tcell_agent 1.1.12 → 2.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (169) hide show
  1. checksums.yaml +5 -5
  2. data/bin/tcell_agent +45 -137
  3. data/lib/tcell_agent.rb +12 -14
  4. data/lib/tcell_agent/agent.rb +108 -97
  5. data/lib/tcell_agent/agent/route_manager.rb +0 -16
  6. data/lib/tcell_agent/agent/static_agent.rb +9 -30
  7. data/lib/tcell_agent/config_initializer.rb +66 -0
  8. data/lib/tcell_agent/configuration.rb +69 -345
  9. data/lib/tcell_agent/hooks/login_fraud.rb +30 -33
  10. data/lib/tcell_agent/instrument_servers.rb +23 -0
  11. data/lib/tcell_agent/instrumentation.rb +12 -10
  12. data/lib/tcell_agent/instrumentation/cmdi.rb +29 -25
  13. data/lib/tcell_agent/instrumentation/lfi.rb +84 -0
  14. data/lib/tcell_agent/instrumentation/monkey_patches/file.rb +25 -0
  15. data/lib/tcell_agent/instrumentation/monkey_patches/io.rb +131 -0
  16. data/lib/tcell_agent/instrumentation/monkey_patches/kernel.rb +102 -0
  17. data/lib/tcell_agent/logger.rb +49 -114
  18. data/lib/tcell_agent/patches.rb +6 -7
  19. data/lib/tcell_agent/policies/appfirewall_policy.rb +26 -0
  20. data/lib/tcell_agent/policies/command_injection_policy.rb +28 -0
  21. data/lib/tcell_agent/policies/dataloss_policy.rb +44 -44
  22. data/lib/tcell_agent/policies/headers_policy.rb +25 -0
  23. data/lib/tcell_agent/policies/http_redirect_policy.rb +13 -79
  24. data/lib/tcell_agent/policies/js_agent_policy.rb +27 -0
  25. data/lib/tcell_agent/policies/local_file_access.rb +28 -0
  26. data/lib/tcell_agent/policies/login_policy.rb +43 -0
  27. data/lib/tcell_agent/policies/patches_policy.rb +27 -0
  28. data/lib/tcell_agent/policies/policies_manager.rb +68 -0
  29. data/lib/tcell_agent/policies/policy_polling.rb +58 -0
  30. data/lib/tcell_agent/policies/policy_types.rb +14 -0
  31. data/lib/tcell_agent/policies/system_enablements.rb +27 -0
  32. data/lib/tcell_agent/rails/auth/authlogic.rb +46 -75
  33. data/lib/tcell_agent/rails/auth/authlogic_helper.rb +20 -0
  34. data/lib/tcell_agent/rails/auth/devise.rb +100 -105
  35. data/lib/tcell_agent/rails/auth/devise_helper.rb +29 -0
  36. data/lib/tcell_agent/rails/auth/doorkeeper.rb +62 -76
  37. data/lib/tcell_agent/{userinfo.rb → rails/auth/userinfo.rb} +0 -0
  38. data/lib/tcell_agent/rails/csrf_exception.rb +2 -10
  39. data/lib/tcell_agent/rails/dlp.rb +35 -23
  40. data/lib/tcell_agent/rails/dlp_handler.rb +1 -2
  41. data/lib/tcell_agent/rails/js_agent_insert.rb +12 -13
  42. data/lib/tcell_agent/rails/middleware/body_filter_middleware.rb +4 -25
  43. data/lib/tcell_agent/rails/middleware/context_middleware.rb +2 -12
  44. data/lib/tcell_agent/rails/middleware/global_middleware.rb +1 -2
  45. data/lib/tcell_agent/rails/middleware/headers_middleware.rb +14 -34
  46. data/lib/tcell_agent/{rails.rb → rails/railties/tcell_agent_railties.rb} +11 -16
  47. data/lib/tcell_agent/rails/railties/tcell_agent_unicorn_railties.rb +8 -0
  48. data/lib/tcell_agent/rails/routes.rb +10 -12
  49. data/lib/tcell_agent/rails/routes/grape.rb +4 -14
  50. data/lib/tcell_agent/rails/routes/route_id.rb +3 -1
  51. data/lib/tcell_agent/rails/settings_reporter.rb +23 -36
  52. data/lib/tcell_agent/rails/tcell_body_proxy.rb +5 -4
  53. data/lib/tcell_agent/rust/agent_config.rb +60 -0
  54. data/lib/tcell_agent/rust/{libtcellagent-alpine-1.3.2.so → libtcellagent-5.0.2.dylib} +0 -0
  55. data/lib/tcell_agent/rust/{libtcellagent-1.3.2.so → libtcellagent-5.0.2.so} +0 -0
  56. data/lib/tcell_agent/rust/libtcellagent-alpine-5.0.2.so +0 -0
  57. data/lib/tcell_agent/rust/models.rb +6 -52
  58. data/lib/tcell_agent/rust/native_agent.rb +549 -0
  59. data/lib/tcell_agent/rust/native_agent_response.rb +42 -0
  60. data/lib/tcell_agent/rust/native_library.rb +69 -0
  61. data/lib/tcell_agent/rust/tcellagent-5.0.2.dll +0 -0
  62. data/lib/tcell_agent/sensor_events/agent_setting_event.rb +12 -0
  63. data/lib/tcell_agent/sensor_events/{app_config.rb → app_config_setting_event.rb} +0 -6
  64. data/lib/tcell_agent/sensor_events/dlp.rb +2 -6
  65. data/lib/tcell_agent/sensor_events/sensor.rb +0 -62
  66. data/lib/tcell_agent/sensor_events/server_agent.rb +13 -18
  67. data/lib/tcell_agent/sensor_events/util/sanitizer_utilities.rb +0 -108
  68. data/lib/tcell_agent/sensor_events/util/utils.rb +0 -2
  69. data/lib/tcell_agent/servers/passenger.rb +1 -28
  70. data/lib/tcell_agent/servers/puma.rb +3 -21
  71. data/lib/tcell_agent/servers/rails_server.rb +1 -2
  72. data/lib/tcell_agent/servers/thin.rb +2 -2
  73. data/lib/tcell_agent/servers/unicorn.rb +19 -80
  74. data/lib/tcell_agent/servers/webrick.rb +1 -2
  75. data/lib/tcell_agent/settings_reporter.rb +11 -90
  76. data/lib/tcell_agent/sinatra.rb +14 -16
  77. data/lib/tcell_agent/tcell_context.rb +40 -14
  78. data/lib/tcell_agent/utils/headers.rb +14 -0
  79. data/lib/tcell_agent/version.rb +1 -1
  80. data/spec/lib/tcell_agent/configuration_spec.rb +55 -346
  81. data/spec/lib/tcell_agent/hooks/login_fraud_spec.rb +46 -173
  82. data/spec/lib/tcell_agent/instrumentation/cmdi/io_cmdi_spec.rb +504 -0
  83. data/spec/lib/tcell_agent/instrumentation/cmdi/kernel_cmdi_spec.rb +435 -0
  84. data/spec/lib/tcell_agent/instrumentation/cmdi_spec.rb +201 -0
  85. data/spec/lib/tcell_agent/instrumentation/lfi/file_lfi_spec.rb +326 -0
  86. data/spec/lib/tcell_agent/instrumentation/lfi/io_lfi_spec.rb +562 -0
  87. data/spec/lib/tcell_agent/instrumentation/lfi/kernel_lfi_spec.rb +264 -0
  88. data/spec/lib/tcell_agent/instrumentation/lfi_spec.rb +150 -0
  89. data/spec/lib/tcell_agent/patches_spec.rb +25 -43
  90. data/spec/lib/tcell_agent/policies/appfirewall_policy_spec.rb +183 -0
  91. data/spec/lib/tcell_agent/policies/clickjacking_policy_spec.rb +57 -0
  92. data/spec/lib/tcell_agent/policies/command_injection_policy_spec.rb +84 -773
  93. data/spec/lib/tcell_agent/policies/content_security_policy_spec.rb +161 -0
  94. data/spec/lib/tcell_agent/policies/dataloss_policy_spec.rb +9 -9
  95. data/spec/lib/tcell_agent/policies/http_redirect_policy_spec.rb +243 -198
  96. data/spec/lib/tcell_agent/policies/js_agent_policy_spec.rb +75 -0
  97. data/spec/lib/tcell_agent/policies/login_policy_spec.rb +165 -33
  98. data/spec/lib/tcell_agent/policies/patches_policy_spec.rb +84 -277
  99. data/spec/lib/tcell_agent/policies/policies_manager_spec.rb +104 -0
  100. data/spec/lib/tcell_agent/policies/policy_polling_spec.rb +6 -0
  101. data/spec/lib/tcell_agent/policies/secure_headers_policy_spec.rb +56 -0
  102. data/spec/lib/tcell_agent/rails/csrf_exception_spec.rb +9 -18
  103. data/spec/lib/tcell_agent/rails/js_agent_insert_spec.rb +13 -30
  104. data/spec/lib/tcell_agent/rails/logger_spec.rb +27 -7
  105. data/spec/lib/tcell_agent/rails/middleware/tcell_body_proxy_spec.rb +17 -12
  106. data/spec/lib/tcell_agent/rails/routes/routes_spec.rb +14 -14
  107. data/spec/lib/tcell_agent/rust/agent_config_spec.rb +27 -0
  108. data/spec/lib/tcell_agent/sensor_events/util/sanitizer_utilities_spec.rb +0 -35
  109. data/spec/lib/tcell_agent/settings_reporter_spec.rb +56 -155
  110. data/spec/spec_helper.rb +1 -1
  111. data/spec/support/builders.rb +103 -0
  112. data/spec/support/force_logger_mocking.rb +38 -0
  113. data/spec/support/resources/lfi_sample_file.txt +2 -0
  114. data/spec/support/static_agent_overrides.rb +0 -15
  115. metadata +72 -83
  116. data/lib/tcell_agent/agent/event_processor.rb +0 -326
  117. data/lib/tcell_agent/agent/fork_pipe_manager.rb +0 -113
  118. data/lib/tcell_agent/agent/policy_manager.rb +0 -219
  119. data/lib/tcell_agent/agent/policy_types.rb +0 -30
  120. data/lib/tcell_agent/api.rb +0 -91
  121. data/lib/tcell_agent/appsensor/injections_reporter.rb +0 -24
  122. data/lib/tcell_agent/authlogic.rb +0 -26
  123. data/lib/tcell_agent/config/child_process_events.rb +0 -8
  124. data/lib/tcell_agent/config/unknown_options.rb +0 -123
  125. data/lib/tcell_agent/devise.rb +0 -35
  126. data/lib/tcell_agent/instrumentation/cmdi/backtick.rb +0 -10
  127. data/lib/tcell_agent/instrumentation/cmdi/exec.rb +0 -14
  128. data/lib/tcell_agent/instrumentation/cmdi/popen.rb +0 -28
  129. data/lib/tcell_agent/instrumentation/cmdi/spawn.rb +0 -11
  130. data/lib/tcell_agent/instrumentation/cmdi/system.rb +0 -11
  131. data/lib/tcell_agent/policies/http_tx_policy.rb +0 -60
  132. data/lib/tcell_agent/policies/login_fraud_policy.rb +0 -45
  133. data/lib/tcell_agent/policies/rust_policies.rb +0 -110
  134. data/lib/tcell_agent/rails/on_start.rb +0 -41
  135. data/lib/tcell_agent/rust/libtcellagent-1.3.2.dylib +0 -0
  136. data/lib/tcell_agent/rust/tcellagent-1.3.2.dll +0 -0
  137. data/lib/tcell_agent/rust/whisperer.rb +0 -308
  138. data/lib/tcell_agent/sensor_events/appsensor_event.rb +0 -52
  139. data/lib/tcell_agent/sensor_events/appsensor_meta_event.rb +0 -45
  140. data/lib/tcell_agent/sensor_events/command_injection.rb +0 -75
  141. data/lib/tcell_agent/sensor_events/honeytokens.rb +0 -16
  142. data/lib/tcell_agent/sensor_events/login_fraud.rb +0 -60
  143. data/lib/tcell_agent/sensor_events/metrics.rb +0 -123
  144. data/lib/tcell_agent/sensor_events/patches.rb +0 -21
  145. data/lib/tcell_agent/start_background_thread.rb +0 -55
  146. data/lib/tcell_agent/system_info.rb +0 -11
  147. data/lib/tcell_agent/utils/io.rb +0 -38
  148. data/lib/tcell_agent/utils/passwords.rb +0 -28
  149. data/lib/tcell_agent/utils/queue_with_timeout.rb +0 -142
  150. data/spec/lib/tcell_agent/agent/fork_pipe_manager_spec.rb +0 -100
  151. data/spec/lib/tcell_agent/agent/policy_manager_spec.rb +0 -535
  152. data/spec/lib/tcell_agent/agent/static_agent_spec.rb +0 -133
  153. data/spec/lib/tcell_agent/api/api_spec.rb +0 -39
  154. data/spec/lib/tcell_agent/appsensor/injections_reporter_spec.rb +0 -187
  155. data/spec/lib/tcell_agent/cmdi_spec.rb +0 -736
  156. data/spec/lib/tcell_agent/config/unknown_options_spec.rb +0 -213
  157. data/spec/lib/tcell_agent/instrumentation_spec.rb +0 -225
  158. data/spec/lib/tcell_agent/policies/appsensor_policy_spec.rb +0 -517
  159. data/spec/lib/tcell_agent/policies/http_tx_policy_spec.rb +0 -22
  160. data/spec/lib/tcell_agent/rails/middleware/appsensor_middleware_spec.rb +0 -293
  161. data/spec/lib/tcell_agent/rails/middleware/dlp_middleware_spec.rb +0 -198
  162. data/spec/lib/tcell_agent/rails/middleware/global_middleware_spec.rb +0 -180
  163. data/spec/lib/tcell_agent/rails/middleware/redirect_middleware_spec.rb +0 -116
  164. data/spec/lib/tcell_agent/rust/models_spec.rb +0 -120
  165. data/spec/lib/tcell_agent/rust/whisperer_spec.rb +0 -704
  166. data/spec/lib/tcell_agent/sensor_events/appsensor_meta_event_spec.rb +0 -45
  167. data/spec/lib/tcell_agent/sensor_events/sessions_metric_spec.rb +0 -272
  168. data/spec/lib/tcell_agent/utils/bounded_queue_spec.rb +0 -52
  169. data/spec/lib/tcell_agent/utils/passwords_spec.rb +0 -143
@@ -0,0 +1,38 @@
1
+ # These modules create a logger and cache it as a class variable.
2
+ # This is an issue in tests when you want to mock out the logger
3
+ # because the cached logger will hold on to the mock object
4
+ # from tests across rspec tests which will result in this message:
5
+ #
6
+ # <Double "logger"> was originally created in one example
7
+ # but has leaked into another example and can no longer
8
+ # be used. rspec-mocks' doubles are designed to only last
9
+ # for one example, and you need to create a new one in each
10
+ # example you wish to use it for.module TCellAgent
11
+ #
12
+ # These overrides will force you to mock out these specific
13
+ # method calls by raising an exception if they are not mocked
14
+ module TCellAgent
15
+ module Instrumentation
16
+ def self.get_safe_block_logger
17
+ raise StandardError, 'It is in your best interest to mock this method in specs'
18
+ end
19
+ end
20
+ end
21
+
22
+ module TCellAgent
23
+ module Hooks
24
+ module LoginFraud
25
+ def self.get_logger
26
+ raise StandardError, 'It is in your best interest to mock this method in specs'
27
+ end
28
+ end
29
+ end
30
+ end
31
+
32
+ module TCellAgent
33
+ module DLP
34
+ def self.get_dlp_logger
35
+ raise StandardError, 'It is in your best interest to mock this method in specs'
36
+ end
37
+ end
38
+ end
@@ -0,0 +1,2 @@
1
+ This is line one.
2
+ This is line two.
@@ -10,7 +10,6 @@ module TCellAgent
10
10
  end
11
11
 
12
12
  def self.send_event(event)
13
- event.post_process
14
13
  @@spec_event_queue.push(event)
15
14
  end
16
15
 
@@ -18,20 +17,6 @@ module TCellAgent
18
17
  self.thread_agent = thread_agent
19
18
  end
20
19
 
21
- def self.queue_metric(event)
22
- thread_agent._queue_metric(event)
23
- end
24
-
25
- def self.increment_session_info(hmac_session_id, user_id, ip_address, user_agent)
26
- thread_agent.increment_session_info(hmac_session_id, user_id, ip_address, user_agent)
27
- end
28
-
29
- def self.increment_route(route_id, response_time)
30
- thread_agent.increment_route(route_id, response_time)
31
- end
32
-
33
- def self.ensure_event_processor_running; end
34
-
35
20
  class TCellApi
36
21
  def send_event_set(_events)
37
22
  puts 'Send Events'
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: tcell_agent
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.1.12
4
+ version: 2.2.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Rafael
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2019-10-22 00:00:00.000000000 Z
11
+ date: 2020-06-24 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: ffi
@@ -109,39 +109,40 @@ files:
109
109
  - bin/tcell_agent
110
110
  - lib/tcell_agent.rb
111
111
  - lib/tcell_agent/agent.rb
112
- - lib/tcell_agent/agent/event_processor.rb
113
- - lib/tcell_agent/agent/fork_pipe_manager.rb
114
- - lib/tcell_agent/agent/policy_manager.rb
115
- - lib/tcell_agent/agent/policy_types.rb
116
112
  - lib/tcell_agent/agent/route_manager.rb
117
113
  - lib/tcell_agent/agent/static_agent.rb
118
- - lib/tcell_agent/api.rb
119
- - lib/tcell_agent/appsensor/injections_reporter.rb
120
- - lib/tcell_agent/authlogic.rb
121
- - lib/tcell_agent/config/child_process_events.rb
122
- - lib/tcell_agent/config/unknown_options.rb
114
+ - lib/tcell_agent/config_initializer.rb
123
115
  - lib/tcell_agent/configuration.rb
124
- - lib/tcell_agent/devise.rb
125
116
  - lib/tcell_agent/hooks/login_fraud.rb
117
+ - lib/tcell_agent/instrument_servers.rb
126
118
  - lib/tcell_agent/instrumentation.rb
127
119
  - lib/tcell_agent/instrumentation/cmdi.rb
128
- - lib/tcell_agent/instrumentation/cmdi/backtick.rb
129
- - lib/tcell_agent/instrumentation/cmdi/exec.rb
130
- - lib/tcell_agent/instrumentation/cmdi/popen.rb
131
- - lib/tcell_agent/instrumentation/cmdi/spawn.rb
132
- - lib/tcell_agent/instrumentation/cmdi/system.rb
120
+ - lib/tcell_agent/instrumentation/lfi.rb
121
+ - lib/tcell_agent/instrumentation/monkey_patches/file.rb
122
+ - lib/tcell_agent/instrumentation/monkey_patches/io.rb
123
+ - lib/tcell_agent/instrumentation/monkey_patches/kernel.rb
133
124
  - lib/tcell_agent/logger.rb
134
125
  - lib/tcell_agent/patches.rb
126
+ - lib/tcell_agent/policies/appfirewall_policy.rb
127
+ - lib/tcell_agent/policies/command_injection_policy.rb
135
128
  - lib/tcell_agent/policies/dataloss_policy.rb
129
+ - lib/tcell_agent/policies/headers_policy.rb
136
130
  - lib/tcell_agent/policies/http_redirect_policy.rb
137
- - lib/tcell_agent/policies/http_tx_policy.rb
138
- - lib/tcell_agent/policies/login_fraud_policy.rb
131
+ - lib/tcell_agent/policies/js_agent_policy.rb
132
+ - lib/tcell_agent/policies/local_file_access.rb
133
+ - lib/tcell_agent/policies/login_policy.rb
134
+ - lib/tcell_agent/policies/patches_policy.rb
135
+ - lib/tcell_agent/policies/policies_manager.rb
139
136
  - lib/tcell_agent/policies/policy.rb
140
- - lib/tcell_agent/policies/rust_policies.rb
141
- - lib/tcell_agent/rails.rb
137
+ - lib/tcell_agent/policies/policy_polling.rb
138
+ - lib/tcell_agent/policies/policy_types.rb
139
+ - lib/tcell_agent/policies/system_enablements.rb
142
140
  - lib/tcell_agent/rails/auth/authlogic.rb
141
+ - lib/tcell_agent/rails/auth/authlogic_helper.rb
143
142
  - lib/tcell_agent/rails/auth/devise.rb
143
+ - lib/tcell_agent/rails/auth/devise_helper.rb
144
144
  - lib/tcell_agent/rails/auth/doorkeeper.rb
145
+ - lib/tcell_agent/rails/auth/userinfo.rb
145
146
  - lib/tcell_agent/rails/better_ip.rb
146
147
  - lib/tcell_agent/rails/csrf_exception.rb
147
148
  - lib/tcell_agent/rails/dlp.rb
@@ -152,7 +153,8 @@ files:
152
153
  - lib/tcell_agent/rails/middleware/context_middleware.rb
153
154
  - lib/tcell_agent/rails/middleware/global_middleware.rb
154
155
  - lib/tcell_agent/rails/middleware/headers_middleware.rb
155
- - lib/tcell_agent/rails/on_start.rb
156
+ - lib/tcell_agent/rails/railties/tcell_agent_railties.rb
157
+ - lib/tcell_agent/rails/railties/tcell_agent_unicorn_railties.rb
156
158
  - lib/tcell_agent/rails/responses.rb
157
159
  - lib/tcell_agent/rails/routes.rb
158
160
  - lib/tcell_agent/rails/routes/grape.rb
@@ -160,22 +162,19 @@ files:
160
162
  - lib/tcell_agent/rails/settings_reporter.rb
161
163
  - lib/tcell_agent/rails/tcell_body_proxy.rb
162
164
  - lib/tcell_agent/routes/table.rb
163
- - lib/tcell_agent/rust/libtcellagent-1.3.2.dylib
164
- - lib/tcell_agent/rust/libtcellagent-1.3.2.so
165
- - lib/tcell_agent/rust/libtcellagent-alpine-1.3.2.so
165
+ - lib/tcell_agent/rust/agent_config.rb
166
+ - lib/tcell_agent/rust/libtcellagent-5.0.2.dylib
167
+ - lib/tcell_agent/rust/libtcellagent-5.0.2.so
168
+ - lib/tcell_agent/rust/libtcellagent-alpine-5.0.2.so
166
169
  - lib/tcell_agent/rust/models.rb
167
- - lib/tcell_agent/rust/tcellagent-1.3.2.dll
168
- - lib/tcell_agent/rust/whisperer.rb
169
- - lib/tcell_agent/sensor_events/app_config.rb
170
- - lib/tcell_agent/sensor_events/appsensor_event.rb
171
- - lib/tcell_agent/sensor_events/appsensor_meta_event.rb
172
- - lib/tcell_agent/sensor_events/command_injection.rb
170
+ - lib/tcell_agent/rust/native_agent.rb
171
+ - lib/tcell_agent/rust/native_agent_response.rb
172
+ - lib/tcell_agent/rust/native_library.rb
173
+ - lib/tcell_agent/rust/tcellagent-5.0.2.dll
174
+ - lib/tcell_agent/sensor_events/agent_setting_event.rb
175
+ - lib/tcell_agent/sensor_events/app_config_setting_event.rb
173
176
  - lib/tcell_agent/sensor_events/discovery.rb
174
177
  - lib/tcell_agent/sensor_events/dlp.rb
175
- - lib/tcell_agent/sensor_events/honeytokens.rb
176
- - lib/tcell_agent/sensor_events/login_fraud.rb
177
- - lib/tcell_agent/sensor_events/metrics.rb
178
- - lib/tcell_agent/sensor_events/patches.rb
179
178
  - lib/tcell_agent/sensor_events/sensor.rb
180
179
  - lib/tcell_agent/sensor_events/server_agent.rb
181
180
  - lib/tcell_agent/sensor_events/util/sanitizer_utilities.rb
@@ -188,63 +187,56 @@ files:
188
187
  - lib/tcell_agent/servers/webrick.rb
189
188
  - lib/tcell_agent/settings_reporter.rb
190
189
  - lib/tcell_agent/sinatra.rb
191
- - lib/tcell_agent/start_background_thread.rb
192
- - lib/tcell_agent/system_info.rb
193
190
  - lib/tcell_agent/tcell_context.rb
194
- - lib/tcell_agent/userinfo.rb
195
- - lib/tcell_agent/utils/io.rb
191
+ - lib/tcell_agent/utils/headers.rb
196
192
  - lib/tcell_agent/utils/params.rb
197
- - lib/tcell_agent/utils/passwords.rb
198
- - lib/tcell_agent/utils/queue_with_timeout.rb
199
193
  - lib/tcell_agent/utils/strings.rb
200
194
  - lib/tcell_agent/version.rb
201
- - spec/lib/tcell_agent/agent/fork_pipe_manager_spec.rb
202
- - spec/lib/tcell_agent/agent/policy_manager_spec.rb
203
- - spec/lib/tcell_agent/agent/static_agent_spec.rb
204
- - spec/lib/tcell_agent/api/api_spec.rb
205
- - spec/lib/tcell_agent/appsensor/injections_reporter_spec.rb
206
- - spec/lib/tcell_agent/cmdi_spec.rb
207
- - spec/lib/tcell_agent/config/unknown_options_spec.rb
208
195
  - spec/lib/tcell_agent/configuration_spec.rb
209
196
  - spec/lib/tcell_agent/hooks/login_fraud_spec.rb
210
- - spec/lib/tcell_agent/instrumentation_spec.rb
197
+ - spec/lib/tcell_agent/instrumentation/cmdi/io_cmdi_spec.rb
198
+ - spec/lib/tcell_agent/instrumentation/cmdi/kernel_cmdi_spec.rb
199
+ - spec/lib/tcell_agent/instrumentation/cmdi_spec.rb
200
+ - spec/lib/tcell_agent/instrumentation/lfi/file_lfi_spec.rb
201
+ - spec/lib/tcell_agent/instrumentation/lfi/io_lfi_spec.rb
202
+ - spec/lib/tcell_agent/instrumentation/lfi/kernel_lfi_spec.rb
203
+ - spec/lib/tcell_agent/instrumentation/lfi_spec.rb
211
204
  - spec/lib/tcell_agent/patches_spec.rb
212
- - spec/lib/tcell_agent/policies/appsensor_policy_spec.rb
205
+ - spec/lib/tcell_agent/policies/appfirewall_policy_spec.rb
206
+ - spec/lib/tcell_agent/policies/clickjacking_policy_spec.rb
213
207
  - spec/lib/tcell_agent/policies/command_injection_policy_spec.rb
208
+ - spec/lib/tcell_agent/policies/content_security_policy_spec.rb
214
209
  - spec/lib/tcell_agent/policies/dataloss_policy_spec.rb
215
210
  - spec/lib/tcell_agent/policies/http_redirect_policy_spec.rb
216
- - spec/lib/tcell_agent/policies/http_tx_policy_spec.rb
211
+ - spec/lib/tcell_agent/policies/js_agent_policy_spec.rb
217
212
  - spec/lib/tcell_agent/policies/login_policy_spec.rb
218
213
  - spec/lib/tcell_agent/policies/patches_policy_spec.rb
214
+ - spec/lib/tcell_agent/policies/policies_manager_spec.rb
215
+ - spec/lib/tcell_agent/policies/policy_polling_spec.rb
216
+ - spec/lib/tcell_agent/policies/secure_headers_policy_spec.rb
219
217
  - spec/lib/tcell_agent/rails/better_ip_spec.rb
220
218
  - spec/lib/tcell_agent/rails/csrf_exception_spec.rb
221
219
  - spec/lib/tcell_agent/rails/dlp_spec.rb
222
220
  - spec/lib/tcell_agent/rails/js_agent_insert_spec.rb
223
221
  - spec/lib/tcell_agent/rails/logger_spec.rb
224
- - spec/lib/tcell_agent/rails/middleware/appsensor_middleware_spec.rb
225
- - spec/lib/tcell_agent/rails/middleware/dlp_middleware_spec.rb
226
- - spec/lib/tcell_agent/rails/middleware/global_middleware_spec.rb
227
- - spec/lib/tcell_agent/rails/middleware/redirect_middleware_spec.rb
228
222
  - spec/lib/tcell_agent/rails/middleware/tcell_body_proxy_spec.rb
229
223
  - spec/lib/tcell_agent/rails/responses_spec.rb
230
224
  - spec/lib/tcell_agent/rails/routes/grape_spec.rb
231
225
  - spec/lib/tcell_agent/rails/routes/route_id_spec.rb
232
226
  - spec/lib/tcell_agent/rails/routes/routes_spec.rb
233
227
  - spec/lib/tcell_agent/rails_spec.rb
234
- - spec/lib/tcell_agent/rust/models_spec.rb
235
- - spec/lib/tcell_agent/rust/whisperer_spec.rb
236
- - spec/lib/tcell_agent/sensor_events/appsensor_meta_event_spec.rb
228
+ - spec/lib/tcell_agent/rust/agent_config_spec.rb
237
229
  - spec/lib/tcell_agent/sensor_events/dlp_spec.rb
238
- - spec/lib/tcell_agent/sensor_events/sessions_metric_spec.rb
239
230
  - spec/lib/tcell_agent/sensor_events/util/sanitizer_utilities_spec.rb
240
231
  - spec/lib/tcell_agent/settings_reporter_spec.rb
241
232
  - spec/lib/tcell_agent/tcell_context_spec.rb
242
- - spec/lib/tcell_agent/utils/bounded_queue_spec.rb
243
233
  - spec/lib/tcell_agent/utils/params_spec.rb
244
- - spec/lib/tcell_agent/utils/passwords_spec.rb
245
234
  - spec/lib/tcell_agent/utils/strings_spec.rb
246
235
  - spec/spec_helper.rb
236
+ - spec/support/builders.rb
237
+ - spec/support/force_logger_mocking.rb
247
238
  - spec/support/middleware_helper.rb
239
+ - spec/support/resources/lfi_sample_file.txt
248
240
  - spec/support/resources/normal_config.json
249
241
  - spec/support/static_agent_overrides.rb
250
242
  - tcell_agent.gemspec
@@ -269,58 +261,55 @@ required_rubygems_version: !ruby/object:Gem::Requirement
269
261
  - !ruby/object:Gem::Version
270
262
  version: '0'
271
263
  requirements: []
272
- rubyforge_project:
273
- rubygems_version: 2.5.2.3
264
+ rubygems_version: 3.0.3
274
265
  signing_key:
275
266
  specification_version: 4
276
267
  summary: tCell.io Agent for Rails
277
268
  test_files:
278
- - spec/lib/tcell_agent/agent/fork_pipe_manager_spec.rb
279
- - spec/lib/tcell_agent/agent/policy_manager_spec.rb
280
- - spec/lib/tcell_agent/agent/static_agent_spec.rb
281
- - spec/lib/tcell_agent/api/api_spec.rb
282
- - spec/lib/tcell_agent/appsensor/injections_reporter_spec.rb
283
- - spec/lib/tcell_agent/cmdi_spec.rb
284
- - spec/lib/tcell_agent/config/unknown_options_spec.rb
285
269
  - spec/lib/tcell_agent/configuration_spec.rb
286
270
  - spec/lib/tcell_agent/hooks/login_fraud_spec.rb
287
- - spec/lib/tcell_agent/instrumentation_spec.rb
271
+ - spec/lib/tcell_agent/instrumentation/cmdi/io_cmdi_spec.rb
272
+ - spec/lib/tcell_agent/instrumentation/cmdi/kernel_cmdi_spec.rb
273
+ - spec/lib/tcell_agent/instrumentation/cmdi_spec.rb
274
+ - spec/lib/tcell_agent/instrumentation/lfi/file_lfi_spec.rb
275
+ - spec/lib/tcell_agent/instrumentation/lfi/io_lfi_spec.rb
276
+ - spec/lib/tcell_agent/instrumentation/lfi/kernel_lfi_spec.rb
277
+ - spec/lib/tcell_agent/instrumentation/lfi_spec.rb
288
278
  - spec/lib/tcell_agent/patches_spec.rb
289
- - spec/lib/tcell_agent/policies/appsensor_policy_spec.rb
279
+ - spec/lib/tcell_agent/policies/appfirewall_policy_spec.rb
280
+ - spec/lib/tcell_agent/policies/clickjacking_policy_spec.rb
290
281
  - spec/lib/tcell_agent/policies/command_injection_policy_spec.rb
282
+ - spec/lib/tcell_agent/policies/content_security_policy_spec.rb
291
283
  - spec/lib/tcell_agent/policies/dataloss_policy_spec.rb
292
284
  - spec/lib/tcell_agent/policies/http_redirect_policy_spec.rb
293
- - spec/lib/tcell_agent/policies/http_tx_policy_spec.rb
285
+ - spec/lib/tcell_agent/policies/js_agent_policy_spec.rb
294
286
  - spec/lib/tcell_agent/policies/login_policy_spec.rb
295
287
  - spec/lib/tcell_agent/policies/patches_policy_spec.rb
288
+ - spec/lib/tcell_agent/policies/policies_manager_spec.rb
289
+ - spec/lib/tcell_agent/policies/policy_polling_spec.rb
290
+ - spec/lib/tcell_agent/policies/secure_headers_policy_spec.rb
296
291
  - spec/lib/tcell_agent/rails/better_ip_spec.rb
297
292
  - spec/lib/tcell_agent/rails/csrf_exception_spec.rb
298
293
  - spec/lib/tcell_agent/rails/dlp_spec.rb
299
294
  - spec/lib/tcell_agent/rails/js_agent_insert_spec.rb
300
295
  - spec/lib/tcell_agent/rails/logger_spec.rb
301
- - spec/lib/tcell_agent/rails/middleware/appsensor_middleware_spec.rb
302
- - spec/lib/tcell_agent/rails/middleware/dlp_middleware_spec.rb
303
- - spec/lib/tcell_agent/rails/middleware/global_middleware_spec.rb
304
- - spec/lib/tcell_agent/rails/middleware/redirect_middleware_spec.rb
305
296
  - spec/lib/tcell_agent/rails/middleware/tcell_body_proxy_spec.rb
306
297
  - spec/lib/tcell_agent/rails/responses_spec.rb
307
298
  - spec/lib/tcell_agent/rails/routes/grape_spec.rb
308
299
  - spec/lib/tcell_agent/rails/routes/route_id_spec.rb
309
300
  - spec/lib/tcell_agent/rails/routes/routes_spec.rb
310
301
  - spec/lib/tcell_agent/rails_spec.rb
311
- - spec/lib/tcell_agent/rust/models_spec.rb
312
- - spec/lib/tcell_agent/rust/whisperer_spec.rb
313
- - spec/lib/tcell_agent/sensor_events/appsensor_meta_event_spec.rb
302
+ - spec/lib/tcell_agent/rust/agent_config_spec.rb
314
303
  - spec/lib/tcell_agent/sensor_events/dlp_spec.rb
315
- - spec/lib/tcell_agent/sensor_events/sessions_metric_spec.rb
316
304
  - spec/lib/tcell_agent/sensor_events/util/sanitizer_utilities_spec.rb
317
305
  - spec/lib/tcell_agent/settings_reporter_spec.rb
318
306
  - spec/lib/tcell_agent/tcell_context_spec.rb
319
- - spec/lib/tcell_agent/utils/bounded_queue_spec.rb
320
307
  - spec/lib/tcell_agent/utils/params_spec.rb
321
- - spec/lib/tcell_agent/utils/passwords_spec.rb
322
308
  - spec/lib/tcell_agent/utils/strings_spec.rb
323
309
  - spec/spec_helper.rb
310
+ - spec/support/builders.rb
311
+ - spec/support/force_logger_mocking.rb
324
312
  - spec/support/middleware_helper.rb
313
+ - spec/support/resources/lfi_sample_file.txt
325
314
  - spec/support/resources/normal_config.json
326
315
  - spec/support/static_agent_overrides.rb
@@ -1,326 +0,0 @@
1
- # See the file "LICENSE" for the full license governing this code.
2
-
3
- require 'tcell_agent/logger'
4
- require 'tcell_agent/version'
5
- require 'tcell_agent/api'
6
- require 'tcell_agent/configuration'
7
-
8
- require 'tcell_agent/policies/http_tx_policy'
9
- require 'tcell_agent/policies/http_redirect_policy'
10
-
11
- require 'tcell_agent/sensor_events/server_agent'
12
- require 'tcell_agent/sensor_events/metrics'
13
-
14
- require 'tcell_agent/utils/queue_with_timeout'
15
-
16
- require 'tcell_agent/agent/fork_pipe_manager'
17
- require 'tcell_agent/agent/static_agent'
18
-
19
- require 'net/http'
20
- require 'thread'
21
- require 'logger'
22
- require 'json'
23
-
24
- module TCellAgent
25
- class Agent # rubocop:disable Metrics/ClassLength
26
- # cmdi events are special because they can be triggered very easily by running any shell command.
27
- # Startup scripts are likely to run shell commands. It's not a good idea to startup the event
28
- # processor before worker processses are forked, so the safest thing to do is let a different
29
- # event start the event processor to avoid deadlocking worker processes.
30
- def safe_to_send_cmdi_events?
31
- event_processor_running?
32
- end
33
-
34
- def ensure_event_processor_running
35
- if event_processor_running?
36
- TCellAgent.logger.debug('[Agent::ensure_event_processor_running] Event processor already running, no need to start')
37
- return
38
- end
39
- if TCellAgent.configuration.should_start_event_manager? == false
40
- TCellAgent.logger.debug('[Agent::ensure_event_processor_running] TCellAgent.configuration.should_start_event_manager? is false, no need to start')
41
- return
42
- end
43
- @worker_mutex.synchronize do
44
- return if event_processor_running?
45
- initialize_processor_variables if parent_process? == false
46
- start_event_processor
47
- end
48
- end
49
-
50
- def event_processor_running?
51
- if TCellAgent::Agent.parent_process? == false
52
- TCellAgent.logger.debug('[Agent::event_processor_running?] Not a parent process, so returning true')
53
- return true
54
- end
55
- @event_processor_thread && @event_processor_thread.alive?
56
- end
57
-
58
- def stop_event_processor
59
- TCellAgent.logger.debug('Stopping event processor thread')
60
- @event_processor_thread.exit if @event_processor_thread && @event_processor_thread.alive?
61
- end
62
-
63
- def send_dispatch_events(tapi)
64
- events_to_send = []
65
- @event_dispatch_monitor.synchronize do
66
- events_to_send = @dispatch_events
67
- @dispatch_events = []
68
- end
69
-
70
- unless @response_time_table.empty?
71
- metrics_event = TCellAgent::SensorEvents::MetricsEvent.new
72
- metrics_event.set_route_count_table(@response_time_table)
73
- events_to_send.push(metrics_event)
74
- @mutex.synchronize do
75
- @response_time_table = {}
76
- end
77
- end
78
-
79
- if @sessions_metrics.sessions?
80
- sessions_to_send = []
81
- @sessions_metrics_mutex.synchronize do
82
- sessions_to_send = @sessions_metrics
83
- @sessions_metrics = TCellAgent::SensorEvents::SessionsMetric.new
84
- end
85
- events_to_send.push(sessions_to_send)
86
- end
87
-
88
- return if tapi.send_event_set(events_to_send)
89
-
90
- ensured_events = events_to_send.find_all { |item| item.ensure == true }
91
- @event_dispatch_monitor.synchronize do
92
- @dispatch_events.push(*ensured_events)
93
- end
94
- end
95
-
96
- def start_event_processor(send_empties = true)
97
- return if TCellAgent.configuration.should_start_event_manager? == false
98
-
99
- if TCellAgent.configuration.should_start_event_manager_in_child_processes?
100
- TCellAgent.logger.debug('Enabling event manager in child processes')
101
- require('tcell_agent/config/child_process_events')
102
- end
103
-
104
- if TCellAgent::Agent.parent_process? == false
105
- TCellAgent.logger.debug('[Agent::start_event_processor] Not a parent process, so not starting event processor thread')
106
- return
107
- end
108
-
109
- TCellAgent.logger.debug('[Agent::start_event_processor] Starting event processor thread')
110
- @events_send_empties = send_empties
111
- Thread.abort_on_exception = true
112
- @event_processor_thread = Thread.new do
113
- begin
114
- tapi = TCellApi.new
115
-
116
- last_run_time = Time.now
117
- loop do
118
- begin
119
- begin
120
- now = Time.now
121
- wait_for = @dispatch_events_timeout - (now - last_run_time).to_i.abs
122
- event = @event_queue.pop([wait_for, 1].max)
123
- if event.nil?
124
- if @events_send_empties || !@dispatch_events.empty?
125
- last_run_time = Time.now
126
- send_dispatch_events(tapi)
127
- end
128
- else
129
- event.post_process
130
- if event.send == true
131
- @event_dispatch_monitor.synchronize do
132
- @dispatch_events.push(event)
133
- end
134
- end
135
- if event.flush || @dispatch_events.length >= @dispatch_events_limit || wait_for < 0
136
- last_run_time = Time.now
137
- send_dispatch_events(tapi)
138
- end
139
- end
140
- rescue ThreadError => te
141
- TCellAgent.logger.error("ThreadError while processing events: #{te.message}")
142
- TCellAgent.logger.debug(te.backtrace)
143
- last_run_time = Time.now
144
- @event_dispatch_monitor.synchronize do
145
- @dispatch_events = []
146
- end
147
- end
148
- rescue TCellAgent::ConfigurationException
149
- Thread.exit
150
- rescue StandardError => e
151
- last_run_time = Time.now
152
- TCellAgent.logger.error("Exception while processing events: #{e.message}")
153
- TCellAgent.logger.debug(e.backtrace)
154
- @event_dispatch_monitor.synchronize do
155
- @dispatch_events = []
156
- end
157
- end
158
- end
159
- rescue StandardError => xyz
160
- TCellAgent.logger.error("Exception while starting processor: #{xyz.message}")
161
- TCellAgent.logger.debug(xyz.backtrace)
162
- end
163
- end
164
- end
165
-
166
- def ensure_fork_event_thread_running
167
- TCellAgent.logger.debug('[Agent::ensure_fork_event_thread_running] Ensuring the fork event thread is running')
168
- return if event_fork_thread_running?
169
- @fork_event_thread_mutex.synchronize do
170
- return if event_fork_thread_running?
171
- start_fork_event_thread
172
- end
173
- end
174
-
175
- def event_fork_thread_running?
176
- if TCellAgent::Agent.parent_process?
177
- TCellAgent.logger.debug('[Agent::event_fork_thread_running?] Parent process, so returning true')
178
- return true
179
- end
180
- @fork_event_thread && @fork_event_thread.alive?
181
- end
182
-
183
- def start_fork_event_thread
184
- TCellAgent.logger.debug('[Agent::start_fork_event_thread] Starting event fork thread')
185
- @fork_event_thread = Thread.new do
186
- loop do
187
- begin
188
- event = @fork_event_queue.pop
189
- if event.send
190
- TCellAgent::Agent.send_to_event_pipe(event)
191
- else
192
- event.post_process
193
- end
194
- rescue StandardError => e
195
- TCellAgent.logger.error("Exception while processing (forked) events: #{e.message}")
196
- TCellAgent.logger.debug(e.backtrace)
197
- end
198
- end
199
- end
200
- end
201
-
202
- def queue_forked_event(event)
203
- ensure_fork_event_thread_running
204
- if @fork_event_queue.length > 100
205
- TCellAgent.logger.debug('Dropping (forked) event because queue full')
206
- return
207
- end
208
- @fork_event_queue.push(event)
209
- rescue StandardError => queue_exception
210
- TCellAgent.logger.debug("Could not add (forked) event #{queue_exception.message}")
211
- TCellAgent.logger.debug(queue_exception.backtrace)
212
- end
213
-
214
- def ensure_metrics_event_thread_running
215
- return if event_metrics_thread_running?
216
- @metrics_event_thread_mutex.synchronize do
217
- return if event_metrics_thread_running?
218
- start_metrics_event_thread
219
- end
220
- end
221
-
222
- def event_metrics_thread_running?
223
- return true if TCellAgent::Agent.parent_process?
224
- @metrics_event_thread && @metrics_event_thread.alive?
225
- end
226
-
227
- def stop_metrics_event_thread
228
- TCellAgent.logger.debug('Stopping metrics event thread')
229
- @metrics_event_thread.exit if @metrics_event_thread && @metrics_event_thread.alive?
230
- end
231
-
232
- def start_metrics_event_thread
233
- return if TCellAgent.configuration.should_consume_event? == false
234
- @metrics_event_thread = Thread.new do
235
- loop do
236
- begin
237
- event = @metrics_event_queue.pop
238
- TCellAgent::Agent.send_to_metrics_pipe(event)
239
- rescue StandardError => e
240
- TCellAgent.logger.error("Exception while processing (forked) metrics: #{e.message}")
241
- TCellAgent.logger.debug(e.backtrace)
242
- end
243
- end
244
- end
245
- end
246
-
247
- def _queue_metric(event)
248
- return unless TCellAgent.configuration.should_consume_event?
249
-
250
- begin
251
- ensure_metrics_event_thread_running
252
- if @metrics_event_queue.length > 100
253
- TCellAgent.logger.debug('Dropping (forked) metric because queue full')
254
- return
255
- end
256
- @metrics_event_queue.push(event)
257
- rescue StandardError => queue_exception
258
- TCellAgent.logger.debug("Could not add (forked) metric #{queue_exception.message}")
259
- TCellAgent.logger.debug(queue_exception.backtrace)
260
- end
261
- end
262
-
263
- def queue_sensor_event(event)
264
- return unless TCellAgent.configuration.should_consume_event?
265
-
266
- if TCellAgent::Agent.parent_process? == false
267
- queue_forked_event(event)
268
- return
269
- end
270
-
271
- begin
272
- ensure_event_processor_running
273
- @event_queue_monitor.synchronize do
274
- @event_queue.push(event, 10)
275
- end
276
- rescue StandardError => queue_exception
277
- TCellAgent.logger.debug("Dropping event because queue full #{queue_exception.message}")
278
- TCellAgent.logger.debug(queue_exception.backtrace)
279
- end
280
- end
281
-
282
- def increment_session_info(hmac_session_id, user_id, ip_address, user_agent)
283
- TCellAgent::Instrumentation.safe_block('Incrementing session info') do
284
- if TCellAgent::Agent.parent_process? == false
285
- TCellAgent.queue_metric(
286
- '_type' => 'increment_session_info',
287
- 'hmac_session_id' => hmac_session_id,
288
- 'user_id' => user_id,
289
- 'ip_address' => ip_address,
290
- 'user_agent' => user_agent
291
- )
292
- return
293
- end
294
-
295
- @sessions_metrics_mutex.synchronize do
296
- @sessions_metrics.add_session_info(hmac_session_id, user_id, ip_address, user_agent)
297
- end
298
-
299
- if @sessions_metrics.flush
300
- TCellAgent.send_event(TCellAgent::SensorEvents::FlushDummyEvent.new)
301
- end
302
- end
303
- end
304
-
305
- def increment_route(route_id, response_time)
306
- TCellAgent::Instrumentation.safe_block('Incrementing route') do
307
- if TCellAgent::Agent.parent_process? == false
308
- TCellAgent.queue_metric(
309
- '_type' => 'increment_route',
310
- 'route_id' => route_id,
311
- 'response_time' => response_time
312
- )
313
- return
314
- end
315
- @mutex.synchronize do
316
- route_id = '?' if route_id.nil? || route_id == ''
317
- @response_time_table[route_id] = @response_time_table.fetch(route_id, {})
318
- @response_time_table[route_id]['c'] = @response_time_table[route_id].fetch('c', 0) + 1
319
- @response_time_table[route_id]['mx'] = [@response_time_table[route_id].fetch('mx', 0), response_time].max
320
- @response_time_table[route_id]['mn'] = [@response_time_table[route_id].fetch('mn', response_time), response_time].min
321
- @response_time_table[route_id]['t'] = ((@response_time_table[route_id].fetch('t', 0) * (@response_time_table[route_id]['c'] - 1)) + response_time) / @response_time_table[route_id]['c']
322
- end
323
- end
324
- end
325
- end
326
- end