tcell_agent 1.1.12 → 2.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (163) hide show
  1. checksums.yaml +5 -5
  2. data/bin/tcell_agent +26 -14
  3. data/lib/tcell_agent.rb +16 -10
  4. data/lib/tcell_agent/agent.rb +78 -97
  5. data/lib/tcell_agent/agent/route_manager.rb +0 -16
  6. data/lib/tcell_agent/agent/static_agent.rb +9 -30
  7. data/lib/tcell_agent/authlogic.rb +3 -6
  8. data/lib/tcell_agent/config/unknown_options.rb +4 -8
  9. data/lib/tcell_agent/configuration.rb +38 -119
  10. data/lib/tcell_agent/devise.rb +25 -27
  11. data/lib/tcell_agent/hooks/login_fraud.rb +30 -33
  12. data/lib/tcell_agent/instrument_servers.rb +25 -0
  13. data/lib/tcell_agent/instrumentation.rb +12 -10
  14. data/lib/tcell_agent/instrumentation/cmdi.rb +19 -15
  15. data/lib/tcell_agent/instrumentation/lfi.rb +73 -0
  16. data/lib/tcell_agent/instrumentation/monkey_patches/file.rb +25 -0
  17. data/lib/tcell_agent/instrumentation/monkey_patches/io.rb +123 -0
  18. data/lib/tcell_agent/instrumentation/monkey_patches/kernel.rb +159 -0
  19. data/lib/tcell_agent/logger.rb +50 -114
  20. data/lib/tcell_agent/patches.rb +6 -7
  21. data/lib/tcell_agent/policies/appfirewall_policy.rb +26 -0
  22. data/lib/tcell_agent/policies/command_injection_policy.rb +28 -0
  23. data/lib/tcell_agent/policies/dataloss_policy.rb +44 -44
  24. data/lib/tcell_agent/policies/headers_policy.rb +25 -0
  25. data/lib/tcell_agent/policies/http_redirect_policy.rb +13 -79
  26. data/lib/tcell_agent/policies/js_agent_policy.rb +27 -0
  27. data/lib/tcell_agent/policies/local_file_access.rb +28 -0
  28. data/lib/tcell_agent/policies/login_policy.rb +43 -0
  29. data/lib/tcell_agent/policies/patches_policy.rb +27 -0
  30. data/lib/tcell_agent/policies/policies_manager.rb +68 -0
  31. data/lib/tcell_agent/policies/policy_polling.rb +58 -0
  32. data/lib/tcell_agent/policies/policy_types.rb +14 -0
  33. data/lib/tcell_agent/policies/system_enablements.rb +27 -0
  34. data/lib/tcell_agent/rails/auth/authlogic.rb +43 -68
  35. data/lib/tcell_agent/rails/auth/devise.rb +20 -23
  36. data/lib/tcell_agent/rails/auth/doorkeeper.rb +63 -74
  37. data/lib/tcell_agent/rails/csrf_exception.rb +2 -2
  38. data/lib/tcell_agent/rails/dlp.rb +25 -15
  39. data/lib/tcell_agent/rails/dlp_handler.rb +1 -2
  40. data/lib/tcell_agent/rails/js_agent_insert.rb +12 -13
  41. data/lib/tcell_agent/rails/middleware/body_filter_middleware.rb +4 -25
  42. data/lib/tcell_agent/rails/middleware/context_middleware.rb +2 -12
  43. data/lib/tcell_agent/rails/middleware/global_middleware.rb +0 -1
  44. data/lib/tcell_agent/rails/middleware/headers_middleware.rb +14 -34
  45. data/lib/tcell_agent/rails/on_start.rb +32 -31
  46. data/lib/tcell_agent/rails/routes.rb +7 -6
  47. data/lib/tcell_agent/rails/routes/grape.rb +1 -3
  48. data/lib/tcell_agent/rails/routes/route_id.rb +3 -1
  49. data/lib/tcell_agent/rails/settings_reporter.rb +23 -36
  50. data/lib/tcell_agent/rails/start_agent_after_initializers.rb +12 -0
  51. data/lib/tcell_agent/rails/tcell_body_proxy.rb +6 -4
  52. data/lib/tcell_agent/rust/agent_config.rb +49 -0
  53. data/lib/tcell_agent/rust/{libtcellagent-alpine-1.3.2.so → libtcellagent-4.14.0.dylib} +0 -0
  54. data/lib/tcell_agent/rust/libtcellagent-4.14.0.so +0 -0
  55. data/lib/tcell_agent/rust/{libtcellagent-1.3.2.so → libtcellagent-alpine-4.14.0.so} +0 -0
  56. data/lib/tcell_agent/rust/models.rb +0 -55
  57. data/lib/tcell_agent/rust/native_agent.rb +531 -0
  58. data/lib/tcell_agent/rust/native_agent_response.rb +42 -0
  59. data/lib/tcell_agent/rust/native_library.rb +68 -0
  60. data/lib/tcell_agent/rust/tcellagent-4.14.0.dll +0 -0
  61. data/lib/tcell_agent/sensor_events/agent_setting_event.rb +12 -0
  62. data/lib/tcell_agent/sensor_events/{app_config.rb → app_config_setting_event.rb} +0 -6
  63. data/lib/tcell_agent/sensor_events/dlp.rb +2 -6
  64. data/lib/tcell_agent/sensor_events/sensor.rb +0 -62
  65. data/lib/tcell_agent/sensor_events/server_agent.rb +13 -18
  66. data/lib/tcell_agent/sensor_events/util/sanitizer_utilities.rb +0 -108
  67. data/lib/tcell_agent/sensor_events/util/utils.rb +0 -2
  68. data/lib/tcell_agent/servers/passenger.rb +1 -28
  69. data/lib/tcell_agent/servers/puma.rb +3 -21
  70. data/lib/tcell_agent/servers/rails_server.rb +1 -1
  71. data/lib/tcell_agent/servers/thin.rb +2 -2
  72. data/lib/tcell_agent/servers/unicorn.rb +19 -80
  73. data/lib/tcell_agent/servers/webrick.rb +1 -1
  74. data/lib/tcell_agent/settings_reporter.rb +24 -24
  75. data/lib/tcell_agent/sinatra.rb +14 -16
  76. data/lib/tcell_agent/tcell_context.rb +40 -14
  77. data/lib/tcell_agent/utils/headers.rb +14 -0
  78. data/lib/tcell_agent/version.rb +1 -1
  79. data/spec/lib/tcell_agent/cmdi_spec.rb +0 -585
  80. data/spec/lib/tcell_agent/config/unknown_options_spec.rb +0 -18
  81. data/spec/lib/tcell_agent/configuration_spec.rb +4 -140
  82. data/spec/lib/tcell_agent/hooks/login_fraud_spec.rb +46 -173
  83. data/spec/lib/tcell_agent/instrumentation/cmdi/io_cmdi_spec.rb +504 -0
  84. data/spec/lib/tcell_agent/instrumentation/cmdi/kernel_cmdi_spec.rb +435 -0
  85. data/spec/lib/tcell_agent/instrumentation/lfi/file_lfi_spec.rb +326 -0
  86. data/spec/lib/tcell_agent/instrumentation/lfi/io_lfi_spec.rb +556 -0
  87. data/spec/lib/tcell_agent/instrumentation/lfi/kernel_lfi_spec.rb +249 -0
  88. data/spec/lib/tcell_agent/instrumentation/lfi_spec.rb +105 -0
  89. data/spec/lib/tcell_agent/patches_spec.rb +25 -43
  90. data/spec/lib/tcell_agent/policies/appfirewall_policy_spec.rb +183 -0
  91. data/spec/lib/tcell_agent/policies/clickjacking_policy_spec.rb +57 -0
  92. data/spec/lib/tcell_agent/policies/command_injection_policy_spec.rb +84 -773
  93. data/spec/lib/tcell_agent/policies/content_security_policy_spec.rb +161 -0
  94. data/spec/lib/tcell_agent/policies/dataloss_policy_spec.rb +9 -9
  95. data/spec/lib/tcell_agent/policies/http_redirect_policy_spec.rb +243 -198
  96. data/spec/lib/tcell_agent/policies/js_agent_policy_spec.rb +75 -0
  97. data/spec/lib/tcell_agent/policies/login_policy_spec.rb +165 -33
  98. data/spec/lib/tcell_agent/policies/patches_policy_spec.rb +84 -277
  99. data/spec/lib/tcell_agent/policies/policies_manager_spec.rb +104 -0
  100. data/spec/lib/tcell_agent/policies/policy_polling_spec.rb +6 -0
  101. data/spec/lib/tcell_agent/policies/secure_headers_policy_spec.rb +56 -0
  102. data/spec/lib/tcell_agent/rails/csrf_exception_spec.rb +9 -18
  103. data/spec/lib/tcell_agent/rails/js_agent_insert_spec.rb +13 -30
  104. data/spec/lib/tcell_agent/rails/logger_spec.rb +27 -7
  105. data/spec/lib/tcell_agent/rails/middleware/tcell_body_proxy_spec.rb +17 -12
  106. data/spec/lib/tcell_agent/rails/routes/routes_spec.rb +14 -14
  107. data/spec/lib/tcell_agent/sensor_events/util/sanitizer_utilities_spec.rb +0 -35
  108. data/spec/lib/tcell_agent/settings_reporter_spec.rb +127 -153
  109. data/spec/spec_helper.rb +1 -1
  110. data/spec/support/builders.rb +104 -0
  111. data/spec/support/force_logger_mocking.rb +38 -0
  112. data/spec/support/resources/lfi_sample_file.txt +2 -0
  113. data/spec/support/static_agent_overrides.rb +0 -15
  114. metadata +63 -74
  115. data/lib/tcell_agent/agent/event_processor.rb +0 -326
  116. data/lib/tcell_agent/agent/fork_pipe_manager.rb +0 -113
  117. data/lib/tcell_agent/agent/policy_manager.rb +0 -219
  118. data/lib/tcell_agent/agent/policy_types.rb +0 -30
  119. data/lib/tcell_agent/api.rb +0 -91
  120. data/lib/tcell_agent/appsensor/injections_reporter.rb +0 -24
  121. data/lib/tcell_agent/config/child_process_events.rb +0 -8
  122. data/lib/tcell_agent/instrumentation/cmdi/backtick.rb +0 -10
  123. data/lib/tcell_agent/instrumentation/cmdi/exec.rb +0 -14
  124. data/lib/tcell_agent/instrumentation/cmdi/popen.rb +0 -28
  125. data/lib/tcell_agent/instrumentation/cmdi/spawn.rb +0 -11
  126. data/lib/tcell_agent/instrumentation/cmdi/system.rb +0 -11
  127. data/lib/tcell_agent/policies/http_tx_policy.rb +0 -60
  128. data/lib/tcell_agent/policies/login_fraud_policy.rb +0 -45
  129. data/lib/tcell_agent/policies/rust_policies.rb +0 -110
  130. data/lib/tcell_agent/rails.rb +0 -40
  131. data/lib/tcell_agent/rust/libtcellagent-1.3.2.dylib +0 -0
  132. data/lib/tcell_agent/rust/tcellagent-1.3.2.dll +0 -0
  133. data/lib/tcell_agent/rust/whisperer.rb +0 -308
  134. data/lib/tcell_agent/sensor_events/appsensor_event.rb +0 -52
  135. data/lib/tcell_agent/sensor_events/appsensor_meta_event.rb +0 -45
  136. data/lib/tcell_agent/sensor_events/command_injection.rb +0 -75
  137. data/lib/tcell_agent/sensor_events/honeytokens.rb +0 -16
  138. data/lib/tcell_agent/sensor_events/login_fraud.rb +0 -60
  139. data/lib/tcell_agent/sensor_events/metrics.rb +0 -123
  140. data/lib/tcell_agent/sensor_events/patches.rb +0 -21
  141. data/lib/tcell_agent/start_background_thread.rb +0 -55
  142. data/lib/tcell_agent/system_info.rb +0 -11
  143. data/lib/tcell_agent/utils/io.rb +0 -38
  144. data/lib/tcell_agent/utils/passwords.rb +0 -28
  145. data/lib/tcell_agent/utils/queue_with_timeout.rb +0 -142
  146. data/spec/lib/tcell_agent/agent/fork_pipe_manager_spec.rb +0 -100
  147. data/spec/lib/tcell_agent/agent/policy_manager_spec.rb +0 -535
  148. data/spec/lib/tcell_agent/agent/static_agent_spec.rb +0 -133
  149. data/spec/lib/tcell_agent/api/api_spec.rb +0 -39
  150. data/spec/lib/tcell_agent/appsensor/injections_reporter_spec.rb +0 -187
  151. data/spec/lib/tcell_agent/instrumentation_spec.rb +0 -225
  152. data/spec/lib/tcell_agent/policies/appsensor_policy_spec.rb +0 -517
  153. data/spec/lib/tcell_agent/policies/http_tx_policy_spec.rb +0 -22
  154. data/spec/lib/tcell_agent/rails/middleware/appsensor_middleware_spec.rb +0 -293
  155. data/spec/lib/tcell_agent/rails/middleware/dlp_middleware_spec.rb +0 -198
  156. data/spec/lib/tcell_agent/rails/middleware/global_middleware_spec.rb +0 -180
  157. data/spec/lib/tcell_agent/rails/middleware/redirect_middleware_spec.rb +0 -116
  158. data/spec/lib/tcell_agent/rust/models_spec.rb +0 -120
  159. data/spec/lib/tcell_agent/rust/whisperer_spec.rb +0 -704
  160. data/spec/lib/tcell_agent/sensor_events/appsensor_meta_event_spec.rb +0 -45
  161. data/spec/lib/tcell_agent/sensor_events/sessions_metric_spec.rb +0 -272
  162. data/spec/lib/tcell_agent/utils/bounded_queue_spec.rb +0 -52
  163. data/spec/lib/tcell_agent/utils/passwords_spec.rb +0 -143
@@ -6,8 +6,6 @@ module TCellAgent
6
6
  describe '.get_unknown_options' do
7
7
  context 'with an unknown tcell environment variable set' do
8
8
  it 'should return a message about the unknown variable' do
9
- orig_allow_uap = ENV.fetch('TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS', nil)
10
- orig_allow_uafp = ENV.fetch('TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS', nil)
11
9
  orig_allow_ap = ENV.fetch('TCELL_AGENT_ALLOW_PAYLOADS', nil)
12
10
  orig_demomode = ENV.fetch('TCELL_DEMOMODE', nil)
13
11
  orig_agent_home = ENV.fetch('TCELL_AGENT_HOME', nil)
@@ -22,8 +20,6 @@ module TCellAgent
22
20
  orig_password_hmac_key = ENV.fetch('TCELL_PASSWORD_HMAC_KEY', nil)
23
21
 
24
22
  ENV['TCELL_HACK'] = 'hack the system'
25
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS'] = 'valid'
26
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS'] = 'valid'
27
23
  ENV['TCELL_AGENT_ALLOW_PAYLOADS'] = 'valid'
28
24
  ENV['TCELL_DEMOMODE'] = 'valid'
29
25
  ENV['TCELL_AGENT_HOME'] = 'valid'
@@ -40,17 +36,7 @@ module TCellAgent
40
36
  messages = Validate.get_unknown_options(nil)
41
37
 
42
38
  ENV.delete 'TCELL_HACK'
43
- if orig_allow_uap
44
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS'] = orig_allow_uap
45
- else
46
- ENV.delete 'TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS'
47
- end
48
39
 
49
- if orig_allow_uafp
50
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS'] = orig_allow_uafp
51
- else
52
- ENV.delete 'TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS'
53
- end
54
40
  if orig_allow_ap
55
41
  ENV['TCELL_AGENT_ALLOW_PAYLOADS'] = orig_allow_ap
56
42
  else
@@ -150,8 +136,6 @@ module TCellAgent
150
136
  'js_agent_url' => 'js agent url',
151
137
  'max_csp_header_bytes' => 512,
152
138
  'event_batch_size_limit' => 50,
153
- 'allow_unencrypted_appsensor_payloads' => true,
154
- 'allow_unencrypted_appfirewall_payloads' => true,
155
139
  'allow_payloads' => true,
156
140
  'data_exposure' => {
157
141
  'data_ex_level' => 'boo',
@@ -164,12 +148,10 @@ module TCellAgent
164
148
  'disable_all' => false,
165
149
  'enabled' => true,
166
150
  'enable_event_manager' => true,
167
- 'enable_event_consumer' => true,
168
151
  'enable_policy_polling' => true,
169
152
  'enable_instrumentation' => true,
170
153
  'enable_intercept_requests' => true,
171
154
  'instrument_for_events' => true,
172
- 'agent_home_owner' => true,
173
155
  'enabled_instrumentations' => {
174
156
  'enabled_instrumentations_level' => 'blah',
175
157
  'doorkeeper' => true,
@@ -7,9 +7,6 @@ module TCellAgent
7
7
  it 'should set cache file, config, and log file to defaults' do
8
8
  configuration = Configuration.new
9
9
 
10
- expect(configuration.cache_filename_with_app_id).to match(
11
- %r{/tcell/cache/tcell_agent.cache}
12
- )
13
10
  expect(configuration.log_filename).to eq(
14
11
  File.join(Dir.getwd, 'tcell/logs/tcell_agent.log')
15
12
  )
@@ -27,9 +24,6 @@ module TCellAgent
27
24
 
28
25
  configuration = Configuration.new
29
26
 
30
- expect(configuration.cache_filename_with_app_id).to match(
31
- %r{spec_tcell_home/cache/tcell_agent.cache}
32
- )
33
27
  expect(configuration.log_filename).to eq(
34
28
  'spec_tcell_home/logs/tcell_agent.log'
35
29
  )
@@ -51,9 +45,6 @@ module TCellAgent
51
45
 
52
46
  configuration = Configuration.new
53
47
 
54
- expect(configuration.cache_filename_with_app_id).to match(
55
- %r{spec_tcell_home/cache/tcell_agent.cache}
56
- )
57
48
  expect(configuration.log_filename).to eq(
58
49
  'spec_tcell_log_dir/tcell_agent.log'
59
50
  )
@@ -78,9 +69,6 @@ module TCellAgent
78
69
 
79
70
  configuration = Configuration.new
80
71
 
81
- expect(configuration.cache_filename_with_app_id).to match(
82
- %r{spec_tcell_home/cache/tcell_agent.cache}
83
- )
84
72
  expect(configuration.log_filename).to eq(
85
73
  'spec_tcell_log_dir/tcell_agent.log'
86
74
  )
@@ -178,61 +166,9 @@ module TCellAgent
178
166
 
179
167
  describe '#allow_payloads' do
180
168
  context 'setting it via config' do
181
- context 'using allow_unencrypted_appsensor_payloads' do
182
- it 'should be false' do
183
- allow_unencrypted_appfirewall_payloads_enabled = double(
184
- 'no_data_ex',
185
- :read => {
186
- :version => 1,
187
- :applications => [
188
- :app_id => 'app_id',
189
- :api_key => 'api_key',
190
- :allow_unencrypted_appsensor_payloads => false
191
- ]
192
- }.to_json
193
- )
194
- expect(File).to receive(:file?).with(
195
- File.join(Dir.getwd, 'config/tcell_agent.config')
196
- ).and_return(true)
197
- expect(File).to receive(:open).with(
198
- File.join(Dir.getwd, 'config/tcell_agent.config')
199
- ).and_return(allow_unencrypted_appfirewall_payloads_enabled)
200
-
201
- configuration = Configuration.new
202
-
203
- expect(configuration.allow_payloads).to eq(false)
204
- end
205
- end
206
-
207
- context 'using allow_unencrypted_appfirewall_payloads' do
208
- it 'should be false' do
209
- allow_unencrypted_appfirewall_payloads_enabled = double(
210
- 'no_data_ex',
211
- :read => {
212
- :version => 1,
213
- :applications => [
214
- :app_id => 'app_id',
215
- :api_key => 'api_key',
216
- :allow_unencrypted_appfirewall_payloads => false
217
- ]
218
- }.to_json
219
- )
220
- expect(File).to receive(:file?).with(
221
- File.join(Dir.getwd, 'config/tcell_agent.config')
222
- ).and_return(true)
223
- expect(File).to receive(:open).with(
224
- File.join(Dir.getwd, 'config/tcell_agent.config')
225
- ).and_return(allow_unencrypted_appfirewall_payloads_enabled)
226
-
227
- configuration = Configuration.new
228
-
229
- expect(configuration.allow_payloads).to eq(false)
230
- end
231
- end
232
-
233
169
  context 'using allow_payloads' do
234
170
  it 'should be false' do
235
- allow_unencrypted_appfirewall_payloads_enabled = double(
171
+ allow_payloads_enabled = double(
236
172
  'no_data_ex',
237
173
  :read => {
238
174
  :version => 1,
@@ -248,7 +184,7 @@ module TCellAgent
248
184
  ).and_return(true)
249
185
  expect(File).to receive(:open).with(
250
186
  File.join(Dir.getwd, 'config/tcell_agent.config')
251
- ).and_return(allow_unencrypted_appfirewall_payloads_enabled)
187
+ ).and_return(allow_payloads_enabled)
252
188
 
253
189
  configuration = Configuration.new
254
190
 
@@ -258,89 +194,19 @@ module TCellAgent
258
194
  end
259
195
 
260
196
  context 'setting it via env var' do
261
- context 'TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS overrides config file' do
262
- it 'should be false' do
263
- old_allow_unencrypted_appsensor_payloads = ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS']
264
-
265
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS'] = 'false'
266
-
267
- allow_unencrypted_appfirewall_payloads_enabled = double(
268
- 'no_data_ex',
269
- :read => {
270
- :version => 1,
271
- :applications => [
272
- :app_id => 'app_id',
273
- :api_key => 'api_key',
274
- :allow_unencrypted_appsensor_payloads => true
275
- ]
276
- }.to_json
277
- )
278
- expect(File).to receive(:file?).with(
279
- File.join(Dir.getwd, 'config/tcell_agent.config')
280
- ).and_return(true)
281
- expect(File).to receive(:open).with(
282
- File.join(Dir.getwd, 'config/tcell_agent.config')
283
- ).and_return(allow_unencrypted_appfirewall_payloads_enabled)
284
-
285
- configuration = Configuration.new
286
-
287
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS'] = old_allow_unencrypted_appsensor_payloads
288
-
289
- expect(configuration.allow_payloads).to eq(false)
290
- end
291
- end
292
-
293
- context 'TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS overrides config file' do
294
- it 'should be false' do
295
- old_allow_unencrypted_appfirewall_payloads = ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS']
296
-
297
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS'] = 'false'
298
-
299
- allow_unencrypted_appfirewall_payloads_enabled = double(
300
- 'no_data_ex',
301
- :read => {
302
- :version => 1,
303
- :applications => [
304
- :app_id => 'app_id',
305
- :api_key => 'api_key',
306
- :allow_unencrypted_appfirewall_payloads => true
307
- ]
308
- }.to_json
309
- )
310
- expect(File).to receive(:file?).with(
311
- File.join(Dir.getwd, 'config/tcell_agent.config')
312
- ).and_return(true)
313
- expect(File).to receive(:open).with(
314
- File.join(Dir.getwd, 'config/tcell_agent.config')
315
- ).and_return(allow_unencrypted_appfirewall_payloads_enabled)
316
-
317
- configuration = Configuration.new
318
-
319
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS'] = old_allow_unencrypted_appfirewall_payloads
320
-
321
- expect(configuration.allow_payloads).to eq(false)
322
- end
323
- end
324
-
325
197
  context 'TCELL_AGENT_ALLOW_PAYLOADS overrides everything else' do
326
198
  it 'should be false' do
327
- old_allow_unencrypted_appsensor_payloads = ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS']
328
- old_allow_unencrypted_appfirewall_payloads = ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS']
329
199
  old_tcell_agent_allow_payloads = ENV['TCELL_AGENT_ALLOW_PAYLOADS']
330
200
 
331
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS'] = 'true'
332
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS'] = 'true'
333
201
  ENV['TCELL_AGENT_ALLOW_PAYLOADS'] = 'false'
334
202
 
335
- allow_unencrypted_appfirewall_payloads_enabled = double(
203
+ allow_payloads_enabled = double(
336
204
  'no_data_ex',
337
205
  :read => {
338
206
  :version => 1,
339
207
  :applications => [
340
208
  :app_id => 'app_id',
341
209
  :api_key => 'api_key',
342
- :allow_unencrypted_appsensor_payloads => true,
343
- :allow_unencrypted_appfirewall_payloads => true,
344
210
  :allow_payloads => true
345
211
  ]
346
212
  }.to_json
@@ -350,12 +216,10 @@ module TCellAgent
350
216
  ).and_return(true)
351
217
  expect(File).to receive(:open).with(
352
218
  File.join(Dir.getwd, 'config/tcell_agent.config')
353
- ).and_return(allow_unencrypted_appfirewall_payloads_enabled)
219
+ ).and_return(allow_payloads_enabled)
354
220
 
355
221
  configuration = Configuration.new
356
222
 
357
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS'] = old_allow_unencrypted_appsensor_payloads
358
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS'] = old_allow_unencrypted_appfirewall_payloads
359
223
  ENV['TCELL_AGENT_ALLOW_PAYLOADS'] = old_tcell_agent_allow_payloads
360
224
 
361
225
  expect(configuration.allow_payloads).to eq(false)
@@ -26,56 +26,30 @@ module TCellAgent
26
26
 
27
27
  describe 'manually requiring auth hooks' do
28
28
  before(:all) do
29
- require 'tcell_agent/hooks/login_fraud'
29
+ load 'lib/tcell_agent/hooks/login_fraud.rb'
30
+ load 'spec/support/force_logger_mocking.rb'
30
31
  end
31
32
 
32
33
  describe 'Using generic interface' do
33
34
  context 'with a login failure' do
34
35
  context 'with login_failed_enabled set to true' do
35
36
  it 'should report the login failure' do
36
- login_fraud = double('login_fraud', :enabled => true, :login_failed_enabled => true)
37
-
38
- expect(TCellAgent).to receive(:policy).with(TCellAgent::PolicyTypes::LOGINFRAUD).and_return(
39
- login_fraud
40
- )
41
- expect(TCellAgent).to receive(:send_event).with(
42
- {
43
- 'event_type' => 'login',
44
- 'header_keys' => %w[USER_AGENT X_FORWARDED_FOR],
45
- 'user_agent' => 'user_agent',
46
- 'referrer' => 'http://tcell.tcell.io/?utm_campaign=',
47
- 'remote_addr' => '1.1.1.1',
48
- 'user_id' => 'user_id',
49
- 'document_uri' => 'http://tcell.tcell.io/login?param_name=',
50
- 'session' => '48c0ce7961d8d5d4bd57bd77976b3d38',
51
- 'event_name' => 'login-failure'
52
- }
53
- )
54
-
37
+ login_fraud = double('login_fraud', :login_failed_enabled => true)
55
38
  status = Hooks::V1::Login::LOGIN_FAILURE
56
39
  header_keys = %w[HTTP_USER_AGENT HTTP_X_FORWARDED_FOR]
57
40
  document_uri = 'http://tcell.tcell.io/login?param_name=param_value'
58
41
  referrer = 'http://tcell.tcell.io/?utm_campaign=some-source'
59
42
 
60
- Hooks::V1::Login.register_login_event(
61
- status, 'session_id', 'user_agent', referrer, '1.1.1.1', header_keys, 'user_id', document_uri
62
- )
63
- end
64
- end
65
-
66
- context 'with login_failed_enabled set to false' do
67
- it 'should NOT report the login failure' do
68
- login_fraud = double('login_fraud', :enabled => true, :login_failed_enabled => false)
69
-
70
- expect(TCellAgent).to receive(:policy).with(TCellAgent::PolicyTypes::LOGINFRAUD).and_return(
71
- login_fraud
43
+ expect(TCellAgent).to receive(:policy).with(
44
+ TCellAgent::PolicyTypes::LOGINFRAUD
45
+ ).and_return(login_fraud)
46
+ expect(login_fraud).to receive(:report_login_failure).with(
47
+ 'user_id',
48
+ nil,
49
+ header_keys,
50
+ nil,
51
+ anything
72
52
  )
73
- expect(TCellAgent).to_not receive(:send_event)
74
-
75
- status = Hooks::V1::Login::LOGIN_FAILURE
76
- header_keys = %w[HTTP_USER_AGENT HTTP_X_FORWARDED_FOR]
77
- document_uri = 'http://tcell.tcell.io/login?param_name=param_value'
78
- referrer = 'http://tcell.tcell.io/?utm_campaign=some-source'
79
53
 
80
54
  Hooks::V1::Login.register_login_event(
81
55
  status, 'session_id', 'user_agent', referrer, '1.1.1.1', header_keys, 'user_id', document_uri
@@ -87,49 +61,20 @@ module TCellAgent
87
61
  context 'with a login success' do
88
62
  context 'with login_success_enabled set to true' do
89
63
  it 'should report the login success' do
90
- login_fraud = double('login_fraud', :enabled => true, :login_success_enabled => true)
91
-
92
- expect(TCellAgent).to receive(:policy).with(TCellAgent::PolicyTypes::LOGINFRAUD).and_return(
93
- login_fraud
94
- )
95
- expect(TCellAgent).to receive(:send_event).with(
96
- {
97
- 'event_type' => 'login',
98
- 'header_keys' => %w[USER_AGENT X_FORWARDED_FOR],
99
- 'user_agent' => 'user_agent',
100
- 'referrer' => 'http://tcell.tcell.io/?utm_campaign=',
101
- 'remote_addr' => '1.1.1.1',
102
- 'user_id' => 'user_id',
103
- 'document_uri' => 'http://tcell.tcell.io/login?param_name=',
104
- 'session' => '48c0ce7961d8d5d4bd57bd77976b3d38',
105
- 'event_name' => 'login-success'
106
- }
107
- )
108
-
64
+ login_fraud = double('login_fraud', :login_success_enabled => true)
109
65
  status = Hooks::V1::Login::LOGIN_SUCCESS
110
66
  header_keys = %w[HTTP_USER_AGENT HTTP_X_FORWARDED_FOR]
111
67
  document_uri = 'http://tcell.tcell.io/login?param_name=param_value'
112
68
  referrer = 'http://tcell.tcell.io/?utm_campaign=some-source'
113
69
 
114
- Hooks::V1::Login.register_login_event(
115
- status, 'session_id', 'user_agent', referrer, '1.1.1.1', header_keys, 'user_id', document_uri
116
- )
117
- end
118
- end
119
-
120
- context 'with login_success_enabled set to false' do
121
- it 'should NOT report the login success' do
122
- login_fraud = double('login_fraud', :enabled => true, :login_success_enabled => false)
123
-
124
70
  expect(TCellAgent).to receive(:policy).with(TCellAgent::PolicyTypes::LOGINFRAUD).and_return(
125
71
  login_fraud
126
72
  )
127
- expect(TCellAgent).to_not receive(:send_event)
128
-
129
- status = Hooks::V1::Login::LOGIN_SUCCESS
130
- header_keys = %w[HTTP_USER_AGENT HTTP_X_FORWARDED_FOR]
131
- document_uri = 'http://tcell.tcell.io/login?param_name=param_value'
132
- referrer = 'http://tcell.tcell.io/?utm_campaign=some-source'
73
+ expect(login_fraud).to receive(:report_login_success).with(
74
+ 'user_id',
75
+ header_keys,
76
+ anything
77
+ )
133
78
 
134
79
  Hooks::V1::Login.register_login_event(
135
80
  status, 'session_id', 'user_agent', referrer, '1.1.1.1', header_keys, 'user_id', document_uri
@@ -140,15 +85,17 @@ module TCellAgent
140
85
 
141
86
  context 'with an unknown status' do
142
87
  it 'should log the error' do
143
- login_fraud = double('login_fraud', :enabled => true)
88
+ login_fraud = double('login_fraud')
144
89
  logger = double('logger')
145
90
 
146
- expect(TCellAgent).to receive(:policy).with(TCellAgent::PolicyTypes::LOGINFRAUD).and_return(
147
- login_fraud
148
- )
91
+ expect(TCellAgent).to receive(:policy).with(
92
+ TCellAgent::PolicyTypes::LOGINFRAUD
93
+ ).and_return(login_fraud)
149
94
  expect(TCellAgent).to_not receive(:send_event)
150
- expect(TCellAgent).to receive(:logger).and_return(logger)
151
- expect(logger).to receive(:error).with('Unkown login status: mumbo-jumbo')
95
+ expect(TCellAgent::Hooks::LoginFraud).to receive(:get_logger).and_return(logger)
96
+ expect(logger).to receive(:error).with(
97
+ 'Unkown login status: mumbo-jumbo'
98
+ )
152
99
 
153
100
  status = 'mumbo-jumbo'
154
101
  header_keys = %w[HTTP_USER_AGENT HTTP_X_FORWARDED_FOR]
@@ -166,12 +113,12 @@ module TCellAgent
166
113
  context 'with a login failure' do
167
114
  context 'with login_failed_enabled set to true' do
168
115
  it 'should report the login failure' do
169
- login_fraud = double('login_fraud', :enabled => true, :login_failed_enabled => true)
116
+ login_fraud = double('login_fraud', :login_failed_enabled => true)
170
117
  rails_request = double('rails_request')
171
118
  tcell_data = TCellAgent::Instrumentation::TCellData.new
172
119
  tcell_data.user_agent = 'user_agent'
173
120
  tcell_data.referrer = 'http://tcell.tcell.io/?utm_campaign=some-source'
174
- tcell_data.ip_address = '1.1.1.1'
121
+ tcell_data.remote_address = '1.1.1.1'
175
122
  tcell_data.path = 'http://tcell.tcell.io/login?param_name=param_value'
176
123
  tcell_data.hmac_session_id = TCellAgent::SensorEvents::Util.hmac('session_id')
177
124
  request_env = {
@@ -185,18 +132,12 @@ module TCellAgent
185
132
  )
186
133
  expect(rails_request).to receive(:env).and_return(request_env)
187
134
  expect(rails_request).to receive(:env).and_return(request_env)
188
- expect(TCellAgent).to receive(:send_event).with(
189
- {
190
- 'event_type' => 'login',
191
- 'header_keys' => %w[USER_AGENT X_FORWARDED_FOR],
192
- 'user_agent' => 'user_agent',
193
- 'referrer' => 'http://tcell.tcell.io/?utm_campaign=',
194
- 'remote_addr' => '1.1.1.1',
195
- 'user_id' => 'user_id',
196
- 'document_uri' => 'http://tcell.tcell.io/login?param_name=',
197
- 'session' => '48c0ce7961d8d5d4bd57bd77976b3d38',
198
- 'event_name' => 'login-failure'
199
- }
135
+ expect(login_fraud).to receive(:report_login_failure).with(
136
+ 'user_id',
137
+ nil,
138
+ request_env,
139
+ nil,
140
+ anything
200
141
  )
201
142
 
202
143
  status = Hooks::V1::Login::LOGIN_FAILURE
@@ -206,48 +147,17 @@ module TCellAgent
206
147
  )
207
148
  end
208
149
  end
209
-
210
- context 'with login_failed_enabled set to false' do
211
- it 'should NOT report the login failure' do
212
- login_fraud = double('login_fraud', :enabled => true, :login_failed_enabled => false)
213
- rails_request = double('rails_request')
214
- tcell_data = TCellAgent::Instrumentation::TCellData.new
215
- tcell_data.user_agent = 'user_agent'
216
- tcell_data.referrer = 'http://tcell.tcell.io/?utm_campaign='
217
- tcell_data.ip_address = '1.1.1.1'
218
- tcell_data.path = 'http://tcell.tcell.io/login?param_name=param_value'
219
- tcell_data.hmac_session_id = TCellAgent::SensorEvents::Util.hmac('session_id')
220
- request_env = {
221
- TCellAgent::Instrumentation::TCELL_ID => tcell_data,
222
- 'HTTP_USER_AGENT' => true,
223
- 'HTTP_X_FORWARDED_FOR' => true
224
- }
225
-
226
- expect(TCellAgent).to receive(:policy).with(TCellAgent::PolicyTypes::LOGINFRAUD).and_return(
227
- login_fraud
228
- )
229
- expect(rails_request).to receive(:env).and_return(request_env)
230
- expect(rails_request).to receive(:env).and_return(request_env)
231
- expect(TCellAgent).to_not receive(:send_event)
232
-
233
- status = Hooks::V1::Login::LOGIN_FAILURE
234
-
235
- Hooks::V1::Frameworks::Rails::Login.register_login_event(
236
- status, rails_request, 'user_id'
237
- )
238
- end
239
- end
240
150
  end
241
151
 
242
152
  context 'with a login success' do
243
153
  context 'with login_success_enabled set to true' do
244
154
  it 'should report the login success' do
245
- login_fraud = double('login_fraud', :enabled => true, :login_success_enabled => true)
155
+ login_fraud = double('login_fraud', :login_success_enabled => true)
246
156
  rails_request = double('rails_request')
247
157
  tcell_data = TCellAgent::Instrumentation::TCellData.new
248
158
  tcell_data.user_agent = 'user_agent'
249
159
  tcell_data.referrer = 'http://tcell.tcell.io/?utm_campaign=some-source'
250
- tcell_data.ip_address = '1.1.1.1'
160
+ tcell_data.remote_address = '1.1.1.1'
251
161
  tcell_data.path = 'http://tcell.tcell.io/login?param_name=param_value'
252
162
  tcell_data.hmac_session_id = TCellAgent::SensorEvents::Util.hmac('session_id')
253
163
  request_env = {
@@ -261,18 +171,10 @@ module TCellAgent
261
171
  )
262
172
  expect(rails_request).to receive(:env).and_return(request_env)
263
173
  expect(rails_request).to receive(:env).and_return(request_env)
264
- expect(TCellAgent).to receive(:send_event).with(
265
- {
266
- 'event_type' => 'login',
267
- 'header_keys' => %w[USER_AGENT X_FORWARDED_FOR],
268
- 'user_agent' => 'user_agent',
269
- 'referrer' => 'http://tcell.tcell.io/?utm_campaign=',
270
- 'remote_addr' => '1.1.1.1',
271
- 'user_id' => 'user_id',
272
- 'document_uri' => 'http://tcell.tcell.io/login?param_name=',
273
- 'session' => '48c0ce7961d8d5d4bd57bd77976b3d38',
274
- 'event_name' => 'login-success'
275
- }
174
+ expect(login_fraud).to receive(:report_login_success).with(
175
+ 'user_id',
176
+ request_env,
177
+ anything
276
178
  )
277
179
 
278
180
  status = Hooks::V1::Login::LOGIN_SUCCESS
@@ -282,48 +184,17 @@ module TCellAgent
282
184
  )
283
185
  end
284
186
  end
285
-
286
- context 'with login_success_enabled set to false' do
287
- it 'should NOT report the login success' do
288
- login_fraud = double('login_fraud', :enabled => true, :login_success_enabled => false)
289
- rails_request = double('rails_request')
290
- tcell_data = TCellAgent::Instrumentation::TCellData.new
291
- tcell_data.user_agent = 'user_agent'
292
- tcell_data.referrer = 'http://tcell.tcell.io/?utm_campaign=some-source'
293
- tcell_data.ip_address = '1.1.1.1'
294
- tcell_data.path = 'http://tcell.tcell.io/login?param_name=param_value'
295
- tcell_data.hmac_session_id = TCellAgent::SensorEvents::Util.hmac('session_id')
296
- request_env = {
297
- TCellAgent::Instrumentation::TCELL_ID => tcell_data,
298
- 'HTTP_USER_AGENT' => true,
299
- 'HTTP_X_FORWARDED_FOR' => true
300
- }
301
-
302
- expect(TCellAgent).to receive(:policy).with(TCellAgent::PolicyTypes::LOGINFRAUD).and_return(
303
- login_fraud
304
- )
305
- expect(rails_request).to receive(:env).and_return(request_env)
306
- expect(rails_request).to receive(:env).and_return(request_env)
307
- expect(TCellAgent).to_not receive(:send_event)
308
-
309
- status = Hooks::V1::Login::LOGIN_SUCCESS
310
-
311
- Hooks::V1::Frameworks::Rails::Login.register_login_event(
312
- status, rails_request, 'user_id'
313
- )
314
- end
315
- end
316
187
  end
317
188
 
318
189
  context 'with an unknown status' do
319
190
  it 'should log the error' do
320
- login_fraud = double('login_fraud', :enabled => true, :login_failed_enabled => true)
191
+ login_fraud = double('login_fraud', :login_failed_enabled => true)
321
192
  logger = double('logger')
322
193
  rails_request = double('rails_request')
323
194
  tcell_data = TCellAgent::Instrumentation::TCellData.new
324
195
  tcell_data.user_agent = 'user_agent'
325
196
  tcell_data.referrer = 'http://tcell.tcell.io/?utm_campaign=some-source'
326
- tcell_data.ip_address = '1.1.1.1'
197
+ tcell_data.remote_address = '1.1.1.1'
327
198
  tcell_data.path = 'http://tcell.tcell.io/login?param_name=param_value'
328
199
  tcell_data.hmac_session_id = TCellAgent::SensorEvents::Util.hmac('session_id')
329
200
  request_env = {
@@ -338,8 +209,10 @@ module TCellAgent
338
209
  expect(rails_request).to receive(:env).and_return(request_env)
339
210
  expect(rails_request).to receive(:env).and_return(request_env)
340
211
  expect(TCellAgent).to_not receive(:send_event)
341
- expect(TCellAgent).to receive(:logger).and_return(logger)
342
- expect(logger).to receive(:error).with('Unkown login status: mumbo-jumbo')
212
+ expect(TCellAgent::Hooks::LoginFraud).to receive(:get_logger).and_return(logger)
213
+ expect(logger).to receive(:error).with(
214
+ 'Unkown login status: mumbo-jumbo'
215
+ )
343
216
 
344
217
  status = 'mumbo-jumbo'
345
218