tcell_agent 1.1.3 → 1.1.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/bin/tcell_agent +10 -2
- data/lib/tcell_agent.rb +3 -3
- data/lib/tcell_agent/agent.rb +42 -52
- data/lib/tcell_agent/agent/event_processor.rb +129 -162
- data/lib/tcell_agent/agent/fork_pipe_manager.rb +57 -62
- data/lib/tcell_agent/agent/policy_manager.rb +83 -104
- data/lib/tcell_agent/agent/policy_types.rb +24 -29
- data/lib/tcell_agent/agent/route_manager.rb +36 -46
- data/lib/tcell_agent/agent/static_agent.rb +19 -21
- data/lib/tcell_agent/api.rb +23 -28
- data/lib/tcell_agent/appsensor/injections_reporter.rb +7 -11
- data/lib/tcell_agent/authlogic.rb +7 -7
- data/lib/tcell_agent/cmdi.rb +22 -23
- data/lib/tcell_agent/config/unknown_options.rb +71 -69
- data/lib/tcell_agent/configuration.rb +187 -191
- data/lib/tcell_agent/devise.rb +13 -15
- data/lib/tcell_agent/hooks/login_fraud.rb +1 -1
- data/lib/tcell_agent/instrumentation.rb +120 -124
- data/lib/tcell_agent/logger.rb +29 -45
- data/lib/tcell_agent/patches.rb +5 -5
- data/lib/tcell_agent/policies/dataloss_policy.rb +263 -288
- data/lib/tcell_agent/policies/http_redirect_policy.rb +25 -37
- data/lib/tcell_agent/policies/http_tx_policy.rb +48 -52
- data/lib/tcell_agent/policies/login_fraud_policy.rb +15 -20
- data/lib/tcell_agent/policies/policy.rb +0 -2
- data/lib/tcell_agent/policies/rust_policies.rb +24 -29
- data/lib/tcell_agent/rails.rb +2 -3
- data/lib/tcell_agent/rails/auth/authlogic.rb +2 -2
- data/lib/tcell_agent/rails/auth/devise.rb +2 -2
- data/lib/tcell_agent/rails/auth/doorkeeper.rb +2 -2
- data/lib/tcell_agent/rails/better_ip.rb +12 -16
- data/lib/tcell_agent/rails/csrf_exception.rb +4 -7
- data/lib/tcell_agent/rails/dlp.rb +208 -107
- data/lib/tcell_agent/rails/dlp/process_request.rb +37 -47
- data/lib/tcell_agent/rails/dlp_handler.rb +9 -11
- data/lib/tcell_agent/rails/js_agent_insert.rb +11 -14
- data/lib/tcell_agent/rails/middleware/body_filter_middleware.rb +8 -7
- data/lib/tcell_agent/rails/middleware/context_middleware.rb +4 -5
- data/lib/tcell_agent/rails/middleware/global_middleware.rb +5 -8
- data/lib/tcell_agent/rails/middleware/headers_middleware.rb +24 -27
- data/lib/tcell_agent/rails/on_start.rb +5 -5
- data/lib/tcell_agent/rails/responses.rb +7 -9
- data/lib/tcell_agent/rails/routes.rb +62 -81
- data/lib/tcell_agent/rails/routes/grape.rb +25 -30
- data/lib/tcell_agent/rails/routes/route_id.rb +9 -14
- data/lib/tcell_agent/rails/settings_reporter.rb +44 -33
- data/lib/tcell_agent/rails/tcell_body_proxy.rb +15 -18
- data/lib/tcell_agent/routes/table.rb +31 -33
- data/lib/tcell_agent/rust/{libtcellagent-1.3.0.dylib → libtcellagent-1.3.1.dylib} +0 -0
- data/lib/tcell_agent/rust/{libtcellagent-1.3.0.so → libtcellagent-1.3.1.so} +0 -0
- data/lib/tcell_agent/rust/{libtcellagent-alpine-1.3.0.so → libtcellagent-alpine-1.3.1.so} +0 -0
- data/lib/tcell_agent/rust/models.rb +32 -37
- data/lib/tcell_agent/rust/tcellagent-1.3.1.dll +0 -0
- data/lib/tcell_agent/rust/whisperer.rb +101 -104
- data/lib/tcell_agent/sensor_events/app_config.rb +7 -7
- data/lib/tcell_agent/sensor_events/appsensor_event.rb +26 -27
- data/lib/tcell_agent/sensor_events/appsensor_meta_event.rb +20 -88
- data/lib/tcell_agent/sensor_events/command_injection.rb +52 -80
- data/lib/tcell_agent/sensor_events/discovery.rb +27 -27
- data/lib/tcell_agent/sensor_events/dlp.rb +50 -56
- data/lib/tcell_agent/sensor_events/honeytokens.rb +9 -9
- data/lib/tcell_agent/sensor_events/metrics.rb +20 -21
- data/lib/tcell_agent/sensor_events/patches.rb +10 -12
- data/lib/tcell_agent/sensor_events/sensor.rb +32 -36
- data/lib/tcell_agent/sensor_events/server_agent.rb +130 -127
- data/lib/tcell_agent/sensor_events/util/sanitizer_utilities.rb +60 -80
- data/lib/tcell_agent/sensor_events/util/utils.rb +3 -5
- data/lib/tcell_agent/servers/passenger.rb +5 -9
- data/lib/tcell_agent/servers/puma.rb +18 -27
- data/lib/tcell_agent/servers/rails_server.rb +5 -9
- data/lib/tcell_agent/servers/thin.rb +2 -4
- data/lib/tcell_agent/servers/unicorn.rb +18 -27
- data/lib/tcell_agent/servers/webrick.rb +2 -4
- data/lib/tcell_agent/settings_reporter.rb +126 -0
- data/lib/tcell_agent/sinatra.rb +24 -26
- data/lib/tcell_agent/start_background_thread.rb +21 -142
- data/lib/tcell_agent/system_info.rb +4 -3
- data/lib/tcell_agent/tcell_context.rb +150 -0
- data/lib/tcell_agent/userinfo.rb +3 -3
- data/lib/tcell_agent/utils/io.rb +19 -24
- data/lib/tcell_agent/utils/params.rb +9 -15
- data/lib/tcell_agent/utils/queue_with_timeout.rb +26 -32
- data/lib/tcell_agent/utils/strings.rb +4 -6
- data/lib/tcell_agent/version.rb +1 -1
- data/spec/lib/tcell_agent/agent/policy_manager_spec.rb +5 -5
- data/spec/lib/tcell_agent/agent/static_agent_spec.rb +7 -7
- data/spec/lib/tcell_agent/cmdi_spec.rb +21 -21
- data/spec/lib/tcell_agent/hooks/login_fraud_spec.rb +29 -24
- data/spec/lib/tcell_agent/instrumentation_spec.rb +4 -4
- data/spec/lib/tcell_agent/patches_spec.rb +8 -8
- data/spec/lib/tcell_agent/policies/appsensor_policy_spec.rb +23 -23
- data/spec/lib/tcell_agent/policies/patches_policy_spec.rb +2 -2
- data/spec/lib/tcell_agent/rails/csrf_exception_spec.rb +69 -0
- data/spec/lib/tcell_agent/rails/dlp_spec.rb +1039 -0
- data/spec/lib/tcell_agent/rails/js_agent_insert_spec.rb +271 -0
- data/spec/lib/tcell_agent/rails/logger_spec.rb +5 -5
- data/spec/lib/tcell_agent/rails/middleware/appsensor_middleware_spec.rb +3 -3
- data/spec/lib/tcell_agent/rails/middleware/dlp_middleware_spec.rb +4 -4
- data/spec/lib/tcell_agent/rails/middleware/global_middleware_spec.rb +5 -5
- data/spec/lib/tcell_agent/rails/middleware/redirect_middleware_spec.rb +1 -1
- data/spec/lib/tcell_agent/rails/middleware/tcell_body_proxy_spec.rb +11 -8
- data/spec/lib/tcell_agent/rails/responses_spec.rb +2 -2
- data/spec/lib/tcell_agent/rails/routes/grape_spec.rb +2 -2
- data/spec/lib/tcell_agent/rails/routes/route_id_spec.rb +1 -1
- data/spec/lib/tcell_agent/rails/routes/routes_spec.rb +4 -4
- data/spec/lib/tcell_agent/rust/models_spec.rb +83 -75
- data/spec/lib/tcell_agent/rust/whisperer_spec.rb +14 -14
- data/spec/lib/tcell_agent/sensor_events/appsensor_meta_event_spec.rb +19 -70
- data/spec/lib/tcell_agent/sensor_events/sessions_metric_spec.rb +1 -1
- data/spec/lib/tcell_agent/settings_reporter_spec.rb +162 -0
- data/spec/lib/tcell_agent/tcell_context_spec.rb +154 -0
- data/spec/spec_helper.rb +5 -0
- metadata +18 -10
- data/lib/tcell_agent/appsensor/meta_data.rb +0 -132
- data/lib/tcell_agent/patches/meta_data.rb +0 -59
- data/lib/tcell_agent/rust/tcellagent-1.3.0.dll +0 -0
- data/spec/lib/tcell_agent/appsensor/meta_data_spec.rb +0 -71
@@ -1,7 +1,5 @@
|
|
1
|
-
# encoding: utf-8
|
2
|
-
|
3
1
|
require 'thread'
|
4
|
-
require
|
2
|
+
require 'tcell_agent/logger'
|
5
3
|
|
6
4
|
module TCellAgent
|
7
5
|
class Agent
|
@@ -11,108 +9,105 @@ module TCellAgent
|
|
11
9
|
|
12
10
|
@@parent_id = Process.pid
|
13
11
|
def initialize(&block)
|
14
|
-
|
15
|
-
|
16
|
-
|
17
|
-
@writep.set_encoding(::Encoding::ASCII_8BIT)
|
18
|
-
end
|
19
|
-
if is_parent?
|
20
|
-
self.start_listener(&block)
|
21
|
-
end
|
22
|
-
rescue StandardError => init_exception
|
23
|
-
TCellAgent.logger.error("Could not start listener for pipe to forks")
|
24
|
-
TCellAgent.logger.error(init_exception.message)
|
25
|
-
TCellAgent.logger.debug(init_exception.backtrace)
|
12
|
+
@readp, @writep = IO.pipe('ASCII-8BIT', 'ASCII-8BIT', :binmode => true)
|
13
|
+
if defined?(::Encoding::ASCII_8BIT)
|
14
|
+
@writep.set_encoding(::Encoding::ASCII_8BIT)
|
26
15
|
end
|
16
|
+
start_listener(&block) if parent?
|
17
|
+
rescue StandardError => init_exception
|
18
|
+
TCellAgent.logger.error('Could not start listener for pipe to forks')
|
19
|
+
TCellAgent.logger.error(init_exception.message)
|
20
|
+
TCellAgent.logger.debug(init_exception.backtrace)
|
27
21
|
end
|
28
|
-
|
22
|
+
|
23
|
+
def parent?
|
29
24
|
@@parent_id == Process.pid
|
30
25
|
end
|
26
|
+
|
31
27
|
def start_listener(&block)
|
32
|
-
Thread.new
|
28
|
+
Thread.new do
|
33
29
|
loop do
|
34
30
|
begin
|
35
31
|
packed_bytes = @readp.read(4)
|
36
|
-
event_length = packed_bytes.unpack(
|
32
|
+
event_length = packed_bytes.unpack('L>').first
|
37
33
|
packed_event = @readp.read(event_length)
|
38
|
-
event = Marshal.load(packed_event)
|
39
|
-
if block
|
40
|
-
block.call(event)
|
41
|
-
end
|
34
|
+
event = Marshal.load(packed_event) # rubocop:disable Security/MarshalLoad
|
35
|
+
yield(event) if block
|
42
36
|
rescue StandardError => block_exception
|
43
|
-
TCellAgent.logger.error(
|
37
|
+
TCellAgent.logger.error('Could not decode block')
|
44
38
|
TCellAgent.logger.error(block_exception.message)
|
45
39
|
TCellAgent.logger.debug(block_exception.backtrace)
|
46
40
|
sleep 0.5
|
47
41
|
end
|
48
42
|
end
|
49
|
-
|
43
|
+
end
|
50
44
|
end
|
45
|
+
|
51
46
|
def send_to_parent(event)
|
52
|
-
if
|
53
|
-
|
54
|
-
|
55
|
-
|
56
|
-
|
57
|
-
|
58
|
-
|
59
|
-
|
60
|
-
|
61
|
-
|
62
|
-
TCellAgent.logger.error(block_exception.message)
|
63
|
-
TCellAgent.logger.debug(block_exception.backtrace)
|
64
|
-
end
|
47
|
+
return if parent?
|
48
|
+
|
49
|
+
begin
|
50
|
+
packed_event = Marshal.dump(event)
|
51
|
+
packed_bytes = [packed_event.bytesize].pack('L>')
|
52
|
+
@writep.write(packed_bytes + packed_event)
|
53
|
+
rescue StandardError => block_exception
|
54
|
+
TCellAgent.logger.error('Could not write to pipe')
|
55
|
+
TCellAgent.logger.error(block_exception.message)
|
56
|
+
TCellAgent.logger.debug(block_exception.backtrace)
|
65
57
|
end
|
66
58
|
end
|
67
59
|
end
|
68
60
|
|
69
|
-
@@event_pipe_manager = ForkPipeManager.new
|
61
|
+
@@event_pipe_manager = ForkPipeManager.new do |event|
|
70
62
|
begin
|
71
63
|
TCellAgent.send_event(event)
|
72
64
|
rescue StandardError => block_exception
|
73
|
-
TCellAgent.logger.error(
|
65
|
+
TCellAgent.logger.error('Could handle send_event_block')
|
74
66
|
TCellAgent.logger.error(block_exception.message)
|
75
67
|
TCellAgent.logger.debug(block_exception.backtrace)
|
76
68
|
end
|
77
|
-
|
78
|
-
|
79
|
-
|
80
|
-
|
69
|
+
end
|
70
|
+
|
71
|
+
@@metrics_pipe_manager = ForkPipeManager.new do |val|
|
72
|
+
TCellAgent::Instrumentation.safe_block('Handling metrics_pipe_block') do
|
73
|
+
switch_on = val.fetch('_type', '')
|
81
74
|
case switch_on
|
82
|
-
when
|
75
|
+
when 'increment_route'
|
83
76
|
TCellAgent.increment_route(
|
84
|
-
val.fetch(
|
85
|
-
val.fetch(
|
77
|
+
val.fetch('route_id', nil),
|
78
|
+
val.fetch('response_time', nil)
|
86
79
|
)
|
87
|
-
when
|
80
|
+
when 'discover_database_fields'
|
88
81
|
TCellAgent.discover_database_fields(
|
89
|
-
val.fetch(
|
90
|
-
val.fetch(
|
91
|
-
val.fetch(
|
92
|
-
val.fetch(
|
93
|
-
val.fetch(
|
82
|
+
val.fetch('route_id', nil),
|
83
|
+
val.fetch('database', nil),
|
84
|
+
val.fetch('schema', nil),
|
85
|
+
val.fetch('table', nil),
|
86
|
+
val.fetch('fields', nil)
|
94
87
|
)
|
95
|
-
when
|
88
|
+
when 'increment_session_info'
|
96
89
|
TCellAgent.increment_session_info(
|
97
|
-
val.fetch(
|
98
|
-
val.fetch(
|
99
|
-
val.fetch(
|
100
|
-
val.fetch(
|
90
|
+
val.fetch('hmac_session_id', nil),
|
91
|
+
val.fetch('user_id', nil),
|
92
|
+
val.fetch('ip_address', nil),
|
93
|
+
val.fetch('user_agent', nil)
|
101
94
|
)
|
102
95
|
else
|
103
|
-
raise StandardError
|
96
|
+
raise StandardError, "Metrics Pipe Manager received unknown metric: #{val.fetch('_type', '')}"
|
104
97
|
end
|
105
98
|
end
|
106
|
-
}
|
107
|
-
def self.is_parent_process?
|
108
|
-
@@event_pipe_manager.is_parent?
|
109
99
|
end
|
100
|
+
|
101
|
+
def self.parent_process?
|
102
|
+
@@event_pipe_manager.parent?
|
103
|
+
end
|
104
|
+
|
110
105
|
def self.send_to_metrics_pipe(hash_value)
|
111
106
|
@@metrics_pipe_manager.send_to_parent(hash_value)
|
112
107
|
end
|
108
|
+
|
113
109
|
def self.send_to_event_pipe(event)
|
114
110
|
@@event_pipe_manager.send_to_parent(event)
|
115
111
|
end
|
116
|
-
|
117
112
|
end
|
118
113
|
end
|
@@ -1,20 +1,18 @@
|
|
1
|
-
# encoding: utf-8
|
2
|
-
|
3
1
|
# See the file "LICENSE" for the full license governing this code.
|
4
2
|
|
5
|
-
require
|
6
|
-
require
|
7
|
-
require
|
8
|
-
require
|
3
|
+
require 'tcell_agent/logger'
|
4
|
+
require 'tcell_agent/version'
|
5
|
+
require 'tcell_agent/api'
|
6
|
+
require 'tcell_agent/configuration'
|
9
7
|
|
10
|
-
require
|
8
|
+
require 'tcell_agent/agent/policy_types'
|
11
9
|
|
12
|
-
require
|
13
|
-
require
|
10
|
+
require 'tcell_agent/policies/http_tx_policy'
|
11
|
+
require 'tcell_agent/policies/http_redirect_policy'
|
14
12
|
|
15
|
-
require
|
13
|
+
require 'tcell_agent/sensor_events/server_agent'
|
16
14
|
|
17
|
-
require
|
15
|
+
require 'tcell_agent/utils/queue_with_timeout'
|
18
16
|
|
19
17
|
require 'net/http'
|
20
18
|
require 'thread'
|
@@ -22,11 +20,11 @@ require 'logger'
|
|
22
20
|
require 'json'
|
23
21
|
|
24
22
|
module TCellAgent
|
25
|
-
class Agent
|
26
|
-
|
23
|
+
class Agent # rubocop:disable Metrics/ClassLength
|
27
24
|
def ensure_policy_polling_running
|
28
25
|
return if policy_polling_running?
|
29
26
|
return if TCellAgent.configuration.should_start_policy_poll? == false
|
27
|
+
|
30
28
|
@policy_polling_worker_mutex.synchronize do
|
31
29
|
return if policy_polling_running?
|
32
30
|
start_policy_polling_loop
|
@@ -38,46 +36,43 @@ module TCellAgent
|
|
38
36
|
end
|
39
37
|
|
40
38
|
def stop_policy_polling
|
41
|
-
TCellAgent.logger.debug(
|
42
|
-
if @policy_polling_thread && @policy_polling_thread.alive?
|
43
|
-
@policy_polling_thread.exit
|
44
|
-
end
|
39
|
+
TCellAgent.logger.debug('Stopping policy polling thread')
|
40
|
+
@policy_polling_thread.exit if @policy_polling_thread && @policy_polling_thread.alive?
|
45
41
|
end
|
46
42
|
|
47
43
|
def start_policy_polling_loop
|
48
|
-
|
49
|
-
|
50
|
-
if TCellAgent::Utils::Strings.blank?(TCellAgent.configuration.tcell_api_url)
|
51
|
-
TCellAgent.logger.error("tCell.io tcell_api_url is missing. Disabling policy polling.")
|
52
|
-
return
|
53
|
-
end
|
54
|
-
|
55
|
-
if TCellAgent::Utils::Strings.blank?(TCellAgent.configuration.app_id)
|
56
|
-
TCellAgent.logger.error("tCell.io app_id is missing. Disabling policy polling.")
|
57
|
-
return
|
58
|
-
end
|
59
|
-
|
60
|
-
TCellAgent.logger.debug("Starting policy polling thread")
|
44
|
+
return unless TCellAgent.configuration.should_start_policy_poll?
|
61
45
|
|
62
|
-
|
63
|
-
|
64
|
-
|
65
|
-
|
46
|
+
if TCellAgent::Utils::Strings.blank?(TCellAgent.configuration.tcell_api_url)
|
47
|
+
TCellAgent.logger.error('tCell.io tcell_api_url is missing. Disabling policy polling.')
|
48
|
+
return
|
49
|
+
end
|
66
50
|
|
67
|
-
|
68
|
-
|
51
|
+
if TCellAgent::Utils::Strings.blank?(TCellAgent.configuration.app_id)
|
52
|
+
TCellAgent.logger.error('tCell.io app_id is missing. Disabling policy polling.')
|
53
|
+
return
|
54
|
+
end
|
69
55
|
|
70
|
-
|
71
|
-
if (Time.now - last_run) < 2
|
72
|
-
random = Random.new
|
73
|
-
sleeptime = sleep(random.rand(5..20))
|
74
|
-
TCellAgent.logger.debug("Rate limiting: sleeping #{sleeptime} seconds")
|
75
|
-
sleep(sleeptime)
|
76
|
-
end
|
56
|
+
TCellAgent.logger.debug('Starting policy polling thread')
|
77
57
|
|
78
|
-
|
58
|
+
@policy_polling_thread = Thread.new do
|
59
|
+
failure_sleep_time = 30
|
60
|
+
last_poll_time = 0
|
61
|
+
last_run = Time.now
|
62
|
+
|
63
|
+
loop do
|
64
|
+
failure_sleep_time, last_poll_time = policy_polling_iteration(failure_sleep_time, last_poll_time)
|
65
|
+
|
66
|
+
unless TCellAgent.configuration.demomode
|
67
|
+
if (Time.now - last_run) < 2
|
68
|
+
random = Random.new
|
69
|
+
sleeptime = sleep(random.rand(5..20))
|
70
|
+
TCellAgent.logger.debug("Rate limiting: sleeping #{sleeptime} seconds")
|
71
|
+
sleep(sleeptime)
|
79
72
|
end
|
80
73
|
end
|
74
|
+
|
75
|
+
last_run = Time.now
|
81
76
|
end
|
82
77
|
end
|
83
78
|
end
|
@@ -86,115 +81,105 @@ module TCellAgent
|
|
86
81
|
begin
|
87
82
|
policy_jsons = @@policy_tapi.poll_api(last_poll_time)
|
88
83
|
|
89
|
-
if policy_jsons
|
84
|
+
if policy_jsons.nil?
|
90
85
|
TCellAgent.logger.error("Policy was nil. Sleeping for #{failure_sleep_time}")
|
91
86
|
|
92
87
|
sleep(failure_sleep_time)
|
93
88
|
|
94
|
-
if failure_sleep_time < 480
|
95
|
-
failure_sleep_time *= 2
|
96
|
-
end
|
89
|
+
failure_sleep_time *= 2 if failure_sleep_time < 480
|
97
90
|
|
98
91
|
return [failure_sleep_time, last_poll_time]
|
99
92
|
|
100
|
-
elsif policy_jsons.key?(
|
101
|
-
if policy_jsons[
|
102
|
-
last_poll_time = policy_jsons[
|
93
|
+
elsif policy_jsons.key?('last_id')
|
94
|
+
if policy_jsons['last_id'] != 0
|
95
|
+
last_poll_time = policy_jsons['last_id']
|
103
96
|
end
|
104
97
|
end
|
105
98
|
|
106
99
|
failure_sleep_time = 30
|
107
100
|
|
108
|
-
|
109
|
-
|
101
|
+
process_policy_json(policy_jsons)
|
110
102
|
rescue TCellAgent::ConfigurationException
|
111
103
|
Thread.exit
|
112
104
|
rescue StandardError => e
|
113
105
|
TCellAgent.logger.error("exception while handling connection: #{e.message}")
|
114
106
|
TCellAgent.logger.debug(e.backtrace)
|
115
|
-
TCellAgent.logger.debug(
|
107
|
+
TCellAgent.logger.debug('Sleeping 30 seconds because the tCell.io request failed...')
|
116
108
|
sleep(failure_sleep_time)
|
117
109
|
|
118
|
-
if failure_sleep_time < 480
|
119
|
-
failure_sleep_time *= 2
|
120
|
-
end
|
110
|
+
failure_sleep_time *= 2 if failure_sleep_time < 480
|
121
111
|
end
|
122
112
|
|
123
113
|
[failure_sleep_time, last_poll_time]
|
124
114
|
end
|
125
115
|
|
126
|
-
def
|
116
|
+
def process_policy_json(policy_jsons, cache_the_policy = true)
|
127
117
|
return if policy_jsons.nil?
|
128
118
|
|
129
|
-
TCellAgent::PolicyTypes::
|
130
|
-
|
131
|
-
|
132
|
-
|
133
|
-
|
134
|
-
|
135
|
-
end
|
136
|
-
end
|
119
|
+
TCellAgent::PolicyTypes::CLASS_MAP.each do |policy_type, policy_class|
|
120
|
+
next unless policy_jsons.key?(policy_type)
|
121
|
+
new_policy = policy_class.from_json(policy_jsons[policy_type])
|
122
|
+
next unless new_policy
|
123
|
+
@lock.synchronize do
|
124
|
+
@policies[policy_type] = new_policy
|
137
125
|
end
|
138
126
|
end
|
139
127
|
|
140
|
-
@policies[TCellAgent::PolicyTypes::
|
141
|
-
|
142
|
-
|
143
|
-
|
144
|
-
|
145
|
-
|
146
|
-
|
147
|
-
|
148
|
-
|
149
|
-
|
150
|
-
|
151
|
-
|
152
|
-
|
153
|
-
|
154
|
-
|
128
|
+
@policies[TCellAgent::PolicyTypes::RUST].update_policies(policy_jsons)
|
129
|
+
|
130
|
+
return unless cache_the_policy
|
131
|
+
|
132
|
+
(TCellAgent::PolicyTypes::CLASS_MAP.keys +
|
133
|
+
[TCellAgent::PolicyTypes::CSP,
|
134
|
+
TCellAgent::PolicyTypes::CLICKJACKING,
|
135
|
+
TCellAgent::PolicyTypes::SECUREHEADERS,
|
136
|
+
TCellAgent::PolicyTypes::JSAGENTINJECTION,
|
137
|
+
TCellAgent::PolicyTypes::APPSENSOR,
|
138
|
+
TCellAgent::PolicyTypes::PATCHES,
|
139
|
+
TCellAgent::PolicyTypes::COMMANDINJECTION,
|
140
|
+
TCellAgent::PolicyTypes::REGEX]).each do |policy_type|
|
141
|
+
@lock.synchronize do
|
142
|
+
cache(policy_type, policy_jsons[policy_type]) if policy_jsons[policy_type]
|
155
143
|
end
|
156
|
-
|
144
|
+
end
|
157
145
|
end
|
158
146
|
|
159
147
|
def cache(policy_name, policy)
|
160
148
|
cache_filename = TCellAgent.configuration.cache_filename_with_app_id
|
161
149
|
|
162
150
|
begin
|
163
|
-
|
164
151
|
TCellAgent::Utils::IO.create_directory(
|
165
152
|
File.dirname(cache_filename),
|
166
153
|
TCellAgent.configuration.agent_home_owner
|
167
154
|
)
|
168
155
|
|
169
|
-
f1 = File.open(cache_filename, File::RDWR|File::CREAT)
|
156
|
+
f1 = File.open(cache_filename, File::RDWR | File::CREAT)
|
170
157
|
|
171
|
-
Timeout
|
158
|
+
Timeout.timeout(0.100) { f1.flock(File::LOCK_EX) }
|
172
159
|
|
173
160
|
policy_cache = {}
|
174
161
|
existing_policy = f1.read
|
175
162
|
|
176
163
|
begin
|
177
|
-
if !existing_policy.nil? && existing_policy !=
|
164
|
+
if !existing_policy.nil? && existing_policy != ''
|
178
165
|
policy_jsons = JSON.parse(existing_policy)
|
179
166
|
if policy_jsons
|
180
|
-
if policy_jsons.key?(
|
181
|
-
|
182
|
-
|
183
|
-
|
184
|
-
|
167
|
+
policy_cache = if policy_jsons.key?('result')
|
168
|
+
policy_jsons['result']
|
169
|
+
else
|
170
|
+
policy_jsons
|
171
|
+
end
|
185
172
|
end
|
186
173
|
end
|
187
174
|
policy_cache[policy_name] = policy
|
188
175
|
@complete_policy_cache = policy_cache
|
189
176
|
rescue StandardError => e
|
190
177
|
TCellAgent.logger.warn(e.message)
|
191
|
-
if @complete_policy_cache
|
192
|
-
policy_cache = @complete_policy_cache
|
193
|
-
end
|
178
|
+
policy_cache = @complete_policy_cache if @complete_policy_cache
|
194
179
|
end
|
195
180
|
|
196
181
|
f1.rewind
|
197
|
-
f1.write(
|
182
|
+
f1.write(JSON.dump(policy_cache))
|
198
183
|
f1.flush
|
199
184
|
f1.truncate(f1.pos)
|
200
185
|
|
@@ -204,11 +189,9 @@ module TCellAgent
|
|
204
189
|
)
|
205
190
|
rescue StandardError => e
|
206
191
|
TCellAgent.logger.warn(e.message)
|
207
|
-
|
208
192
|
ensure
|
209
193
|
f1.close unless f1.nil?
|
210
194
|
end
|
211
|
-
|
212
195
|
end
|
213
196
|
|
214
197
|
def policies_from_cachefile
|
@@ -218,23 +201,19 @@ module TCellAgent
|
|
218
201
|
|
219
202
|
begin
|
220
203
|
f1 = File.open(cache_filename, File::RDONLY)
|
221
|
-
Timeout
|
204
|
+
Timeout.timeout(1) { f1.flock(File::LOCK_SH) }
|
222
205
|
policy_filedata = f1.read
|
223
206
|
f1.close
|
224
207
|
|
225
208
|
policy_jsons = JSON.parse(policy_filedata)
|
226
|
-
if policy_jsons.key?(
|
227
|
-
return policy_jsons["result"]
|
228
|
-
end
|
209
|
+
return policy_jsons['result'] if policy_jsons.key?('result')
|
229
210
|
@complete_policy_cache = policy_jsons
|
230
211
|
return policy_jsons
|
231
|
-
|
232
212
|
rescue StandardError => e
|
233
213
|
TCellAgent.logger.warn(e.message)
|
234
214
|
end
|
235
215
|
|
236
|
-
|
216
|
+
nil
|
237
217
|
end
|
238
|
-
|
239
218
|
end
|
240
219
|
end
|