tcell_agent 1.1.12 → 2.0.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (163) hide show
  1. checksums.yaml +5 -5
  2. data/bin/tcell_agent +26 -14
  3. data/lib/tcell_agent.rb +16 -10
  4. data/lib/tcell_agent/agent.rb +78 -97
  5. data/lib/tcell_agent/agent/route_manager.rb +0 -16
  6. data/lib/tcell_agent/agent/static_agent.rb +9 -30
  7. data/lib/tcell_agent/authlogic.rb +3 -6
  8. data/lib/tcell_agent/config/unknown_options.rb +4 -8
  9. data/lib/tcell_agent/configuration.rb +38 -119
  10. data/lib/tcell_agent/devise.rb +25 -27
  11. data/lib/tcell_agent/hooks/login_fraud.rb +30 -33
  12. data/lib/tcell_agent/instrument_servers.rb +25 -0
  13. data/lib/tcell_agent/instrumentation.rb +12 -10
  14. data/lib/tcell_agent/instrumentation/cmdi.rb +19 -15
  15. data/lib/tcell_agent/instrumentation/lfi.rb +73 -0
  16. data/lib/tcell_agent/instrumentation/monkey_patches/file.rb +25 -0
  17. data/lib/tcell_agent/instrumentation/monkey_patches/io.rb +123 -0
  18. data/lib/tcell_agent/instrumentation/monkey_patches/kernel.rb +159 -0
  19. data/lib/tcell_agent/logger.rb +50 -114
  20. data/lib/tcell_agent/patches.rb +6 -7
  21. data/lib/tcell_agent/policies/appfirewall_policy.rb +26 -0
  22. data/lib/tcell_agent/policies/command_injection_policy.rb +28 -0
  23. data/lib/tcell_agent/policies/dataloss_policy.rb +44 -44
  24. data/lib/tcell_agent/policies/headers_policy.rb +25 -0
  25. data/lib/tcell_agent/policies/http_redirect_policy.rb +13 -79
  26. data/lib/tcell_agent/policies/js_agent_policy.rb +27 -0
  27. data/lib/tcell_agent/policies/local_file_access.rb +28 -0
  28. data/lib/tcell_agent/policies/login_policy.rb +43 -0
  29. data/lib/tcell_agent/policies/patches_policy.rb +27 -0
  30. data/lib/tcell_agent/policies/policies_manager.rb +68 -0
  31. data/lib/tcell_agent/policies/policy_polling.rb +58 -0
  32. data/lib/tcell_agent/policies/policy_types.rb +14 -0
  33. data/lib/tcell_agent/policies/system_enablements.rb +27 -0
  34. data/lib/tcell_agent/rails/auth/authlogic.rb +43 -68
  35. data/lib/tcell_agent/rails/auth/devise.rb +20 -23
  36. data/lib/tcell_agent/rails/auth/doorkeeper.rb +63 -74
  37. data/lib/tcell_agent/rails/csrf_exception.rb +2 -2
  38. data/lib/tcell_agent/rails/dlp.rb +25 -15
  39. data/lib/tcell_agent/rails/dlp_handler.rb +1 -2
  40. data/lib/tcell_agent/rails/js_agent_insert.rb +12 -13
  41. data/lib/tcell_agent/rails/middleware/body_filter_middleware.rb +4 -25
  42. data/lib/tcell_agent/rails/middleware/context_middleware.rb +2 -12
  43. data/lib/tcell_agent/rails/middleware/global_middleware.rb +0 -1
  44. data/lib/tcell_agent/rails/middleware/headers_middleware.rb +14 -34
  45. data/lib/tcell_agent/rails/on_start.rb +32 -31
  46. data/lib/tcell_agent/rails/routes.rb +7 -6
  47. data/lib/tcell_agent/rails/routes/grape.rb +1 -3
  48. data/lib/tcell_agent/rails/routes/route_id.rb +3 -1
  49. data/lib/tcell_agent/rails/settings_reporter.rb +23 -36
  50. data/lib/tcell_agent/rails/start_agent_after_initializers.rb +12 -0
  51. data/lib/tcell_agent/rails/tcell_body_proxy.rb +6 -4
  52. data/lib/tcell_agent/rust/agent_config.rb +49 -0
  53. data/lib/tcell_agent/rust/{libtcellagent-alpine-1.3.2.so → libtcellagent-4.14.0.dylib} +0 -0
  54. data/lib/tcell_agent/rust/libtcellagent-4.14.0.so +0 -0
  55. data/lib/tcell_agent/rust/{libtcellagent-1.3.2.so → libtcellagent-alpine-4.14.0.so} +0 -0
  56. data/lib/tcell_agent/rust/models.rb +0 -55
  57. data/lib/tcell_agent/rust/native_agent.rb +531 -0
  58. data/lib/tcell_agent/rust/native_agent_response.rb +42 -0
  59. data/lib/tcell_agent/rust/native_library.rb +68 -0
  60. data/lib/tcell_agent/rust/tcellagent-4.14.0.dll +0 -0
  61. data/lib/tcell_agent/sensor_events/agent_setting_event.rb +12 -0
  62. data/lib/tcell_agent/sensor_events/{app_config.rb → app_config_setting_event.rb} +0 -6
  63. data/lib/tcell_agent/sensor_events/dlp.rb +2 -6
  64. data/lib/tcell_agent/sensor_events/sensor.rb +0 -62
  65. data/lib/tcell_agent/sensor_events/server_agent.rb +13 -18
  66. data/lib/tcell_agent/sensor_events/util/sanitizer_utilities.rb +0 -108
  67. data/lib/tcell_agent/sensor_events/util/utils.rb +0 -2
  68. data/lib/tcell_agent/servers/passenger.rb +1 -28
  69. data/lib/tcell_agent/servers/puma.rb +3 -21
  70. data/lib/tcell_agent/servers/rails_server.rb +1 -1
  71. data/lib/tcell_agent/servers/thin.rb +2 -2
  72. data/lib/tcell_agent/servers/unicorn.rb +19 -80
  73. data/lib/tcell_agent/servers/webrick.rb +1 -1
  74. data/lib/tcell_agent/settings_reporter.rb +24 -24
  75. data/lib/tcell_agent/sinatra.rb +14 -16
  76. data/lib/tcell_agent/tcell_context.rb +40 -14
  77. data/lib/tcell_agent/utils/headers.rb +14 -0
  78. data/lib/tcell_agent/version.rb +1 -1
  79. data/spec/lib/tcell_agent/cmdi_spec.rb +0 -585
  80. data/spec/lib/tcell_agent/config/unknown_options_spec.rb +0 -18
  81. data/spec/lib/tcell_agent/configuration_spec.rb +4 -140
  82. data/spec/lib/tcell_agent/hooks/login_fraud_spec.rb +46 -173
  83. data/spec/lib/tcell_agent/instrumentation/cmdi/io_cmdi_spec.rb +504 -0
  84. data/spec/lib/tcell_agent/instrumentation/cmdi/kernel_cmdi_spec.rb +435 -0
  85. data/spec/lib/tcell_agent/instrumentation/lfi/file_lfi_spec.rb +326 -0
  86. data/spec/lib/tcell_agent/instrumentation/lfi/io_lfi_spec.rb +556 -0
  87. data/spec/lib/tcell_agent/instrumentation/lfi/kernel_lfi_spec.rb +249 -0
  88. data/spec/lib/tcell_agent/instrumentation/lfi_spec.rb +105 -0
  89. data/spec/lib/tcell_agent/patches_spec.rb +25 -43
  90. data/spec/lib/tcell_agent/policies/appfirewall_policy_spec.rb +183 -0
  91. data/spec/lib/tcell_agent/policies/clickjacking_policy_spec.rb +57 -0
  92. data/spec/lib/tcell_agent/policies/command_injection_policy_spec.rb +84 -773
  93. data/spec/lib/tcell_agent/policies/content_security_policy_spec.rb +161 -0
  94. data/spec/lib/tcell_agent/policies/dataloss_policy_spec.rb +9 -9
  95. data/spec/lib/tcell_agent/policies/http_redirect_policy_spec.rb +243 -198
  96. data/spec/lib/tcell_agent/policies/js_agent_policy_spec.rb +75 -0
  97. data/spec/lib/tcell_agent/policies/login_policy_spec.rb +165 -33
  98. data/spec/lib/tcell_agent/policies/patches_policy_spec.rb +84 -277
  99. data/spec/lib/tcell_agent/policies/policies_manager_spec.rb +104 -0
  100. data/spec/lib/tcell_agent/policies/policy_polling_spec.rb +6 -0
  101. data/spec/lib/tcell_agent/policies/secure_headers_policy_spec.rb +56 -0
  102. data/spec/lib/tcell_agent/rails/csrf_exception_spec.rb +9 -18
  103. data/spec/lib/tcell_agent/rails/js_agent_insert_spec.rb +13 -30
  104. data/spec/lib/tcell_agent/rails/logger_spec.rb +27 -7
  105. data/spec/lib/tcell_agent/rails/middleware/tcell_body_proxy_spec.rb +17 -12
  106. data/spec/lib/tcell_agent/rails/routes/routes_spec.rb +14 -14
  107. data/spec/lib/tcell_agent/sensor_events/util/sanitizer_utilities_spec.rb +0 -35
  108. data/spec/lib/tcell_agent/settings_reporter_spec.rb +127 -153
  109. data/spec/spec_helper.rb +1 -1
  110. data/spec/support/builders.rb +104 -0
  111. data/spec/support/force_logger_mocking.rb +38 -0
  112. data/spec/support/resources/lfi_sample_file.txt +2 -0
  113. data/spec/support/static_agent_overrides.rb +0 -15
  114. metadata +63 -74
  115. data/lib/tcell_agent/agent/event_processor.rb +0 -326
  116. data/lib/tcell_agent/agent/fork_pipe_manager.rb +0 -113
  117. data/lib/tcell_agent/agent/policy_manager.rb +0 -219
  118. data/lib/tcell_agent/agent/policy_types.rb +0 -30
  119. data/lib/tcell_agent/api.rb +0 -91
  120. data/lib/tcell_agent/appsensor/injections_reporter.rb +0 -24
  121. data/lib/tcell_agent/config/child_process_events.rb +0 -8
  122. data/lib/tcell_agent/instrumentation/cmdi/backtick.rb +0 -10
  123. data/lib/tcell_agent/instrumentation/cmdi/exec.rb +0 -14
  124. data/lib/tcell_agent/instrumentation/cmdi/popen.rb +0 -28
  125. data/lib/tcell_agent/instrumentation/cmdi/spawn.rb +0 -11
  126. data/lib/tcell_agent/instrumentation/cmdi/system.rb +0 -11
  127. data/lib/tcell_agent/policies/http_tx_policy.rb +0 -60
  128. data/lib/tcell_agent/policies/login_fraud_policy.rb +0 -45
  129. data/lib/tcell_agent/policies/rust_policies.rb +0 -110
  130. data/lib/tcell_agent/rails.rb +0 -40
  131. data/lib/tcell_agent/rust/libtcellagent-1.3.2.dylib +0 -0
  132. data/lib/tcell_agent/rust/tcellagent-1.3.2.dll +0 -0
  133. data/lib/tcell_agent/rust/whisperer.rb +0 -308
  134. data/lib/tcell_agent/sensor_events/appsensor_event.rb +0 -52
  135. data/lib/tcell_agent/sensor_events/appsensor_meta_event.rb +0 -45
  136. data/lib/tcell_agent/sensor_events/command_injection.rb +0 -75
  137. data/lib/tcell_agent/sensor_events/honeytokens.rb +0 -16
  138. data/lib/tcell_agent/sensor_events/login_fraud.rb +0 -60
  139. data/lib/tcell_agent/sensor_events/metrics.rb +0 -123
  140. data/lib/tcell_agent/sensor_events/patches.rb +0 -21
  141. data/lib/tcell_agent/start_background_thread.rb +0 -55
  142. data/lib/tcell_agent/system_info.rb +0 -11
  143. data/lib/tcell_agent/utils/io.rb +0 -38
  144. data/lib/tcell_agent/utils/passwords.rb +0 -28
  145. data/lib/tcell_agent/utils/queue_with_timeout.rb +0 -142
  146. data/spec/lib/tcell_agent/agent/fork_pipe_manager_spec.rb +0 -100
  147. data/spec/lib/tcell_agent/agent/policy_manager_spec.rb +0 -535
  148. data/spec/lib/tcell_agent/agent/static_agent_spec.rb +0 -133
  149. data/spec/lib/tcell_agent/api/api_spec.rb +0 -39
  150. data/spec/lib/tcell_agent/appsensor/injections_reporter_spec.rb +0 -187
  151. data/spec/lib/tcell_agent/instrumentation_spec.rb +0 -225
  152. data/spec/lib/tcell_agent/policies/appsensor_policy_spec.rb +0 -517
  153. data/spec/lib/tcell_agent/policies/http_tx_policy_spec.rb +0 -22
  154. data/spec/lib/tcell_agent/rails/middleware/appsensor_middleware_spec.rb +0 -293
  155. data/spec/lib/tcell_agent/rails/middleware/dlp_middleware_spec.rb +0 -198
  156. data/spec/lib/tcell_agent/rails/middleware/global_middleware_spec.rb +0 -180
  157. data/spec/lib/tcell_agent/rails/middleware/redirect_middleware_spec.rb +0 -116
  158. data/spec/lib/tcell_agent/rust/models_spec.rb +0 -120
  159. data/spec/lib/tcell_agent/rust/whisperer_spec.rb +0 -704
  160. data/spec/lib/tcell_agent/sensor_events/appsensor_meta_event_spec.rb +0 -45
  161. data/spec/lib/tcell_agent/sensor_events/sessions_metric_spec.rb +0 -272
  162. data/spec/lib/tcell_agent/utils/bounded_queue_spec.rb +0 -52
  163. data/spec/lib/tcell_agent/utils/passwords_spec.rb +0 -143
@@ -6,8 +6,6 @@ module TCellAgent
6
6
  describe '.get_unknown_options' do
7
7
  context 'with an unknown tcell environment variable set' do
8
8
  it 'should return a message about the unknown variable' do
9
- orig_allow_uap = ENV.fetch('TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS', nil)
10
- orig_allow_uafp = ENV.fetch('TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS', nil)
11
9
  orig_allow_ap = ENV.fetch('TCELL_AGENT_ALLOW_PAYLOADS', nil)
12
10
  orig_demomode = ENV.fetch('TCELL_DEMOMODE', nil)
13
11
  orig_agent_home = ENV.fetch('TCELL_AGENT_HOME', nil)
@@ -22,8 +20,6 @@ module TCellAgent
22
20
  orig_password_hmac_key = ENV.fetch('TCELL_PASSWORD_HMAC_KEY', nil)
23
21
 
24
22
  ENV['TCELL_HACK'] = 'hack the system'
25
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS'] = 'valid'
26
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS'] = 'valid'
27
23
  ENV['TCELL_AGENT_ALLOW_PAYLOADS'] = 'valid'
28
24
  ENV['TCELL_DEMOMODE'] = 'valid'
29
25
  ENV['TCELL_AGENT_HOME'] = 'valid'
@@ -40,17 +36,7 @@ module TCellAgent
40
36
  messages = Validate.get_unknown_options(nil)
41
37
 
42
38
  ENV.delete 'TCELL_HACK'
43
- if orig_allow_uap
44
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS'] = orig_allow_uap
45
- else
46
- ENV.delete 'TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS'
47
- end
48
39
 
49
- if orig_allow_uafp
50
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS'] = orig_allow_uafp
51
- else
52
- ENV.delete 'TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS'
53
- end
54
40
  if orig_allow_ap
55
41
  ENV['TCELL_AGENT_ALLOW_PAYLOADS'] = orig_allow_ap
56
42
  else
@@ -150,8 +136,6 @@ module TCellAgent
150
136
  'js_agent_url' => 'js agent url',
151
137
  'max_csp_header_bytes' => 512,
152
138
  'event_batch_size_limit' => 50,
153
- 'allow_unencrypted_appsensor_payloads' => true,
154
- 'allow_unencrypted_appfirewall_payloads' => true,
155
139
  'allow_payloads' => true,
156
140
  'data_exposure' => {
157
141
  'data_ex_level' => 'boo',
@@ -164,12 +148,10 @@ module TCellAgent
164
148
  'disable_all' => false,
165
149
  'enabled' => true,
166
150
  'enable_event_manager' => true,
167
- 'enable_event_consumer' => true,
168
151
  'enable_policy_polling' => true,
169
152
  'enable_instrumentation' => true,
170
153
  'enable_intercept_requests' => true,
171
154
  'instrument_for_events' => true,
172
- 'agent_home_owner' => true,
173
155
  'enabled_instrumentations' => {
174
156
  'enabled_instrumentations_level' => 'blah',
175
157
  'doorkeeper' => true,
@@ -7,9 +7,6 @@ module TCellAgent
7
7
  it 'should set cache file, config, and log file to defaults' do
8
8
  configuration = Configuration.new
9
9
 
10
- expect(configuration.cache_filename_with_app_id).to match(
11
- %r{/tcell/cache/tcell_agent.cache}
12
- )
13
10
  expect(configuration.log_filename).to eq(
14
11
  File.join(Dir.getwd, 'tcell/logs/tcell_agent.log')
15
12
  )
@@ -27,9 +24,6 @@ module TCellAgent
27
24
 
28
25
  configuration = Configuration.new
29
26
 
30
- expect(configuration.cache_filename_with_app_id).to match(
31
- %r{spec_tcell_home/cache/tcell_agent.cache}
32
- )
33
27
  expect(configuration.log_filename).to eq(
34
28
  'spec_tcell_home/logs/tcell_agent.log'
35
29
  )
@@ -51,9 +45,6 @@ module TCellAgent
51
45
 
52
46
  configuration = Configuration.new
53
47
 
54
- expect(configuration.cache_filename_with_app_id).to match(
55
- %r{spec_tcell_home/cache/tcell_agent.cache}
56
- )
57
48
  expect(configuration.log_filename).to eq(
58
49
  'spec_tcell_log_dir/tcell_agent.log'
59
50
  )
@@ -78,9 +69,6 @@ module TCellAgent
78
69
 
79
70
  configuration = Configuration.new
80
71
 
81
- expect(configuration.cache_filename_with_app_id).to match(
82
- %r{spec_tcell_home/cache/tcell_agent.cache}
83
- )
84
72
  expect(configuration.log_filename).to eq(
85
73
  'spec_tcell_log_dir/tcell_agent.log'
86
74
  )
@@ -178,61 +166,9 @@ module TCellAgent
178
166
 
179
167
  describe '#allow_payloads' do
180
168
  context 'setting it via config' do
181
- context 'using allow_unencrypted_appsensor_payloads' do
182
- it 'should be false' do
183
- allow_unencrypted_appfirewall_payloads_enabled = double(
184
- 'no_data_ex',
185
- :read => {
186
- :version => 1,
187
- :applications => [
188
- :app_id => 'app_id',
189
- :api_key => 'api_key',
190
- :allow_unencrypted_appsensor_payloads => false
191
- ]
192
- }.to_json
193
- )
194
- expect(File).to receive(:file?).with(
195
- File.join(Dir.getwd, 'config/tcell_agent.config')
196
- ).and_return(true)
197
- expect(File).to receive(:open).with(
198
- File.join(Dir.getwd, 'config/tcell_agent.config')
199
- ).and_return(allow_unencrypted_appfirewall_payloads_enabled)
200
-
201
- configuration = Configuration.new
202
-
203
- expect(configuration.allow_payloads).to eq(false)
204
- end
205
- end
206
-
207
- context 'using allow_unencrypted_appfirewall_payloads' do
208
- it 'should be false' do
209
- allow_unencrypted_appfirewall_payloads_enabled = double(
210
- 'no_data_ex',
211
- :read => {
212
- :version => 1,
213
- :applications => [
214
- :app_id => 'app_id',
215
- :api_key => 'api_key',
216
- :allow_unencrypted_appfirewall_payloads => false
217
- ]
218
- }.to_json
219
- )
220
- expect(File).to receive(:file?).with(
221
- File.join(Dir.getwd, 'config/tcell_agent.config')
222
- ).and_return(true)
223
- expect(File).to receive(:open).with(
224
- File.join(Dir.getwd, 'config/tcell_agent.config')
225
- ).and_return(allow_unencrypted_appfirewall_payloads_enabled)
226
-
227
- configuration = Configuration.new
228
-
229
- expect(configuration.allow_payloads).to eq(false)
230
- end
231
- end
232
-
233
169
  context 'using allow_payloads' do
234
170
  it 'should be false' do
235
- allow_unencrypted_appfirewall_payloads_enabled = double(
171
+ allow_payloads_enabled = double(
236
172
  'no_data_ex',
237
173
  :read => {
238
174
  :version => 1,
@@ -248,7 +184,7 @@ module TCellAgent
248
184
  ).and_return(true)
249
185
  expect(File).to receive(:open).with(
250
186
  File.join(Dir.getwd, 'config/tcell_agent.config')
251
- ).and_return(allow_unencrypted_appfirewall_payloads_enabled)
187
+ ).and_return(allow_payloads_enabled)
252
188
 
253
189
  configuration = Configuration.new
254
190
 
@@ -258,89 +194,19 @@ module TCellAgent
258
194
  end
259
195
 
260
196
  context 'setting it via env var' do
261
- context 'TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS overrides config file' do
262
- it 'should be false' do
263
- old_allow_unencrypted_appsensor_payloads = ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS']
264
-
265
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS'] = 'false'
266
-
267
- allow_unencrypted_appfirewall_payloads_enabled = double(
268
- 'no_data_ex',
269
- :read => {
270
- :version => 1,
271
- :applications => [
272
- :app_id => 'app_id',
273
- :api_key => 'api_key',
274
- :allow_unencrypted_appsensor_payloads => true
275
- ]
276
- }.to_json
277
- )
278
- expect(File).to receive(:file?).with(
279
- File.join(Dir.getwd, 'config/tcell_agent.config')
280
- ).and_return(true)
281
- expect(File).to receive(:open).with(
282
- File.join(Dir.getwd, 'config/tcell_agent.config')
283
- ).and_return(allow_unencrypted_appfirewall_payloads_enabled)
284
-
285
- configuration = Configuration.new
286
-
287
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS'] = old_allow_unencrypted_appsensor_payloads
288
-
289
- expect(configuration.allow_payloads).to eq(false)
290
- end
291
- end
292
-
293
- context 'TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS overrides config file' do
294
- it 'should be false' do
295
- old_allow_unencrypted_appfirewall_payloads = ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS']
296
-
297
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS'] = 'false'
298
-
299
- allow_unencrypted_appfirewall_payloads_enabled = double(
300
- 'no_data_ex',
301
- :read => {
302
- :version => 1,
303
- :applications => [
304
- :app_id => 'app_id',
305
- :api_key => 'api_key',
306
- :allow_unencrypted_appfirewall_payloads => true
307
- ]
308
- }.to_json
309
- )
310
- expect(File).to receive(:file?).with(
311
- File.join(Dir.getwd, 'config/tcell_agent.config')
312
- ).and_return(true)
313
- expect(File).to receive(:open).with(
314
- File.join(Dir.getwd, 'config/tcell_agent.config')
315
- ).and_return(allow_unencrypted_appfirewall_payloads_enabled)
316
-
317
- configuration = Configuration.new
318
-
319
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS'] = old_allow_unencrypted_appfirewall_payloads
320
-
321
- expect(configuration.allow_payloads).to eq(false)
322
- end
323
- end
324
-
325
197
  context 'TCELL_AGENT_ALLOW_PAYLOADS overrides everything else' do
326
198
  it 'should be false' do
327
- old_allow_unencrypted_appsensor_payloads = ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS']
328
- old_allow_unencrypted_appfirewall_payloads = ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS']
329
199
  old_tcell_agent_allow_payloads = ENV['TCELL_AGENT_ALLOW_PAYLOADS']
330
200
 
331
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS'] = 'true'
332
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS'] = 'true'
333
201
  ENV['TCELL_AGENT_ALLOW_PAYLOADS'] = 'false'
334
202
 
335
- allow_unencrypted_appfirewall_payloads_enabled = double(
203
+ allow_payloads_enabled = double(
336
204
  'no_data_ex',
337
205
  :read => {
338
206
  :version => 1,
339
207
  :applications => [
340
208
  :app_id => 'app_id',
341
209
  :api_key => 'api_key',
342
- :allow_unencrypted_appsensor_payloads => true,
343
- :allow_unencrypted_appfirewall_payloads => true,
344
210
  :allow_payloads => true
345
211
  ]
346
212
  }.to_json
@@ -350,12 +216,10 @@ module TCellAgent
350
216
  ).and_return(true)
351
217
  expect(File).to receive(:open).with(
352
218
  File.join(Dir.getwd, 'config/tcell_agent.config')
353
- ).and_return(allow_unencrypted_appfirewall_payloads_enabled)
219
+ ).and_return(allow_payloads_enabled)
354
220
 
355
221
  configuration = Configuration.new
356
222
 
357
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS'] = old_allow_unencrypted_appsensor_payloads
358
- ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS'] = old_allow_unencrypted_appfirewall_payloads
359
223
  ENV['TCELL_AGENT_ALLOW_PAYLOADS'] = old_tcell_agent_allow_payloads
360
224
 
361
225
  expect(configuration.allow_payloads).to eq(false)
@@ -26,56 +26,30 @@ module TCellAgent
26
26
 
27
27
  describe 'manually requiring auth hooks' do
28
28
  before(:all) do
29
- require 'tcell_agent/hooks/login_fraud'
29
+ load 'lib/tcell_agent/hooks/login_fraud.rb'
30
+ load 'spec/support/force_logger_mocking.rb'
30
31
  end
31
32
 
32
33
  describe 'Using generic interface' do
33
34
  context 'with a login failure' do
34
35
  context 'with login_failed_enabled set to true' do
35
36
  it 'should report the login failure' do
36
- login_fraud = double('login_fraud', :enabled => true, :login_failed_enabled => true)
37
-
38
- expect(TCellAgent).to receive(:policy).with(TCellAgent::PolicyTypes::LOGINFRAUD).and_return(
39
- login_fraud
40
- )
41
- expect(TCellAgent).to receive(:send_event).with(
42
- {
43
- 'event_type' => 'login',
44
- 'header_keys' => %w[USER_AGENT X_FORWARDED_FOR],
45
- 'user_agent' => 'user_agent',
46
- 'referrer' => 'http://tcell.tcell.io/?utm_campaign=',
47
- 'remote_addr' => '1.1.1.1',
48
- 'user_id' => 'user_id',
49
- 'document_uri' => 'http://tcell.tcell.io/login?param_name=',
50
- 'session' => '48c0ce7961d8d5d4bd57bd77976b3d38',
51
- 'event_name' => 'login-failure'
52
- }
53
- )
54
-
37
+ login_fraud = double('login_fraud', :login_failed_enabled => true)
55
38
  status = Hooks::V1::Login::LOGIN_FAILURE
56
39
  header_keys = %w[HTTP_USER_AGENT HTTP_X_FORWARDED_FOR]
57
40
  document_uri = 'http://tcell.tcell.io/login?param_name=param_value'
58
41
  referrer = 'http://tcell.tcell.io/?utm_campaign=some-source'
59
42
 
60
- Hooks::V1::Login.register_login_event(
61
- status, 'session_id', 'user_agent', referrer, '1.1.1.1', header_keys, 'user_id', document_uri
62
- )
63
- end
64
- end
65
-
66
- context 'with login_failed_enabled set to false' do
67
- it 'should NOT report the login failure' do
68
- login_fraud = double('login_fraud', :enabled => true, :login_failed_enabled => false)
69
-
70
- expect(TCellAgent).to receive(:policy).with(TCellAgent::PolicyTypes::LOGINFRAUD).and_return(
71
- login_fraud
43
+ expect(TCellAgent).to receive(:policy).with(
44
+ TCellAgent::PolicyTypes::LOGINFRAUD
45
+ ).and_return(login_fraud)
46
+ expect(login_fraud).to receive(:report_login_failure).with(
47
+ 'user_id',
48
+ nil,
49
+ header_keys,
50
+ nil,
51
+ anything
72
52
  )
73
- expect(TCellAgent).to_not receive(:send_event)
74
-
75
- status = Hooks::V1::Login::LOGIN_FAILURE
76
- header_keys = %w[HTTP_USER_AGENT HTTP_X_FORWARDED_FOR]
77
- document_uri = 'http://tcell.tcell.io/login?param_name=param_value'
78
- referrer = 'http://tcell.tcell.io/?utm_campaign=some-source'
79
53
 
80
54
  Hooks::V1::Login.register_login_event(
81
55
  status, 'session_id', 'user_agent', referrer, '1.1.1.1', header_keys, 'user_id', document_uri
@@ -87,49 +61,20 @@ module TCellAgent
87
61
  context 'with a login success' do
88
62
  context 'with login_success_enabled set to true' do
89
63
  it 'should report the login success' do
90
- login_fraud = double('login_fraud', :enabled => true, :login_success_enabled => true)
91
-
92
- expect(TCellAgent).to receive(:policy).with(TCellAgent::PolicyTypes::LOGINFRAUD).and_return(
93
- login_fraud
94
- )
95
- expect(TCellAgent).to receive(:send_event).with(
96
- {
97
- 'event_type' => 'login',
98
- 'header_keys' => %w[USER_AGENT X_FORWARDED_FOR],
99
- 'user_agent' => 'user_agent',
100
- 'referrer' => 'http://tcell.tcell.io/?utm_campaign=',
101
- 'remote_addr' => '1.1.1.1',
102
- 'user_id' => 'user_id',
103
- 'document_uri' => 'http://tcell.tcell.io/login?param_name=',
104
- 'session' => '48c0ce7961d8d5d4bd57bd77976b3d38',
105
- 'event_name' => 'login-success'
106
- }
107
- )
108
-
64
+ login_fraud = double('login_fraud', :login_success_enabled => true)
109
65
  status = Hooks::V1::Login::LOGIN_SUCCESS
110
66
  header_keys = %w[HTTP_USER_AGENT HTTP_X_FORWARDED_FOR]
111
67
  document_uri = 'http://tcell.tcell.io/login?param_name=param_value'
112
68
  referrer = 'http://tcell.tcell.io/?utm_campaign=some-source'
113
69
 
114
- Hooks::V1::Login.register_login_event(
115
- status, 'session_id', 'user_agent', referrer, '1.1.1.1', header_keys, 'user_id', document_uri
116
- )
117
- end
118
- end
119
-
120
- context 'with login_success_enabled set to false' do
121
- it 'should NOT report the login success' do
122
- login_fraud = double('login_fraud', :enabled => true, :login_success_enabled => false)
123
-
124
70
  expect(TCellAgent).to receive(:policy).with(TCellAgent::PolicyTypes::LOGINFRAUD).and_return(
125
71
  login_fraud
126
72
  )
127
- expect(TCellAgent).to_not receive(:send_event)
128
-
129
- status = Hooks::V1::Login::LOGIN_SUCCESS
130
- header_keys = %w[HTTP_USER_AGENT HTTP_X_FORWARDED_FOR]
131
- document_uri = 'http://tcell.tcell.io/login?param_name=param_value'
132
- referrer = 'http://tcell.tcell.io/?utm_campaign=some-source'
73
+ expect(login_fraud).to receive(:report_login_success).with(
74
+ 'user_id',
75
+ header_keys,
76
+ anything
77
+ )
133
78
 
134
79
  Hooks::V1::Login.register_login_event(
135
80
  status, 'session_id', 'user_agent', referrer, '1.1.1.1', header_keys, 'user_id', document_uri
@@ -140,15 +85,17 @@ module TCellAgent
140
85
 
141
86
  context 'with an unknown status' do
142
87
  it 'should log the error' do
143
- login_fraud = double('login_fraud', :enabled => true)
88
+ login_fraud = double('login_fraud')
144
89
  logger = double('logger')
145
90
 
146
- expect(TCellAgent).to receive(:policy).with(TCellAgent::PolicyTypes::LOGINFRAUD).and_return(
147
- login_fraud
148
- )
91
+ expect(TCellAgent).to receive(:policy).with(
92
+ TCellAgent::PolicyTypes::LOGINFRAUD
93
+ ).and_return(login_fraud)
149
94
  expect(TCellAgent).to_not receive(:send_event)
150
- expect(TCellAgent).to receive(:logger).and_return(logger)
151
- expect(logger).to receive(:error).with('Unkown login status: mumbo-jumbo')
95
+ expect(TCellAgent::Hooks::LoginFraud).to receive(:get_logger).and_return(logger)
96
+ expect(logger).to receive(:error).with(
97
+ 'Unkown login status: mumbo-jumbo'
98
+ )
152
99
 
153
100
  status = 'mumbo-jumbo'
154
101
  header_keys = %w[HTTP_USER_AGENT HTTP_X_FORWARDED_FOR]
@@ -166,12 +113,12 @@ module TCellAgent
166
113
  context 'with a login failure' do
167
114
  context 'with login_failed_enabled set to true' do
168
115
  it 'should report the login failure' do
169
- login_fraud = double('login_fraud', :enabled => true, :login_failed_enabled => true)
116
+ login_fraud = double('login_fraud', :login_failed_enabled => true)
170
117
  rails_request = double('rails_request')
171
118
  tcell_data = TCellAgent::Instrumentation::TCellData.new
172
119
  tcell_data.user_agent = 'user_agent'
173
120
  tcell_data.referrer = 'http://tcell.tcell.io/?utm_campaign=some-source'
174
- tcell_data.ip_address = '1.1.1.1'
121
+ tcell_data.remote_address = '1.1.1.1'
175
122
  tcell_data.path = 'http://tcell.tcell.io/login?param_name=param_value'
176
123
  tcell_data.hmac_session_id = TCellAgent::SensorEvents::Util.hmac('session_id')
177
124
  request_env = {
@@ -185,18 +132,12 @@ module TCellAgent
185
132
  )
186
133
  expect(rails_request).to receive(:env).and_return(request_env)
187
134
  expect(rails_request).to receive(:env).and_return(request_env)
188
- expect(TCellAgent).to receive(:send_event).with(
189
- {
190
- 'event_type' => 'login',
191
- 'header_keys' => %w[USER_AGENT X_FORWARDED_FOR],
192
- 'user_agent' => 'user_agent',
193
- 'referrer' => 'http://tcell.tcell.io/?utm_campaign=',
194
- 'remote_addr' => '1.1.1.1',
195
- 'user_id' => 'user_id',
196
- 'document_uri' => 'http://tcell.tcell.io/login?param_name=',
197
- 'session' => '48c0ce7961d8d5d4bd57bd77976b3d38',
198
- 'event_name' => 'login-failure'
199
- }
135
+ expect(login_fraud).to receive(:report_login_failure).with(
136
+ 'user_id',
137
+ nil,
138
+ request_env,
139
+ nil,
140
+ anything
200
141
  )
201
142
 
202
143
  status = Hooks::V1::Login::LOGIN_FAILURE
@@ -206,48 +147,17 @@ module TCellAgent
206
147
  )
207
148
  end
208
149
  end
209
-
210
- context 'with login_failed_enabled set to false' do
211
- it 'should NOT report the login failure' do
212
- login_fraud = double('login_fraud', :enabled => true, :login_failed_enabled => false)
213
- rails_request = double('rails_request')
214
- tcell_data = TCellAgent::Instrumentation::TCellData.new
215
- tcell_data.user_agent = 'user_agent'
216
- tcell_data.referrer = 'http://tcell.tcell.io/?utm_campaign='
217
- tcell_data.ip_address = '1.1.1.1'
218
- tcell_data.path = 'http://tcell.tcell.io/login?param_name=param_value'
219
- tcell_data.hmac_session_id = TCellAgent::SensorEvents::Util.hmac('session_id')
220
- request_env = {
221
- TCellAgent::Instrumentation::TCELL_ID => tcell_data,
222
- 'HTTP_USER_AGENT' => true,
223
- 'HTTP_X_FORWARDED_FOR' => true
224
- }
225
-
226
- expect(TCellAgent).to receive(:policy).with(TCellAgent::PolicyTypes::LOGINFRAUD).and_return(
227
- login_fraud
228
- )
229
- expect(rails_request).to receive(:env).and_return(request_env)
230
- expect(rails_request).to receive(:env).and_return(request_env)
231
- expect(TCellAgent).to_not receive(:send_event)
232
-
233
- status = Hooks::V1::Login::LOGIN_FAILURE
234
-
235
- Hooks::V1::Frameworks::Rails::Login.register_login_event(
236
- status, rails_request, 'user_id'
237
- )
238
- end
239
- end
240
150
  end
241
151
 
242
152
  context 'with a login success' do
243
153
  context 'with login_success_enabled set to true' do
244
154
  it 'should report the login success' do
245
- login_fraud = double('login_fraud', :enabled => true, :login_success_enabled => true)
155
+ login_fraud = double('login_fraud', :login_success_enabled => true)
246
156
  rails_request = double('rails_request')
247
157
  tcell_data = TCellAgent::Instrumentation::TCellData.new
248
158
  tcell_data.user_agent = 'user_agent'
249
159
  tcell_data.referrer = 'http://tcell.tcell.io/?utm_campaign=some-source'
250
- tcell_data.ip_address = '1.1.1.1'
160
+ tcell_data.remote_address = '1.1.1.1'
251
161
  tcell_data.path = 'http://tcell.tcell.io/login?param_name=param_value'
252
162
  tcell_data.hmac_session_id = TCellAgent::SensorEvents::Util.hmac('session_id')
253
163
  request_env = {
@@ -261,18 +171,10 @@ module TCellAgent
261
171
  )
262
172
  expect(rails_request).to receive(:env).and_return(request_env)
263
173
  expect(rails_request).to receive(:env).and_return(request_env)
264
- expect(TCellAgent).to receive(:send_event).with(
265
- {
266
- 'event_type' => 'login',
267
- 'header_keys' => %w[USER_AGENT X_FORWARDED_FOR],
268
- 'user_agent' => 'user_agent',
269
- 'referrer' => 'http://tcell.tcell.io/?utm_campaign=',
270
- 'remote_addr' => '1.1.1.1',
271
- 'user_id' => 'user_id',
272
- 'document_uri' => 'http://tcell.tcell.io/login?param_name=',
273
- 'session' => '48c0ce7961d8d5d4bd57bd77976b3d38',
274
- 'event_name' => 'login-success'
275
- }
174
+ expect(login_fraud).to receive(:report_login_success).with(
175
+ 'user_id',
176
+ request_env,
177
+ anything
276
178
  )
277
179
 
278
180
  status = Hooks::V1::Login::LOGIN_SUCCESS
@@ -282,48 +184,17 @@ module TCellAgent
282
184
  )
283
185
  end
284
186
  end
285
-
286
- context 'with login_success_enabled set to false' do
287
- it 'should NOT report the login success' do
288
- login_fraud = double('login_fraud', :enabled => true, :login_success_enabled => false)
289
- rails_request = double('rails_request')
290
- tcell_data = TCellAgent::Instrumentation::TCellData.new
291
- tcell_data.user_agent = 'user_agent'
292
- tcell_data.referrer = 'http://tcell.tcell.io/?utm_campaign=some-source'
293
- tcell_data.ip_address = '1.1.1.1'
294
- tcell_data.path = 'http://tcell.tcell.io/login?param_name=param_value'
295
- tcell_data.hmac_session_id = TCellAgent::SensorEvents::Util.hmac('session_id')
296
- request_env = {
297
- TCellAgent::Instrumentation::TCELL_ID => tcell_data,
298
- 'HTTP_USER_AGENT' => true,
299
- 'HTTP_X_FORWARDED_FOR' => true
300
- }
301
-
302
- expect(TCellAgent).to receive(:policy).with(TCellAgent::PolicyTypes::LOGINFRAUD).and_return(
303
- login_fraud
304
- )
305
- expect(rails_request).to receive(:env).and_return(request_env)
306
- expect(rails_request).to receive(:env).and_return(request_env)
307
- expect(TCellAgent).to_not receive(:send_event)
308
-
309
- status = Hooks::V1::Login::LOGIN_SUCCESS
310
-
311
- Hooks::V1::Frameworks::Rails::Login.register_login_event(
312
- status, rails_request, 'user_id'
313
- )
314
- end
315
- end
316
187
  end
317
188
 
318
189
  context 'with an unknown status' do
319
190
  it 'should log the error' do
320
- login_fraud = double('login_fraud', :enabled => true, :login_failed_enabled => true)
191
+ login_fraud = double('login_fraud', :login_failed_enabled => true)
321
192
  logger = double('logger')
322
193
  rails_request = double('rails_request')
323
194
  tcell_data = TCellAgent::Instrumentation::TCellData.new
324
195
  tcell_data.user_agent = 'user_agent'
325
196
  tcell_data.referrer = 'http://tcell.tcell.io/?utm_campaign=some-source'
326
- tcell_data.ip_address = '1.1.1.1'
197
+ tcell_data.remote_address = '1.1.1.1'
327
198
  tcell_data.path = 'http://tcell.tcell.io/login?param_name=param_value'
328
199
  tcell_data.hmac_session_id = TCellAgent::SensorEvents::Util.hmac('session_id')
329
200
  request_env = {
@@ -338,8 +209,10 @@ module TCellAgent
338
209
  expect(rails_request).to receive(:env).and_return(request_env)
339
210
  expect(rails_request).to receive(:env).and_return(request_env)
340
211
  expect(TCellAgent).to_not receive(:send_event)
341
- expect(TCellAgent).to receive(:logger).and_return(logger)
342
- expect(logger).to receive(:error).with('Unkown login status: mumbo-jumbo')
212
+ expect(TCellAgent::Hooks::LoginFraud).to receive(:get_logger).and_return(logger)
213
+ expect(logger).to receive(:error).with(
214
+ 'Unkown login status: mumbo-jumbo'
215
+ )
343
216
 
344
217
  status = 'mumbo-jumbo'
345
218