tcell_agent 1.1.2 → 1.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: c723c416478a0722afc590772c8304f31dfd30bc
-  data.tar.gz: 183b96102f0c4206e69627b53b75000ec07c8ccd
+  metadata.gz: 9d0b4e34b740cbb9f4e3a004dc99b77a01b09a53
+  data.tar.gz: d3522bcd25ca86a2d3cd65e238b580d4a253f6e5
 SHA512:
-  metadata.gz: 505569e04ef4f00a564ae6a048d8b130763355a3074a075b484f2098a962cd34cbe72f973c20e7e605b7c961bebf358b970810c6582e598bfefb3defa5193365
-  data.tar.gz: 0e249cbe7555e9f3af0470cde13dc7bf12f74741fbac977433a2cbcb2b6342d2c737e8568483066ef5fbb5fed11f6c8312404d6069e299879d1ea101f5271507
+  metadata.gz: 8c539fcef0eb17c3cbf0f39ae61f54e01843ed197dfc1b65fb813d78387cae444a7c285d2b77cab639a4c845b19798419acd7463e662529fd912282abc29638c
+  data.tar.gz: 33c45e6e14e5cda851e4b3853ab5091322b7aa86be6fe4ba5f552701d4bd8d1289ba26cb4903fb871c8f1b0fcdb2bee887f720e67248a17bdae536b3dc916df7

data/lib/tcell_agent/configuration.rb

@@ -4,6 +4,7 @@ require 'json'
 require 'yaml'
 require 'socket'
 require 'securerandom'
+require 'uri'
 
 require 'tcell_agent/config/unknown_options'
 
@@ -182,9 +183,8 @@ module TCellAgent
         @allow_payloads = [true, "true", "yes", "1"].include?(ENV["TCELL_AGENT_ALLOW_PAYLOADS"])
       end
 
-      @tcell_api_url = compose_api_url
+      @tcell_api_url = compose_api_url!
       @tcell_input_url ||= "https://input.tcell.io/api/v1"
-      @js_agent_api_base_url ||= @tcell_api_url
       @js_agent_url ||= "https://jsagent.tcell.io/tcellagent.min.js"
 
       if (@host_identifier == nil)
@@ -198,7 +198,7 @@ module TCellAgent
       @uuid = SecureRandom.uuid
     end
 
-    def compose_api_url
+    def compose_api_url!
       @tcell_api_url ||= "https://api.tcell.io"
       parsed_uri = URI.parse(@tcell_api_url)
 
@@ -210,6 +210,8 @@ module TCellAgent
 
       api_url.push(":#{parsed_uri.port}") unless [80, 443].include?(parsed_uri.port)
 
+      @js_agent_api_base_url ||= "#{api_url.join('')}/api/v1"
+
       [
         api_url.join(''),
         "/agents/api/v1/apps/",

data/lib/tcell_agent/policies/dataloss_policy.rb

@@ -23,6 +23,7 @@ module TCellAgent
                 HEADER = "header"
             end
 
+            attr_accessor :enabled
             attr_accessor :session_id_filter_actions
             attr_accessor :request_filter_actions
             attr_accessor :database_filter_actions
@@ -45,7 +46,9 @@ module TCellAgent
             def initialize
                 self.init_options
             end
+
             def init_options
+                @enabled = false
                 @policy_id = nil
 
                 @table_field_actions = {}
@@ -66,27 +69,35 @@ module TCellAgent
 
                 @log_actions = nil
             end
+
             def get_actions_for_session_id(route_id=nil)
                 return @session_id_filter_actions
-            end 
+            end
+
             def has_actions_for_form_parameter?
                 return @request_filter_actions[RequestProtectionManager::FORM].size > 0
             end
+
             def has_actions_for_headers?
                 return @request_filter_actions[RequestProtectionManager::HEADER].size > 0
             end
+
             def has_actions_for_cookie?
                 return @request_filter_actions[RequestProtectionManager::COOKIE].size > 0
             end
+
             def get_actions_for_cookie(cookie_name, route_id=nil)
                 get_actions_for_request(RequestProtectionManager::COOKIE, cookie_name, route_id)
             end
+
             def get_actions_for_header(header_name, route_id=nil)
                 get_actions_for_request(RequestProtectionManager::HEADER, header_name.downcase, route_id)
             end
+
             def get_actions_for_form_parameter(parameter_name, route_id=nil)
                 get_actions_for_request(RequestProtectionManager::FORM, parameter_name.downcase, route_id)
             end
+
             def get_actions_for_request(context, variable, route_id=nil)
                 if (context == nil || variable == nil)
                     return nil
@@ -115,6 +126,7 @@ module TCellAgent
                 end
                 return actions
             end
+
             def get_actions_for_table(database, schema, table, field, route_id="*")
                 if route_id == nil
                     route_id = "*"
@@ -152,13 +164,14 @@ module TCellAgent
                 end
                 actions
             end
-                
+
             def get_actions_for(table, field)
                 actions = Set.new
                 key = "#{table}.#{field}"
                 actions.merge(@table_field_actions.fetch(key,[].to_set))
                 return actions
-            end 
+            end
+
             def self.actions_from_json(options)
                 actions = nil
                 if options.has_key?("log")
@@ -191,31 +204,37 @@ module TCellAgent
                 end
                 actions
             end
+
             def self.from_json(policy_json)
                 if (!policy_json)
                     return nil
                 end
+
                 policy = DataLossPolicy.new
                 if policy_json.has_key?("policy_id")
                     policy.policy_id = policy_json["policy_id"]
                 else
                     raise "Policy ID missing"
                 end
+
                 if policy_json.has_key?("data")
                     data_json = policy_json["data"]
                     if data_json.has_key?("data_discovery")
                         data_discovery_json = data_json["data_discovery"]
                         policy.database_discovery_enabled = data_discovery_json.fetch('database_enabled', false)
+                        policy.enabled = policy.database_discovery_enabled
                     end
                     if data_json.has_key?("session_id_protections")
                         session_id_protection = data_json["session_id_protections"]
                         rule_id = session_id_protection.fetch("id",nil)
                         filter_actions = DataLossPolicy.actions_from_json(session_id_protection)
                         if filter_actions != nil
+                            policy.enabled = true
                             filter_actions.action_id = rule_id
                             policy.session_id_filter_actions = filter_actions
                         end
                     end
+
                     if data_json.has_key?("request_protections")
                         data_json["request_protections"].each do |protection|
                             context = protection.fetch('variable_context', nil)
@@ -224,6 +243,7 @@ module TCellAgent
                             rule_id = protection.fetch("id",nil)
                             options = protection.fetch('actions', nil)
                             route_ids = []
+
                             if (scope == "global")
                                 route_ids = ["*"]
                             elsif (scope == "route")
@@ -231,9 +251,11 @@ module TCellAgent
                             else
                                 next
                             end
+
                             if context && policy.request_filter_actions.has_key?(context) && variables && options
                                 filter_actions = DataLossPolicy.actions_from_json(options)
                                 if filter_actions != nil
+                                    policy.enabled = true
                                     filter_actions.action_id = rule_id
                                     variables.each do |variable|
                                         route_ids.each  do |route_id|
@@ -249,7 +271,8 @@ module TCellAgent
                             end
                         end
                     end
-                    if data_json.has_key?("db_protections")                        
+
+                    if data_json.has_key?("db_protections")
                         protections = data_json["db_protections"]
                         if protections
                             protections.each do |protection_json|
@@ -262,6 +285,7 @@ module TCellAgent
                                 actions = protection_json.fetch("actions",{})
                                 filter_actions = DataLossPolicy.actions_from_json(actions)
                                 _route_ids = ["*"]
+
                                 if scope != nil && scope != "global"
                                     if scope=="route"
                                         _route_ids = protection_json.fetch("route_ids",[])
@@ -272,6 +296,8 @@ module TCellAgent
                                 elsif filter_actions == nil
                                     next
                                 end
+
+                                policy.enabled = true
                                 filter_actions.action_id = rule_id
                                 _databases.each do |_database|
                                     _schemas.each do |_schema|
@@ -288,6 +314,7 @@ module TCellAgent
                         end
                     end
                 end
+
                 return policy
             end
         end

data/lib/tcell_agent/rails/dlp.rb

@@ -47,7 +47,7 @@ module TCellAgent
           if tcell_context
             tcell_context.database_result_sizes.push(results.size)
 
-            if dlp_policy
+            if dlp_policy && dlp_policy.enabled
               first_record = results.first
               database_name = first_record.class.connection_config().fetch(:database,"*").split('/').last
               model = first_record.class

data/lib/tcell_agent/rust/whisperer.rb

@@ -9,18 +9,22 @@ module TCellAgent
     module Wrapper
       extend FFI::Library
 
-      VERSION = "0.19.5"
+      VERSION = "1.3.0"
       prefix = "lib"
       extension = ".so"
+      variant = ""
       if /cygwin|mswin|mingw|bccwin|wince|emx/ =~ RUBY_PLATFORM
         extension = ".dll"
         prefix = ""
       elsif /darwin/ =~ RUBY_PLATFORM
         extension = ".dylib"
+      elsif /musl/ =~ RUBY_PLATFORM
+        variant = "alpine-"
       end
 
       begin
-        ffi_lib File.join(File.dirname(__FILE__), "#{prefix}tcellagent-#{VERSION}#{extension}")
+        ffi_lib File.join(File.dirname(__FILE__),
+                          "#{prefix}tcellagent-#{variant}#{VERSION}#{extension}")
 
         # All the rust library calls have the following response api:
         #
@@ -82,11 +86,10 @@ module TCellAgent
         if TCellAgent::Rust::Wrapper.common_lib_available?
           allow_payloads = !!TCellAgent.configuration.allow_payloads
           agent_config = {
+            "skip_logger" => true,
             "application" => {
               "app_id" => TCellAgent.configuration.app_id,
               "api_key" =>  TCellAgent.configuration.api_key,
-              "tcell_api_url" => "",
-              "tcell_input_url" => "",
               "allow_payloads" => allow_payloads,
               "js_agent_api_base_url" => TCellAgent.configuration.js_agent_api_base_url,
               "js_agent_url" => TCellAgent.configuration.js_agent_url
@@ -94,7 +97,6 @@ module TCellAgent
             "appfirewall" => {
               "enable_body_xxe_inspection" => false,
               "enable_body_json_inspection" => false,
-              "allow_send_payloads" => allow_payloads,
               "allow_log_payloads" => true
             },
             "policy_versions" => {

data/lib/tcell_agent/version.rb

@@ -1,5 +1,5 @@
 # See the file "LICENSE" for the full license governing this code.
 
 module TCellAgent
-  VERSION = "1.1.2"
+  VERSION = "1.1.3"
 end

data/spec/lib/tcell_agent/rails/middleware/appsensor_middleware_spec.rb

@@ -135,7 +135,12 @@ module TCellAgent
                     'm' => 'GET',
                     'pattern' => 'tc-xss-1',
                     'uri' => 'http://example.org/foo?xyz=',
-                    'meta' => { 'l' => 'query' },
+                    'meta' => {
+                      'l' => 'query',
+                      'h' => [],
+                      'num_headers' => 1,
+                      'summary' => [{ 'n' => 'content-length', 's' => 1 }]
+                    },
                     'payload' => '<SCRIPT>alert(1)</script>'
                   }
                   expect(TCellAgent.event_queue).to include(expected_as)
@@ -151,7 +156,12 @@ module TCellAgent
                     'm' => 'POST',
                     'pattern' => 'tc-xss-1',
                     'uri' => 'http://example.org/foo',
-                    'meta' => { 'l' => 'body' },
+                    'meta' => {
+                      'l' => 'body',
+                      'h' => [],
+                      'num_headers' => 1,
+                      'summary' => [{ 'n' => 'content-length', 's' => 2 }]
+                    },
                     'payload' => '<SCRIPT>alert(1)</SCRIPT>'
                   }
                   expect(TCellAgent.event_queue).to include(expected_as)
@@ -167,7 +177,12 @@ module TCellAgent
                     'm' => 'GET',
                     'pattern' => 'tc-xss-1',
                     'uri' => 'http://example.org/foo?xyz=',
-                    'meta' => { 'l' => 'query' },
+                    'meta' => {
+                      'l' => 'query',
+                      'h' => [],
+                      'num_headers' => 1,
+                      'summary' => [{ 'n' => 'content-length', 's' => 1 }]
+                    },
                     'payload' => '<script>alert(1)</script>'
                   }
                   expect(TCellAgent.event_queue).to include(expected_as)
@@ -212,7 +227,12 @@ module TCellAgent
                   'm' => 'GET',
                   'pattern' => 'tc-sqli-1',
                   'uri' => 'http://example.org/foo?xyz=&def=',
-                  'meta' => { 'l' => 'query' }
+                  'meta' => {
+                    'l' => 'query',
+                    'h' => [],
+                    'num_headers' => 1,
+                    'summary' => [{ 'n' => 'content-length', 's' => 1 }]
+                  }
                 }
                 expect(TCellAgent.event_queue).to include(expected_as)
               end
@@ -255,7 +275,12 @@ module TCellAgent
                   'm' => 'GET',
                   'pattern' => 'tc-fpt-2',
                   'uri' => 'http://example.org/foo?xyz=',
-                  'meta' => { 'l' => 'query' }
+                  'meta' => {
+                    'l' => 'query',
+                    'h' => [],
+                    'num_headers' => 1,
+                    'summary' => [{ 'n' => 'content-length', 's' => 1 }]
+                  }
                 }
                 expect(TCellAgent.event_queue).to include(expected_as)
               end

data/spec/lib/tcell_agent/rust/whisperer_spec.rb

@@ -641,7 +641,7 @@ module TCellAgent
                 'session_id' => 'session_id',
                 'user_id' => 'user_id',
                 'pattern' => 'tc-xss-1',
-                'meta' => { 'l' => 'query' }
+                'meta' => { 'l' => 'query', 'h' => [], 'num_headers' => 0, 'summary' => [] }
               },
               {
                 'detection_point' => 'exsql',

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tcell_agent
 version: !ruby/object:Gem::Version
-  version: 1.1.2
+  version: 1.1.3
 platform: ruby
 authors:
 - Rafael
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-06-19 00:00:00.000000000 Z
+date: 2018-07-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi
@@ -157,10 +157,11 @@ files:
 - lib/tcell_agent/rails/settings_reporter.rb
 - lib/tcell_agent/rails/tcell_body_proxy.rb
 - lib/tcell_agent/routes/table.rb
-- lib/tcell_agent/rust/libtcellagent-0.19.5.dylib
-- lib/tcell_agent/rust/libtcellagent-0.19.5.so
+- lib/tcell_agent/rust/libtcellagent-1.3.0.dylib
+- lib/tcell_agent/rust/libtcellagent-1.3.0.so
+- lib/tcell_agent/rust/libtcellagent-alpine-1.3.0.so
 - lib/tcell_agent/rust/models.rb
-- lib/tcell_agent/rust/tcellagent-0.19.5.dll
+- lib/tcell_agent/rust/tcellagent-1.3.0.dll
 - lib/tcell_agent/rust/whisperer.rb
 - lib/tcell_agent/sensor_events/app_config.rb
 - lib/tcell_agent/sensor_events/appsensor_event.rb