 'check_equals' => [{ 'path' => '*' }] },
+                      'ignore' => [],
+                      'matches' => [{
+                        'all' => [],
+                        'any' => [{
+                          'ips' => [{
+                            'type' => 'IP',
+                            'values' => ['1.3.3.4']
+                          }]
+                        }]
+                      }]
+                    }]
+                  }
                 }
-              })
-
-              expect(patches.enabled).to eq(true)
-              expect(patches.block_rules.size).to eq(2)
-              expect(patches.block_rules[0].ips).to eq(Set.new(["1.1.1.1", "2.2.2.2"]))
-              expect(patches.block_rules[0].rids).to eq(Set.new)
-              expect(patches.block_rules[1].ips).to eq(Set.new(["1.1.1.1", "2.2.2.2"]))
-              expect(patches.block_rules[1].rids).to eq(Set.new)
-
-              injections_matcher = patches.block_rules[0].sensors_matcher.injections_matcher
-              expect(injections_matcher.enabled).to eq(false)
-              expect(injections_matcher.sensors.size).to eq(0)
-
-              injections_matcher = patches.block_rules[1].sensors_matcher.injections_matcher
-              expect(injections_matcher.enabled).to eq(false)
-              expect(injections_matcher.sensors.size).to eq(0)
-
-              meta_data = TCellAgent::Patches::MetaData.new(
-                "get",
-                "1.1.1.1",
-                "route_id",
-                "session_id",
-                "user_id",
-                "transaction_id")
-              expect(patches.apply(meta_data)).to eq(403)
-
-              meta_data.remote_address = "2.2.2.2"
-              expect(patches.apply(meta_data)).to eq(403)
-            end
+              }
+            )
+
+            meta_data = TCellAgent::Patches::MetaData.new(
+              'get',
+              '1.3.3.4',
+              'route_id',
+              'session_id',
+              'user_id',
+              'transaction_id',
+              'http://test.com/?some_param=present'
+            )
+            expect(@rust_policies.block_request?(meta_data)).to eq(true)
+
+            meta_data = TCellAgent::Patches::MetaData.new(
+              'get',
+              '1.1.1.1',
+              'route_id',
+              'session_id',
+              'user_id',
+              'transaction_id',
+              'http://test.com/?some_param=present'
+            )
+            expect(@rust_policies.block_request?(meta_data)).to eq(false)
           end
         end
       end
-
     end
-
   end
 end