tcell_agent 1.1.12 → 2.0.0

data/spec/lib/tcell_agent/policies/appfirewall_policy_spec.rb

@@ -0,0 +1,183 @@
+require 'spec_helper'
+
+module TCellAgent
+  module Policies
+    describe AppfirewallPolicy do
+      everything_enabled_policy_json = {
+        'appsensor' => {
+          'policy_id' => '01a1',
+          'version' => 2,
+          'data' => {
+            'options' => {
+              'uri_options' => {
+                'collect_full_uri' => true
+              },
+              'payloads' => {
+                'send_payloads' => true,
+                'send_blacklist' => {
+                  'ssn' => ['*'],
+                  'password' => ['*']
+                },
+                'send_whitelist' => {},
+                'log_payloads' => true,
+                'log_blacklist' => {},
+                'log_whitelist' => {
+                  'username' => ['*']
+                }
+              }
+            },
+            'sensors' => {
+              'req_size' => {
+                'limit' => 1024,
+                'exclude_routes' => ['2300']
+              },
+              'resp_size' => {
+                'limit' => 2048,
+                'exclude_routes' => ['2323']
+              },
+              'resp_codes' => {
+                'series_400_enabled' => true,
+                'series_500_enabled' => true
+              },
+              'xss' => {
+                'libinjection' => true,
+                'patterns' => %w[1 2 8],
+                'exclusions' => {
+                  'bob' => ['*']
+                }
+              },
+              'sqli' => {
+                'libinjection' => true,
+                'exclude_headers' => true,
+                'patterns' => ['1']
+              },
+              'fpt' => {
+                'patterns' => %w[1 2],
+                'exclude_forms' => true,
+                'exclude_cookies' => true,
+                'exclusions' => {
+                  'somethingcommon' => ['form']
+                }
+              },
+              'cmdi' => {
+                'patterns' => %w[1 2]
+              },
+              'nullbyte' => {
+                'patterns' => %w[1 2]
+              },
+              'retr' => {
+                'patterns' => %w[1 2]
+              },
+              'ua' => {
+                'empty_enabled' => true
+              },
+              'errors' => {
+                'csrf_exception_enabled' => true,
+                'sql_exception_enabled' => true
+              },
+              'database' => {
+                'large_result' => {
+                  'limit' => 10
+                }
+              }
+            }
+          }
+        },
+        'regex' => {
+          'data' => {
+            'patterns' => [
+              {
+                'id' => 'tc-xss-1',
+                'pattern' => '(?:<(script))',
+                'sensor' => 'xss',
+                'title' => 'Basic Injection'
+              },
+              {
+                'safe_pattern' => '^[a-zA-Z0-9_\\s\\r\\n\\t]*$',
+                'pattern' => '(?:[\\s()]case\\s*\\()|(?:\\)\\s*like\\s*\\()|(?:having\\s*[^\\s]+\\s*[^\\w\\s])|(?:if\\s?\\([\\d\\w]\\s*[=<>~])',
+                'sensor' => 'sqli',
+                'id' => 'tc-sqli-1',
+                'title' => 'Conditional Attempts'
+              }
+            ],
+            'version' => 1_518_546_622_571
+          },
+          'policy_id' => 'f3a313b0-10eb-11e8-8080-808080808080',
+          'version' => 1
+        }
+      }
+
+      describe '#initialize' do
+        context 'empty enablements' do
+          it 'should disable the policy' do
+            native_agent = double('native_agent')
+            policy = AppfirewallPolicy.new(native_agent, {})
+            expect(policy.enabled).to eq(false)
+          end
+        end
+      end
+
+      describe '#check_appfirewall_injections' do
+        context 'with disabled policy' do
+          it 'should not call the native library' do
+            native_agent = double('native_agent')
+            policy = AppfirewallPolicy.new(native_agent, {})
+
+            expect(native_agent).to_not receive(:apply_appfirewall)
+
+            appsensor_meta = double('appsensor_meta')
+            policy.check_appfirewall_injections(appsensor_meta)
+          end
+        end
+
+        context 'with enabled policy' do
+          before(:each) do
+            configuration = TCellAgent::Tests::ConfigurationBuilder.new.build
+            @native_agent = TCellAgent::Rust::NativeAgent.create_agent(
+              configuration
+            )
+            enablements = @native_agent.update_policies(
+              everything_enabled_policy_json
+            )['enablements']
+            expect(enablements['appfirewall']).to eq(true)
+
+            @policy = AppfirewallPolicy.new(@native_agent, enablements)
+            expect(@policy.enabled).to eq(true)
+          end
+
+          after(:each) do
+            TCellAgent::Rust::NativeAgent.free_agent(@native_agent.agent_ptr)
+          end
+
+          it 'should be able to call native library' do
+            meta_data = TCellAgent::Tests::MetaDataBuilder.new.build
+            resp = @policy.check_appfirewall_injections(meta_data)
+            expect(resp).to eq({})
+          end
+
+          context 'exception raised in native_agent' do
+            it 'should log the exception' do
+              expected_error = StandardError.new('UNEXPECTED')
+              logger = double('logger')
+              expect(TCellAgent::Instrumentation).to receive(:get_safe_block_logger).and_return(logger)
+              expect(logger).to receive(:error).with(
+                'Error AppFirewall inspection (StandardError): UNEXPECTED'
+              )
+              expect(logger).to receive(:exception).with(
+                expected_error
+              )
+
+              meta_data = TCellAgent::Tests::MetaDataBuilder.new.build
+              expect(@native_agent).to receive(:apply_appfirewall).with(
+                meta_data
+              ).and_raise(expected_error)
+
+              resp = @policy.check_appfirewall_injections(meta_data)
+              expect(resp).to eq(nil)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/spec/lib/tcell_agent/policies/clickjacking_policy_spec.rb

@@ -0,0 +1,57 @@
+
+require 'spec_helper'
+
+module TCellAgent
+  module Policies
+    describe HeadersPolicy do
+      describe '#get_headers' do
+        context 'with enabled policy' do
+          before(:each) do
+            configuration = TCellAgent::Tests::ConfigurationBuilder.new.build
+            @native_agent = TCellAgent::Rust::NativeAgent.create_agent(
+              configuration
+            )
+            @tcell_context = TCellAgent::Tests::TCellContextBuilder.new.update_attribute(
+              'session_id', 'session-id'
+            ).update_attribute(
+              'route_id', 'route-id'
+            ).build
+          end
+
+          after(:each) do
+            TCellAgent::Rust::NativeAgent.free_agent(@native_agent.agent_ptr)
+          end
+
+          it 'should return csp header' do
+            enablements = @native_agent.update_policies(
+              {
+                'clickjacking' => {
+                  'version' => 1,
+                  'policy_id' => 'xyzd',
+                  'headers' => [
+                    {
+                      'name' => 'Content-Security-Policy',
+                      'value' => "frame-ancestors 'none'",
+                      'report_uri' => 'https://input.tcell-preview.io/csp/430d'
+                    }
+                  ]
+                }
+              }
+            )['enablements']
+            expect(enablements['headers']).to eq(true)
+
+            @policy = HeadersPolicy.new(@native_agent, enablements)
+            expect(@policy.enabled).to eq(true)
+
+            expect(
+              @policy.get_headers(@tcell_context)
+            ).to eq(
+              [{ 'name' => 'Content-Security-Policy',
+                 'value' => "frame-ancestors 'none'; report-uri https://input.tcell-preview.io/csp/430d?sid=ab7074d0bf86c2884766d88b6ad9de4a&rid=route-id" }]
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/spec/lib/tcell_agent/policies/command_injection_policy_spec.rb

@@ -2,872 +2,183 @@ require 'spec_helper'
 
 module TCellAgent
   module Policies
-    describe RustPolicies do
-      before(:each) do
-        configuration = double(
-          'configuration',
-          {
-            'app_id' => 'app_id',
-            'api_key' => 'api_key',
-            'allow_payloads' => true,
-            'js_agent_api_base_url' => 'http://api.tcell.com/',
-            'js_agent_url' => 'https://jsagent.tcell.io/tcellagent.min.js',
-            'max_csp_header_bytes' => nil
-          }
-        )
-        expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
-        allow(TCellAgent).to receive(:safe_to_send_cmdi_events?).and_return(true)
-        @rust_policies = RustPolicies.new
-      end
-
-      describe '#update_policies' do
-        context 'with a nil policy' do
-          it 'should return nil' do
-            expect(TCellAgent).to_not receive(:logger)
-
-            @rust_policies.update_policies(nil)
-
-            expect(@rust_policies.cmdi_enabled).to eq(false)
-          end
-        end
-
-        context 'with an empty policy' do
-          it 'should raise a policy missing error' do
-            expect(TCellAgent).to_not receive(:logger)
-            @rust_policies.update_policies({})
-
-            expect(@rust_policies.cmdi_enabled).to eq(false)
-          end
-        end
-
-        context 'with an empty version' do
-          it 'should have empty version' do
-            logger = double('logger')
-
-            expect(TCellAgent).to receive(:logger).and_return(logger)
-            expect(logger).to receive(:error).with(
-              'Error updating policies: Failed to decode cmdi policy: missing field `version`'
-            )
-            @rust_policies.update_policies(
-              {
-                'cmdi' => { 'policy_id' => 'policy_id' }
-              }
-            )
-
-            expect(@rust_policies.cmdi_enabled).to eq(false)
-          end
-        end
-
-        context 'with no data' do
-          it 'should have disabled ip blocking' do
-            expect(TCellAgent).to_not receive(:logger)
-
-            @rust_policies.update_policies(
-              {
-                'cmdi' => {
-                  'policy_id' => 'policy_id',
-                  'version' => 1
-                }
-              }
-            )
-            expect(@rust_policies.cmdi_enabled).to eq(false)
+    describe CommandInjectionPolicy do
+      describe '#initialize' do
+        context 'empty enablements' do
+          it 'should disable the policy' do
+            native_agent = double('native_agent')
+            policy = CommandInjectionPolicy.new(native_agent, {})
+            expect(policy.enabled).to eq(false)
           end
         end
+      end
 
-        context 'with empty data' do
-          it 'should have default values' do
-            expect(TCellAgent).to_not receive(:logger)
-            @rust_policies.update_policies(
-              {
-                'cmdi' => {
-                  'policy_id' => 'policy_id',
-                  'version' => 1,
-                  'data' => {}
-                }
-              }
-            )
-            expect(@rust_policies.cmdi_enabled).to eq(false)
-          end
-        end
+      describe '#block_command?' do
+        context 'with disabled policy' do
+          it 'should not call the native library' do
+            native_agent = double('native_agent')
+            policy = CommandInjectionPolicy.new(native_agent, {})
 
-        context 'with empty command rules' do
-          it 'should have default values' do
-            expect(TCellAgent).to_not receive(:logger)
-            @rust_policies.update_policies(
-              {
-                'cmdi' => {
-                  'policy_id' => 'policy_id',
-                  'version' => 1,
-                  'data' => {
-                    'command_rules' => []
-                  }
-                }
-              }
-            )
-            expect(@rust_policies.cmdi_enabled).to eq(false)
-          end
-        end
+            expect(native_agent).to_not receive(:apply_cmdi)
 
-        context 'with empty compount statement rules' do
-          it 'should have default values' do
-            expect(TCellAgent).to_not receive(:logger)
-            @rust_policies.update_policies(
-              {
-                'cmdi' => {
-                  'policy_id' => 'policy_id',
-                  'version' => 1,
-                  'data' => {
-                    'compound_statement_rules' => []
-                  }
-                }
-              }
-            )
-            expect(@rust_policies.cmdi_enabled).to eq(false)
+            tcell_context = double('tcell_context')
+            expect(
+              policy.block_command?('cat /etc/passwd && grep root', tcell_context)
+            ).to eq(false)
           end
         end
 
-        context 'with populated command rules' do
-          it 'should have default values' do
-            expect(TCellAgent).to_not receive(:logger)
-            @rust_policies.update_policies(
-              {
-                'cmdi' => {
-                  'policy_id' => 'policy_id',
-                  'version' => 1,
-                  'data' => {
-                    'command_rules' => [
-                      { 'rule_id' => '1', 'action' => 'block' },
-                      { 'rule_id' => '2', 'command' => 'nc', 'action' => 'ignore' }
-                    ]
-                  }
-                }
-              }
+        context 'with policies' do
+          before(:each) do
+            configuration = TCellAgent::Tests::ConfigurationBuilder.new.build
+            @native_agent = TCellAgent::Rust::NativeAgent.create_agent(
+              configuration
             )
-
-            expect(@rust_policies.cmdi_enabled).to eq(true)
+            @tcell_context = TCellAgent::Tests::TCellContextBuilder.new.build
           end
-        end
 
-        context 'with populated compound statement rules' do
-          it 'should have default values' do
-            expect(TCellAgent).to_not receive(:logger)
-            @rust_policies.update_policies(
-              {
-                'cmdi' => {
-                  'policy_id' => 'policy_id',
-                  'version' => 1,
-                  'data' => {
-                    'compound_statement_rules' => [
-                      { 'rule_id' => '3', 'action' => 'block' }
-                    ]
-                  }
-                }
-              }
-            )
-
-            expect(@rust_policies.cmdi_enabled).to eq(true)
+          after(:each) do
+            TCellAgent::Rust::NativeAgent.free_agent(@native_agent.agent_ptr)
           end
-        end
 
-        context 'with populated collect_full_commandline' do
-          context 'as nil' do
-            it 'should have collect_full_commandline disabled' do
-              expect(TCellAgent).to_not receive(:logger)
-              @rust_policies.update_policies(
+          context 'empty command rules policy' do
+            it 'should disable policy' do
+              enablements = @native_agent.update_policies(
                 {
                   'cmdi' => {
                     'policy_id' => 'policy_id',
                     'version' => 1,
-                    'data' => {
-                      'collect_full_commandline' => nil,
-                      'compound_statement_rules' => [
-                        { 'rule_id' => '3', 'action' => 'block' }
-                      ]
-                    }
+                    'data' => { 'command_rules' => [] }
                   }
                 }
-              )
+              )['enablements']
+              expect(enablements['cmdi']).to eq(false)
 
-              expect(@rust_policies.cmdi_enabled).to eq(true)
+              @policy = CommandInjectionPolicy.new(@native_agent, enablements)
+              expect(@policy.enabled).to eq(false)
             end
           end
 
-          context 'as false' do
-            it 'should have collect_full_commandline disabled' do
-              @rust_policies.update_policies(
+          context 'ignore all command rules' do
+            it 'should disable policy' do
+              enablements = @native_agent.update_policies(
                 {
                   'cmdi' => {
                     'policy_id' => 'policy_id',
                     'version' => 1,
                     'data' => {
-                      'collect_full_commandline' => false,
-                      'compound_statement_rules' => [
-                        { 'rule_id' => '3', 'action' => 'block' }
-                      ]
-                    }
-                  }
-                }
-              )
-
-              expect(@rust_policies.cmdi_enabled).to eq(true)
-            end
-          end
-
-          context 'as true' do
-            it 'should have collect_full_commandline enabled' do
-              @rust_policies.update_policies(
-                {
-                  'cmdi' => {
-                    'policy_id' => 'policy_id',
-                    'version' => 1,
-                    'data' => {
-                      'collect_full_commandline' => true,
-                      'compound_statement_rules' => [
-                        { 'rule_id' => '3', 'action' => 'block' }
-                      ]
+                      'command_rules' => [{ 'rule_id' => '1', 'action' => 'ignore' }]
                     }
                   }
                 }
-              )
+              )['enablements']
+              expect(enablements['cmdi']).to eq(false)
 
-              expect(@rust_policies.cmdi_enabled).to eq(true)
+              @policy = CommandInjectionPolicy.new(@native_agent, enablements)
+              expect(@policy.enabled).to eq(false)
             end
           end
-        end
-      end
 
-      describe '#block_command?' do
-        context 'with command rules' do
-          context 'that are blank' do
-            it 'should not block' do
-              @rust_policies.update_policies(
+          context 'report all command rules' do
+            it 'should enable the policy but not block command' do
+              enablements = @native_agent.update_policies(
                 {
                   'cmdi' => {
                     'policy_id' => 'policy_id',
                     'version' => 1,
                     'data' => {
                       'collect_full_commandline' => true,
-                      'command_rules' => []
+                      'command_rules' => [{ 'rule_id' => '1', 'action' => 'report' }]
                     }
                   }
                 }
-              )
-
-              expect(TCellAgent).to_not receive(:send_event)
+              )['enablements']
+              expect(enablements['cmdi']).to eq(true)
 
+              @policy = CommandInjectionPolicy.new(@native_agent, enablements)
+              expect(@policy.enabled).to eq(true)
               expect(
-                @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
+                @policy.block_command?('cat /etc/passwd && grep root', @tcell_context)
               ).to eq(false)
             end
           end
 
-          context 'that ignore all' do
-            it 'should not block' do
-              @rust_policies.update_policies(
+          context 'block all command rules' do
+            it 'should block the command' do
+              enablements = @native_agent.update_policies(
                 {
                   'cmdi' => {
                     'policy_id' => 'policy_id',
                     'version' => 1,
                     'data' => {
                       'collect_full_commandline' => true,
-                      'command_rules' => [{ 'rule_id' => '1', 'action' => 'ignore' }]
+                      'command_rules' => [{ 'rule_id' => '1', 'action' => 'block' }]
                     }
                   }
                 }
-              )
-
-              expect(TCellAgent).to_not receive(:send_event)
+              )['enablements']
+              expect(enablements['cmdi']).to eq(true)
 
+              @policy = CommandInjectionPolicy.new(@native_agent, enablements)
+              expect(@policy.enabled).to eq(true)
               expect(
-                @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
-              ).to eq(false)
-            end
-
-            context 'and ignore cat' do
-              it 'should not send an event' do
-                @rust_policies.update_policies(
-                  {
-                    'cmdi' => {
-                      'policy_id' => 'policy_id',
-                      'version' => 1,
-                      'data' => {
-                        'collect_full_commandline' => true,
-                        'command_rules' => [
-                          { 'rule_id' => '1', 'action' => 'ignore' },
-                          { 'rule_id' => '2', 'action' => 'ignore', 'command' => 'cat' }
-                        ]
-                      }
-                    }
-                  }
-                )
-
-                expect(TCellAgent).to_not receive(:send_event)
-
-                expect(
-                  @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
-                ).to eq(false)
-              end
-            end
-
-            context 'and report cat' do
-              it 'should send an event' do
-                @rust_policies.update_policies(
-                  {
-                    'cmdi' => {
-                      'policy_id' => 'policy_id',
-                      'version' => 1,
-                      'data' => {
-                        'collect_full_commandline' => true,
-                        'command_rules' => [
-                          { 'rule_id' => '1', 'action' => 'ignore' },
-                          { 'rule_id' => '2', 'action' => 'report', 'command' => 'cat' }
-                        ]
-                      }
-                    }
-                  }
-                )
-
-                expect(TCellAgent).to receive(:send_event).with(
-                  {
-                    'event_type' => 'cmdi',
-                    'commands' => [
-                      { 'command' => 'cat', 'arg_count' => 1 },
-                      { 'command' => 'grep', 'arg_count' => 1 }
-                    ],
-                    'blocked' => false,
-                    'matches' => [{ 'rule_id' => '2', 'command' => 'cat' }],
-                    'full_commandline' => 'cat /etc/passwd | grep root'
-                  }
-                )
-
-                expect(
-                  @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
-                ).to eq(false)
-              end
-            end
-
-            context 'and block cat' do
-              it 'should send an event and block' do
-                @rust_policies.update_policies(
-                  {
-                    'cmdi' => {
-                      'policy_id' => 'policy_id',
-                      'version' => 1,
-                      'data' => {
-                        'collect_full_commandline' => true,
-                        'command_rules' => [
-                          { 'rule_id' => '1', 'action' => 'ignore' },
-                          { 'rule_id' => '2', 'action' => 'block', 'command' => 'cat' }
-                        ]
-                      }
-                    }
-                  }
-                )
-
-                expect(TCellAgent).to receive(:send_event).with(
-                  {
-                    'event_type' => 'cmdi',
-                    'commands' => [
-                      { 'command' => 'cat', 'arg_count' => 1 },
-                      { 'command' => 'grep', 'arg_count' => 1 }
-                    ],
-                    'blocked' => true,
-                    'matches' => [{ 'rule_id' => '2', 'command' => 'cat' }],
-                    'full_commandline' => 'cat /etc/passwd | grep root'
-                  }
-                )
-
-                expect(
-                  @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
-                ).to eq(true)
-              end
+                @policy.block_command?('cat /etc/passwd && grep root', @tcell_context)
+              ).to eq(true)
             end
           end
 
-          context 'that report all' do
-            it 'should send an event' do
-              @rust_policies.update_policies(
+          context 'report compound commands' do
+            it 'should enable the policy but no block the command' do
+              enablements = @native_agent.update_policies(
                 {
                   'cmdi' => {
                     'policy_id' => 'policy_id',
                     'version' => 1,
                     'data' => {
-                      'command_rules' => [{ 'rule_id' => '1', 'action' => 'report' }]
+                      'compound_statement_rules' => [{ 'rule_id' => '1', 'action' => 'report' }]
                     }
                   }
                 }
-              )
+              )['enablements']
+              expect(enablements['cmdi']).to eq(true)
 
-              expect(TCellAgent).to receive(:send_event).with(
-                {
-                  'event_type' => 'cmdi',
-                  'commands' => [
-                    { 'command' => 'cat', 'arg_count' => 1 },
-                    { 'command' => 'grep', 'arg_count' => 1 }
-                  ],
-                  'blocked' => false,
-                  'matches' => [
-                    { 'rule_id' => '1', 'command' => 'cat' },
-                    { 'rule_id' => '1', 'command' => 'grep' }
-                  ]
-                }
-              )
+              @policy = CommandInjectionPolicy.new(@native_agent, enablements)
+              expect(@policy.enabled).to eq(true)
 
               expect(
-                @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
+                @policy.block_command?('cat /etc/passwd', @tcell_context)
               ).to eq(false)
-            end
-
-            context 'and ignore cat' do
-              it 'should send an event for grep not cat' do
-                @rust_policies.update_policies(
-                  {
-                    'cmdi' => {
-                      'policy_id' => 'policy_id',
-                      'version' => 1,
-                      'data' => {
-                        'command_rules' => [
-                          { 'rule_id' => '1', 'action' => 'report' },
-                          { 'rule_id' => '2', 'action' => 'ignore', 'command' => 'cat' }
-                        ]
-                      }
-                    }
-                  }
-                )
-
-                expect(TCellAgent).to receive(:send_event).with(
-                  {
-                    'event_type' => 'cmdi',
-                    'commands' => [
-                      { 'command' => 'cat', 'arg_count' => 1 },
-                      { 'command' => 'grep', 'arg_count' => 1 }
-                    ],
-                    'blocked' => false,
-                    'matches' => [{ 'rule_id' => '1', 'command' => 'grep' }]
-                  }
-                )
-
-                expect(
-                  @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
-                ).to eq(false)
-              end
-            end
-
-            context 'and report cat' do
-              it 'should send an event for grep and cat' do
-                @rust_policies.update_policies(
-                  {
-                    'cmdi' => {
-                      'policy_id' => 'policy_id',
-                      'version' => 1,
-                      'data' => {
-                        'command_rules' => [
-                          { 'rule_id' => '1', 'action' => 'report' },
-                          { 'rule_id' => '2', 'action' => 'report', 'command' => 'cat' }
-                        ]
-                      }
-                    }
-                  }
-                )
-
-                expect(TCellAgent).to receive(:send_event).with(
-                  {
-                    'event_type' => 'cmdi',
-                    'commands' => [
-                      { 'command' => 'cat', 'arg_count' => 1 },
-                      { 'command' => 'grep', 'arg_count' => 1 }
-                    ],
-                    'blocked' => false,
-                    'matches' => [
-                      { 'rule_id' => '2', 'command' => 'cat' },
-                      { 'rule_id' => '1', 'command' => 'grep' }
-                    ]
-                  }
-                )
-
-                expect(
-                  @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
-                ).to eq(false)
-              end
-            end
-
-            context 'and block cat' do
-              it 'should send an event for grep and cat and block' do
-                @rust_policies.update_policies(
-                  {
-                    'cmdi' => {
-                      'policy_id' => 'policy_id',
-                      'version' => 1,
-                      'data' => {
-                        'command_rules' => [
-                          { 'rule_id' => '1', 'action' => 'report' },
-                          { 'rule_id' => '2', 'action' => 'block', 'command' => 'cat' }
-                        ]
-                      }
-                    }
-                  }
-                )
-
-                expect(TCellAgent).to receive(:send_event).with(
-                  {
-                    'event_type' => 'cmdi',
-                    'commands' => [
-                      { 'command' => 'cat', 'arg_count' => 1 },
-                      { 'command' => 'grep', 'arg_count' => 1 }
-                    ],
-                    'blocked' => true,
-                    'matches' => [
-                      { 'rule_id' => '2', 'command' => 'cat' },
-                      { 'rule_id' => '1', 'command' => 'grep' }
-                    ]
-                  }
-                )
-
-                expect(
-                  @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
-                ).to eq(true)
-              end
-            end
-          end
-
-          context 'that block all' do
-            it 'should send an event and block' do
-              @rust_policies.update_policies(
-                {
-                  'cmdi' => {
-                    'policy_id' => 'policy_id',
-                    'version' => 1,
-                    'data' => {
-                      'command_rules' => [{ 'rule_id' => '1', 'action' => 'block' }]
-                    }
-                  }
-                }
-              )
-
-              expect(TCellAgent).to receive(:send_event).with(
-                {
-                  'event_type' => 'cmdi',
-                  'commands' => [
-                    { 'command' => 'cat', 'arg_count' => 1 },
-                    { 'command' => 'grep', 'arg_count' => 1 }
-                  ],
-                  'blocked' => true,
-                  'matches' => [
-                    { 'rule_id' => '1', 'command' => 'cat' },
-                    { 'rule_id' => '1', 'command' => 'grep' }
-                  ]
-                }
-              )
 
               expect(
-                @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
-              ).to eq(true)
-            end
-
-            context 'and ignore cat' do
-              it 'should send an event for grep not cat and block' do
-                @rust_policies.update_policies(
-                  {
-                    'cmdi' => {
-                      'policy_id' => 'policy_id',
-                      'version' => 1,
-                      'data' => {
-                        'command_rules' => [
-                          { 'rule_id' => '1', 'action' => 'block' },
-                          { 'rule_id' => '2', 'action' => 'ignore', 'command' => 'cat' }
-                        ]
-                      }
-                    }
-                  }
-                )
-
-                expect(TCellAgent).to receive(:send_event).with(
-                  {
-                    'event_type' => 'cmdi',
-                    'commands' => [
-                      { 'command' => 'cat', 'arg_count' => 1 },
-                      { 'command' => 'grep', 'arg_count' => 1 }
-                    ],
-                    'blocked' => true,
-                    'matches' => [{ 'rule_id' => '1', 'command' => 'grep' }]
-                  }
-                )
-
-                expect(
-                  @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
-                ).to eq(true)
-              end
-            end
-
-            context 'and report cat' do
-              it 'should send an event for grep and cat and block' do
-                @rust_policies.update_policies(
-                  {
-                    'cmdi' => {
-                      'policy_id' => 'policy_id',
-                      'version' => 1,
-                      'data' => {
-                        'command_rules' => [
-                          { 'rule_id' => '1', 'action' => 'block' },
-                          { 'rule_id' => '2', 'action' => 'report', 'command' => 'cat' }
-                        ]
-                      }
-                    }
-                  }
-                )
-
-                expect(TCellAgent).to receive(:send_event).with(
-                  {
-                    'event_type' => 'cmdi',
-                    'commands' => [
-                      { 'command' => 'cat', 'arg_count' => 1 },
-                      { 'command' => 'grep', 'arg_count' => 1 }
-                    ],
-                    'blocked' => true,
-                    'matches' => [
-                      { 'rule_id' => '2', 'command' => 'cat' },
-                      { 'rule_id' => '1', 'command' => 'grep' }
-                    ]
-                  }
-                )
-
-                expect(
-                  @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
-                ).to eq(true)
-              end
-            end
-
-            context 'and block cat' do
-              it 'should send an event for grep and cat and block' do
-                @rust_policies.update_policies(
-                  {
-                    'cmdi' => {
-                      'policy_id' => 'policy_id',
-                      'version' => 1,
-                      'data' => {
-                        'command_rules' => [
-                          { 'rule_id' => '1', 'action' => 'block' },
-                          { 'rule_id' => '2', 'action' => 'block', 'command' => 'cat' }
-                        ]
-                      }
-                    }
-                  }
-                )
-
-                expect(TCellAgent).to receive(:send_event).with(
-                  {
-                    'event_type' => 'cmdi',
-                    'commands' => [
-                      { 'command' => 'cat', 'arg_count' => 1 },
-                      { 'command' => 'grep', 'arg_count' => 1 }
-                    ],
-                    'blocked' => true,
-                    'matches' => [
-                      { 'rule_id' => '2', 'command' => 'cat' },
-                      { 'rule_id' => '1', 'command' => 'grep' }
-                    ]
-                  }
-                )
-
-                expect(
-                  @rust_policies.block_command?('cat /etc/passwd | grep root', nil)
-                ).to eq(true)
-              end
-            end
-          end
-        end
-
-        context 'with compound statement rules' do
-          before(:each) do
-            @tcell_context = TCellAgent::Instrumentation::TCellData.new
-            @tcell_context.request_method = 'GET'
-            @tcell_context.ip_address = '1.1.1.1'
-            @tcell_context.route_id = '12345'
-            @tcell_context.hmac_session_id = 'sldfjk2343'
-            @tcell_context.user_id = 'user_id'
-          end
-
-          context 'set to ignore' do
-            before(:each) do
-              @rust_policies.update_policies(
-                {
-                  'cmdi' => {
-                    'policy_id' => 'policy_id',
-                    'version' => 1,
-                    'data' => {
-                      'compound_statement_rules' => [
-                        { 'rule_id' => '1', 'action' => 'ignore' }
-                      ]
-                    }
-                  }
-                }
-              )
-            end
-
-            context 'one parsed command' do
-              it 'should not send events or block' do
-                expect(TCellAgent).to_not receive(:send_event)
-
-                expect(
-                  @rust_policies.block_command?('cat /etc/passwd', @tcell_context)
-                ).to eq(false)
-              end
-            end
-
-            context 'two parsed commands' do
-              it 'should not send events or block' do
-                expect(TCellAgent).to_not receive(:send_event)
-
-                expect(
-                  @rust_policies.block_command?('cat /etc/passwd | grep root', @tcell_context)
-                ).to eq(false)
-              end
-            end
-          end
-
-          context 'set to report' do
-            before(:each) do
-              @rust_policies.update_policies(
-                {
-                  'cmdi' => {
-                    'policy_id' => 'policy_id',
-                    'version' => 1,
-                    'data' => {
-                      'compound_statement_rules' => [
-                        { 'rule_id' => '1', 'action' => 'report' }
-                      ]
-                    }
-                  }
-                }
-              )
-            end
-
-            context 'one parsed command' do
-              it 'should not send events or block' do
-                expect(TCellAgent).to_not receive(:send_event)
-
-                expect(
-                  @rust_policies.block_command?('cat /etc/passwd', @tcell_context)
-                ).to eq(false)
-              end
-            end
-
-            context 'two parsed commands' do
-              it 'should send an event but not block' do
-                expect(TCellAgent).to receive(:send_event).with(
-                  {
-                    'event_type' => 'cmdi',
-                    'commands' => [
-                      { 'command' => 'cat', 'arg_count' => 1 },
-                      { 'command' => 'grep', 'arg_count' => 1 }
-                    ],
-                    'blocked' => false,
-                    'matches' => [{ 'rule_id' => '1' }],
-                    'm' => 'GET',
-                    'remote_addr' => '1.1.1.1',
-                    'rid' => '12345',
-                    'sid' => 'sldfjk2343',
-                    'uid' => 'user_id'
-                  }
-                )
-
-                expect(
-                  @rust_policies.block_command?('cat /etc/passwd | grep root', @tcell_context)
-                ).to eq(false)
-              end
+                @policy.block_command?('cat /etc/passwd && grep root', @tcell_context)
+              ).to eq(false)
             end
           end
 
-          context 'set to block' do
-            before(:each) do
-              @rust_policies.update_policies(
+          context 'block compound commands' do
+            it 'should enable the policy and block compound commands' do
+              enablements = @native_agent.update_policies(
                 {
                   'cmdi' => {
                     'policy_id' => 'policy_id',
                     'version' => 1,
                     'data' => {
-                      'compound_statement_rules' => [
-                        { 'rule_id' => '1', 'action' => 'block' }
-                      ]
+                      'compound_statement_rules' => [{ 'rule_id' => '1', 'action' => 'block' }]
                     }
                   }
                 }
-              )
-            end
-
-            context 'one parsed command' do
-              it 'should not send events or block' do
-                expect(TCellAgent).to_not receive(:send_event)
-
-                expect(
-                  @rust_policies.block_command?('cat /etc/passwd', @tcell_context)
-                ).to eq(false)
-              end
-            end
-
-            context 'two parsed commands' do
-              it 'should send an event and block' do
-                expect(TCellAgent).to receive(:send_event).with(
-                  {
-                    'event_type' => 'cmdi',
-                    'commands' => [
-                      { 'command' => 'cat', 'arg_count' => 1 },
-                      { 'command' => 'grep', 'arg_count' => 1 }
-                    ],
-                    'blocked' => true,
-                    'matches' => [{ 'rule_id' => '1' }],
-                    'm' => 'GET',
-                    'remote_addr' => '1.1.1.1',
-                    'rid' => '12345',
-                    'sid' => 'sldfjk2343',
-                    'uid' => 'user_id'
-                  }
-                )
-
-                expect(
-                  @rust_policies.block_command?('cat /etc/passwd | grep root', @tcell_context)
-                ).to eq(true)
-              end
-            end
-          end
+              )['enablements']
+              expect(enablements['cmdi']).to eq(true)
 
-          context 'that conflict' do
-            it 'only take the first one and ignore the rest' do
-              ## multiple compound statements present only first one is taken
-              @rust_policies.update_policies(
-                {
-                  'cmdi' => {
-                    'policy_id' => 'policy_id',
-                    'version' => 1,
-                    'data' => {
-                      'compound_statement_rules' => [
-                        { 'rule_id' => '1', 'action' => 'block' },
-                        { 'rule_id' => '2', 'action' => 'ignore' }
-                      ]
-                    }
-                  }
-                }
-              )
+              @policy = CommandInjectionPolicy.new(@native_agent, enablements)
+              expect(@policy.enabled).to eq(true)
 
-              expect(TCellAgent).to receive(:send_event).with(
-                {
-                  'event_type' => 'cmdi',
-                  'commands' => [
-                    { 'command' => 'cat', 'arg_count' => 1 },
-                    { 'command' => 'grep', 'arg_count' => 1 }
-                  ],
-                  'blocked' => true,
-                  'matches' => [{ 'rule_id' => '1' }],
-                  'm' => 'GET',
-                  'remote_addr' => '1.1.1.1',
-                  'rid' => '12345',
-                  'sid' => 'sldfjk2343',
-                  'uid' => 'user_id'
-                }
-              )
+              expect(
+                @policy.block_command?('cat /etc/passwd', @tcell_context)
+              ).to eq(false)
 
               expect(
-                @rust_policies.block_command?('cat /etc/passwd | grep root', @tcell_context)
+                @policy.block_command?('cat /etc/passwd && grep root', @tcell_context)
               ).to eq(true)
             end
           end