tcell_agent 1.1.3 → 1.1.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/bin/tcell_agent +10 -2
- data/lib/tcell_agent.rb +3 -3
- data/lib/tcell_agent/agent.rb +42 -52
- data/lib/tcell_agent/agent/event_processor.rb +129 -162
- data/lib/tcell_agent/agent/fork_pipe_manager.rb +57 -62
- data/lib/tcell_agent/agent/policy_manager.rb +83 -104
- data/lib/tcell_agent/agent/policy_types.rb +24 -29
- data/lib/tcell_agent/agent/route_manager.rb +36 -46
- data/lib/tcell_agent/agent/static_agent.rb +19 -21
- data/lib/tcell_agent/api.rb +23 -28
- data/lib/tcell_agent/appsensor/injections_reporter.rb +7 -11
- data/lib/tcell_agent/authlogic.rb +7 -7
- data/lib/tcell_agent/cmdi.rb +22 -23
- data/lib/tcell_agent/config/unknown_options.rb +71 -69
- data/lib/tcell_agent/configuration.rb +187 -191
- data/lib/tcell_agent/devise.rb +13 -15
- data/lib/tcell_agent/hooks/login_fraud.rb +1 -1
- data/lib/tcell_agent/instrumentation.rb +120 -124
- data/lib/tcell_agent/logger.rb +29 -45
- data/lib/tcell_agent/patches.rb +5 -5
- data/lib/tcell_agent/policies/dataloss_policy.rb +263 -288
- data/lib/tcell_agent/policies/http_redirect_policy.rb +25 -37
- data/lib/tcell_agent/policies/http_tx_policy.rb +48 -52
- data/lib/tcell_agent/policies/login_fraud_policy.rb +15 -20
- data/lib/tcell_agent/policies/policy.rb +0 -2
- data/lib/tcell_agent/policies/rust_policies.rb +24 -29
- data/lib/tcell_agent/rails.rb +2 -3
- data/lib/tcell_agent/rails/auth/authlogic.rb +2 -2
- data/lib/tcell_agent/rails/auth/devise.rb +2 -2
- data/lib/tcell_agent/rails/auth/doorkeeper.rb +2 -2
- data/lib/tcell_agent/rails/better_ip.rb +12 -16
- data/lib/tcell_agent/rails/csrf_exception.rb +4 -7
- data/lib/tcell_agent/rails/dlp.rb +208 -107
- data/lib/tcell_agent/rails/dlp/process_request.rb +37 -47
- data/lib/tcell_agent/rails/dlp_handler.rb +9 -11
- data/lib/tcell_agent/rails/js_agent_insert.rb +11 -14
- data/lib/tcell_agent/rails/middleware/body_filter_middleware.rb +8 -7
- data/lib/tcell_agent/rails/middleware/context_middleware.rb +4 -5
- data/lib/tcell_agent/rails/middleware/global_middleware.rb +5 -8
- data/lib/tcell_agent/rails/middleware/headers_middleware.rb +24 -27
- data/lib/tcell_agent/rails/on_start.rb +5 -5
- data/lib/tcell_agent/rails/responses.rb +7 -9
- data/lib/tcell_agent/rails/routes.rb +62 -81
- data/lib/tcell_agent/rails/routes/grape.rb +25 -30
- data/lib/tcell_agent/rails/routes/route_id.rb +9 -14
- data/lib/tcell_agent/rails/settings_reporter.rb +44 -33
- data/lib/tcell_agent/rails/tcell_body_proxy.rb +15 -18
- data/lib/tcell_agent/routes/table.rb +31 -33
- data/lib/tcell_agent/rust/{libtcellagent-1.3.0.dylib → libtcellagent-1.3.1.dylib} +0 -0
- data/lib/tcell_agent/rust/{libtcellagent-1.3.0.so → libtcellagent-1.3.1.so} +0 -0
- data/lib/tcell_agent/rust/{libtcellagent-alpine-1.3.0.so → libtcellagent-alpine-1.3.1.so} +0 -0
- data/lib/tcell_agent/rust/models.rb +32 -37
- data/lib/tcell_agent/rust/tcellagent-1.3.1.dll +0 -0
- data/lib/tcell_agent/rust/whisperer.rb +101 -104
- data/lib/tcell_agent/sensor_events/app_config.rb +7 -7
- data/lib/tcell_agent/sensor_events/appsensor_event.rb +26 -27
- data/lib/tcell_agent/sensor_events/appsensor_meta_event.rb +20 -88
- data/lib/tcell_agent/sensor_events/command_injection.rb +52 -80
- data/lib/tcell_agent/sensor_events/discovery.rb +27 -27
- data/lib/tcell_agent/sensor_events/dlp.rb +50 -56
- data/lib/tcell_agent/sensor_events/honeytokens.rb +9 -9
- data/lib/tcell_agent/sensor_events/metrics.rb +20 -21
- data/lib/tcell_agent/sensor_events/patches.rb +10 -12
- data/lib/tcell_agent/sensor_events/sensor.rb +32 -36
- data/lib/tcell_agent/sensor_events/server_agent.rb +130 -127
- data/lib/tcell_agent/sensor_events/util/sanitizer_utilities.rb +60 -80
- data/lib/tcell_agent/sensor_events/util/utils.rb +3 -5
- data/lib/tcell_agent/servers/passenger.rb +5 -9
- data/lib/tcell_agent/servers/puma.rb +18 -27
- data/lib/tcell_agent/servers/rails_server.rb +5 -9
- data/lib/tcell_agent/servers/thin.rb +2 -4
- data/lib/tcell_agent/servers/unicorn.rb +18 -27
- data/lib/tcell_agent/servers/webrick.rb +2 -4
- data/lib/tcell_agent/settings_reporter.rb +126 -0
- data/lib/tcell_agent/sinatra.rb +24 -26
- data/lib/tcell_agent/start_background_thread.rb +21 -142
- data/lib/tcell_agent/system_info.rb +4 -3
- data/lib/tcell_agent/tcell_context.rb +150 -0
- data/lib/tcell_agent/userinfo.rb +3 -3
- data/lib/tcell_agent/utils/io.rb +19 -24
- data/lib/tcell_agent/utils/params.rb +9 -15
- data/lib/tcell_agent/utils/queue_with_timeout.rb +26 -32
- data/lib/tcell_agent/utils/strings.rb +4 -6
- data/lib/tcell_agent/version.rb +1 -1
- data/spec/lib/tcell_agent/agent/policy_manager_spec.rb +5 -5
- data/spec/lib/tcell_agent/agent/static_agent_spec.rb +7 -7
- data/spec/lib/tcell_agent/cmdi_spec.rb +21 -21
- data/spec/lib/tcell_agent/hooks/login_fraud_spec.rb +29 -24
- data/spec/lib/tcell_agent/instrumentation_spec.rb +4 -4
- data/spec/lib/tcell_agent/patches_spec.rb +8 -8
- data/spec/lib/tcell_agent/policies/appsensor_policy_spec.rb +23 -23
- data/spec/lib/tcell_agent/policies/patches_policy_spec.rb +2 -2
- data/spec/lib/tcell_agent/rails/csrf_exception_spec.rb +69 -0
- data/spec/lib/tcell_agent/rails/dlp_spec.rb +1039 -0
- data/spec/lib/tcell_agent/rails/js_agent_insert_spec.rb +271 -0
- data/spec/lib/tcell_agent/rails/logger_spec.rb +5 -5
- data/spec/lib/tcell_agent/rails/middleware/appsensor_middleware_spec.rb +3 -3
- data/spec/lib/tcell_agent/rails/middleware/dlp_middleware_spec.rb +4 -4
- data/spec/lib/tcell_agent/rails/middleware/global_middleware_spec.rb +5 -5
- data/spec/lib/tcell_agent/rails/middleware/redirect_middleware_spec.rb +1 -1
- data/spec/lib/tcell_agent/rails/middleware/tcell_body_proxy_spec.rb +11 -8
- data/spec/lib/tcell_agent/rails/responses_spec.rb +2 -2
- data/spec/lib/tcell_agent/rails/routes/grape_spec.rb +2 -2
- data/spec/lib/tcell_agent/rails/routes/route_id_spec.rb +1 -1
- data/spec/lib/tcell_agent/rails/routes/routes_spec.rb +4 -4
- data/spec/lib/tcell_agent/rust/models_spec.rb +83 -75
- data/spec/lib/tcell_agent/rust/whisperer_spec.rb +14 -14
- data/spec/lib/tcell_agent/sensor_events/appsensor_meta_event_spec.rb +19 -70
- data/spec/lib/tcell_agent/sensor_events/sessions_metric_spec.rb +1 -1
- data/spec/lib/tcell_agent/settings_reporter_spec.rb +162 -0
- data/spec/lib/tcell_agent/tcell_context_spec.rb +154 -0
- data/spec/spec_helper.rb +5 -0
- metadata +18 -10
- data/lib/tcell_agent/appsensor/meta_data.rb +0 -132
- data/lib/tcell_agent/patches/meta_data.rb +0 -59
- data/lib/tcell_agent/rust/tcellagent-1.3.0.dll +0 -0
- data/spec/lib/tcell_agent/appsensor/meta_data_spec.rb +0 -71
@@ -3,27 +3,29 @@ require 'set'
|
|
3
3
|
module TCellAgent
|
4
4
|
module Config
|
5
5
|
module Validate
|
6
|
-
|
7
6
|
def self.get_unknown_options(config_json)
|
8
7
|
messages = []
|
9
8
|
|
10
|
-
known_tcell_env_vars = Set.new(
|
11
|
-
|
12
|
-
|
13
|
-
|
14
|
-
|
15
|
-
|
16
|
-
|
17
|
-
|
18
|
-
|
19
|
-
|
20
|
-
|
21
|
-
|
22
|
-
|
23
|
-
|
24
|
-
|
25
|
-
|
26
|
-
|
9
|
+
known_tcell_env_vars = Set.new(
|
10
|
+
[
|
11
|
+
'TCELL_AGENT_SERVER', # this is only meant for specs
|
12
|
+
'TCELL_AGENT_APP_ID',
|
13
|
+
'TCELL_AGENT_API_KEY',
|
14
|
+
'TCELL_HMAC_KEY',
|
15
|
+
'TCELL_PASSWORD_HMAC_KEY',
|
16
|
+
'TCELL_AGENT_HOST_IDENTIFIER',
|
17
|
+
'TCELL_API_URL',
|
18
|
+
'TCELL_INPUT_URL',
|
19
|
+
'TCELL_DEMOMODE',
|
20
|
+
'TCELL_AGENT_HOME',
|
21
|
+
'TCELL_AGENT_LOG_DIR',
|
22
|
+
'TCELL_AGENT_CONFIG',
|
23
|
+
'TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS',
|
24
|
+
'TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS',
|
25
|
+
'TCELL_AGENT_ALLOW_PAYLOADS',
|
26
|
+
'TCELL_AGENT_HOME_OWNER'
|
27
|
+
]
|
28
|
+
)
|
27
29
|
|
28
30
|
ENV.keys.each do |environment_key|
|
29
31
|
if environment_key =~ /^TCELL_/ && !known_tcell_env_vars.include?(environment_key)
|
@@ -35,70 +37,71 @@ module TCellAgent
|
|
35
37
|
key_differences = []
|
36
38
|
|
37
39
|
if config_json
|
38
|
-
first_level_keys = [
|
40
|
+
first_level_keys = %w[version applications]
|
39
41
|
|
40
42
|
key_differences = config_json.keys - first_level_keys
|
41
43
|
|
42
|
-
applications = config_json.fetch(
|
44
|
+
applications = config_json.fetch('applications', nil)
|
43
45
|
if applications
|
44
46
|
|
45
47
|
if applications.size > 1
|
46
|
-
messages <<
|
48
|
+
messages << 'Multiple applications detected in config file'
|
47
49
|
|
48
50
|
elsif applications.size == 1
|
49
51
|
application = applications[0]
|
50
52
|
|
51
|
-
second_level_keys = [
|
52
|
-
|
53
|
-
|
54
|
-
|
55
|
-
|
56
|
-
|
57
|
-
|
58
|
-
|
59
|
-
|
60
|
-
|
61
|
-
|
62
|
-
|
63
|
-
|
64
|
-
|
65
|
-
|
66
|
-
|
67
|
-
|
68
|
-
|
69
|
-
|
70
|
-
|
71
|
-
|
72
|
-
|
73
|
-
|
74
|
-
|
75
|
-
|
76
|
-
|
77
|
-
|
78
|
-
|
79
|
-
|
80
|
-
|
81
|
-
|
82
|
-
|
83
|
-
|
84
|
-
|
85
|
-
|
86
|
-
|
87
|
-
|
88
|
-
|
89
|
-
|
90
|
-
|
91
|
-
|
53
|
+
second_level_keys = %w[
|
54
|
+
name
|
55
|
+
app_id
|
56
|
+
api_key
|
57
|
+
fetch_policies_from_tcell
|
58
|
+
preload_policy_filename
|
59
|
+
log_dir
|
60
|
+
tcell_api_url
|
61
|
+
tcell_input_url
|
62
|
+
host_identifier
|
63
|
+
hipaaSafeMode
|
64
|
+
hmac_key
|
65
|
+
password_hmac_key
|
66
|
+
js_agent_api_base_url
|
67
|
+
js_agent_url
|
68
|
+
max_csp_header_bytes
|
69
|
+
event_batch_size_limit
|
70
|
+
allow_unencrypted_appsensor_payloads
|
71
|
+
allow_unencrypted_appfirewall_payloads
|
72
|
+
allow_payloads
|
73
|
+
reverse_proxy
|
74
|
+
reverse_proxy_ip_address_header
|
75
|
+
demomode
|
76
|
+
logging_options
|
77
|
+
data_exposure
|
78
|
+
disable_all
|
79
|
+
enabled
|
80
|
+
enable_event_manager
|
81
|
+
enable_event_consumer
|
82
|
+
enable_policy_polling
|
83
|
+
enable_instrumentation
|
84
|
+
enable_intercept_requests
|
85
|
+
instrument_for_events
|
86
|
+
agent_home_owner
|
87
|
+
enabled_instrumentations
|
88
|
+
]
|
89
|
+
|
90
|
+
key_differences += (application.keys - second_level_keys)
|
91
|
+
|
92
|
+
if application.fetch('logging_options', nil)
|
93
|
+
logging_options = application['logging_options']
|
94
|
+
key_differences += (logging_options.keys - %w[enabled level filename])
|
92
95
|
end
|
93
96
|
|
94
|
-
if application.fetch(
|
95
|
-
data_exposure = application[
|
96
|
-
key_differences
|
97
|
+
if application.fetch('data_exposure', nil)
|
98
|
+
data_exposure = application['data_exposure']
|
99
|
+
key_differences += (data_exposure.keys - ['max_data_ex_db_records_per_request'])
|
97
100
|
end
|
98
101
|
|
99
|
-
if application.fetch(
|
100
|
-
enabled_instrumentations = application[
|
101
|
-
key_differences
|
102
|
+
if application.fetch('enabled_instrumentations', nil)
|
103
|
+
enabled_instrumentations = application['enabled_instrumentations']
|
104
|
+
key_differences += (enabled_instrumentations.keys - %w[doorkeeper devise authlogic])
|
102
105
|
end
|
103
106
|
end
|
104
107
|
end
|
@@ -114,7 +117,6 @@ module TCellAgent
|
|
114
117
|
|
115
118
|
messages
|
116
119
|
end
|
117
|
-
|
118
120
|
end
|
119
121
|
end
|
120
122
|
end
|
@@ -21,46 +21,46 @@ module TCellAgent
|
|
21
21
|
yield(configuration)
|
22
22
|
end
|
23
23
|
|
24
|
-
class Configuration
|
24
|
+
class Configuration # rubocop:disable Metrics/ClassLength
|
25
25
|
attr_accessor :version,
|
26
|
-
|
27
|
-
|
28
|
-
|
29
|
-
|
30
|
-
|
31
|
-
|
32
|
-
|
33
|
-
|
34
|
-
|
35
|
-
|
36
|
-
|
37
|
-
|
38
|
-
|
39
|
-
|
40
|
-
|
41
|
-
|
42
|
-
|
43
|
-
|
44
|
-
|
45
|
-
|
46
|
-
|
47
|
-
|
48
|
-
|
49
|
-
|
50
|
-
|
51
|
-
|
52
|
-
|
53
|
-
|
54
|
-
|
55
|
-
|
26
|
+
:app_id,
|
27
|
+
:api_key,
|
28
|
+
:hmac_key,
|
29
|
+
:tcell_api_url,
|
30
|
+
:tcell_input_url,
|
31
|
+
:logging_options,
|
32
|
+
:logger,
|
33
|
+
:appfirewall_payloads_logger, # appfirewall_payloads_logger can be specified from initializers
|
34
|
+
:fetch_policies_from_tcell, :instrument_for_events,
|
35
|
+
:preload_policy_filename,
|
36
|
+
:host_identifier,
|
37
|
+
:uuid,
|
38
|
+
:event_batch_size_limit, :event_time_limit_seconds,
|
39
|
+
:base_dir,
|
40
|
+
:cache_filename,
|
41
|
+
:js_agent_api_base_url,
|
42
|
+
:js_agent_url,
|
43
|
+
:config_filename,
|
44
|
+
:agent_log_dir,
|
45
|
+
:max_data_ex_db_records_per_request,
|
46
|
+
:agent_home_dir,
|
47
|
+
:agent_home_owner,
|
48
|
+
:reverse_proxy,
|
49
|
+
:reverse_proxy_ip_address_header,
|
50
|
+
:log_file_name,
|
51
|
+
:log_tag,
|
52
|
+
:max_csp_header_bytes,
|
53
|
+
:demomode,
|
54
|
+
:allow_payloads,
|
55
|
+
:password_hmac_key
|
56
56
|
|
57
57
|
attr_accessor :disable_all,
|
58
|
-
|
59
|
-
|
60
|
-
|
61
|
-
|
62
|
-
|
63
|
-
|
58
|
+
:enabled,
|
59
|
+
:enable_event_manager, # false = Do not start the even manager
|
60
|
+
:enable_event_consumer, # false = Do not consume events, drop them
|
61
|
+
:enable_policy_polling, # false = Do not poll for policies
|
62
|
+
:enable_instrumentation, # false = Do not add instrumentation
|
63
|
+
:enable_intercept_requests # false = Do not insert middleware
|
64
64
|
|
65
65
|
attr_accessor :enabled_instrumentations
|
66
66
|
|
@@ -87,30 +87,30 @@ module TCellAgent
|
|
87
87
|
end
|
88
88
|
|
89
89
|
def should_instrument_doorkeeper?
|
90
|
-
if @enabled_instrumentations.
|
91
|
-
!!(@enabled_instrumentations['doorkeeper'] || @enabled_instrumentations[:doorkeeper])
|
90
|
+
if @enabled_instrumentations.key?('doorkeeper') || @enabled_instrumentations.key?(:doorkeeper)
|
91
|
+
!!(@enabled_instrumentations['doorkeeper'] || @enabled_instrumentations[:doorkeeper]) # rubocop:disable Style/DoubleNegation
|
92
92
|
else
|
93
93
|
true
|
94
94
|
end
|
95
95
|
end
|
96
96
|
|
97
97
|
def should_instrument_devise?
|
98
|
-
if @enabled_instrumentations.
|
99
|
-
!!(@enabled_instrumentations['devise'] || @enabled_instrumentations[:devise])
|
98
|
+
if @enabled_instrumentations.key?('devise') || @enabled_instrumentations.key?(:devise)
|
99
|
+
!!(@enabled_instrumentations['devise'] || @enabled_instrumentations[:devise]) # rubocop:disable Style/DoubleNegation
|
100
100
|
else
|
101
101
|
true
|
102
102
|
end
|
103
103
|
end
|
104
104
|
|
105
105
|
def should_instrument_authlogic?
|
106
|
-
if @enabled_instrumentations.
|
107
|
-
!!(@enabled_instrumentations['authlogic'] || @enabled_instrumentations[:authlogic])
|
106
|
+
if @enabled_instrumentations.key?('authlogic') || @enabled_instrumentations.key?(:authlogic)
|
107
|
+
!!(@enabled_instrumentations['authlogic'] || @enabled_instrumentations[:authlogic]) # rubocop:disable Style/DoubleNegation
|
108
108
|
else
|
109
109
|
true
|
110
110
|
end
|
111
111
|
end
|
112
112
|
|
113
|
-
def initialize(filename=
|
113
|
+
def initialize(filename = 'config/tcell_agent.config', _useapp = nil)
|
114
114
|
# These will be set when the agent starts up, to give rails initializers
|
115
115
|
# a chance to run
|
116
116
|
@cache_filename = nil
|
@@ -141,7 +141,7 @@ module TCellAgent
|
|
141
141
|
:authlogic => true
|
142
142
|
}
|
143
143
|
|
144
|
-
@log_file_name =
|
144
|
+
@log_file_name = 'tcell_agent.log'
|
145
145
|
|
146
146
|
@event_batch_size_limit = 50
|
147
147
|
@event_time_limit_seconds = 15
|
@@ -154,8 +154,8 @@ module TCellAgent
|
|
154
154
|
@max_csp_header_bytes = nil
|
155
155
|
@password_hmac_key = nil
|
156
156
|
|
157
|
-
@agent_home_dir = ENV[
|
158
|
-
@config_filename = ENV[
|
157
|
+
@agent_home_dir = ENV['TCELL_AGENT_HOME'] || File.join(Dir.getwd, 'tcell')
|
158
|
+
@config_filename = ENV['TCELL_AGENT_CONFIG'] || File.join(Dir.getwd, filename)
|
159
159
|
|
160
160
|
read_config_from_file(@config_filename)
|
161
161
|
read_config_using_env
|
@@ -165,33 +165,33 @@ module TCellAgent
|
|
165
165
|
@event_time_limit_seconds = 2
|
166
166
|
end
|
167
167
|
|
168
|
-
if ENV[
|
169
|
-
puts
|
168
|
+
if ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS']
|
169
|
+
puts 'tCell.io Agent: [DEPRECATED] TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS is deprecated and will be removed in a future release. Please switch to TCELL_AGENT_ALLOW_PAYLOADS.'
|
170
170
|
end
|
171
171
|
|
172
|
-
if
|
173
|
-
puts
|
172
|
+
if ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS']
|
173
|
+
puts 'tCell.io Agent: [DEPRECATED] TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS is deprecated and will be removed in a future release. Please switch to TCELL_AGENT_ALLOW_PAYLOADS.'
|
174
174
|
end
|
175
175
|
|
176
|
-
|
177
|
-
@allow_payloads = [true,
|
176
|
+
unless ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS'].nil?
|
177
|
+
@allow_payloads = [true, 'true', 'yes', '1'].include?(ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS'])
|
178
178
|
end
|
179
|
-
|
180
|
-
@allow_payloads = [true,
|
179
|
+
unless ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS'].nil?
|
180
|
+
@allow_payloads = [true, 'true', 'yes', '1'].include?(ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS'])
|
181
181
|
end
|
182
|
-
|
183
|
-
@allow_payloads = [true,
|
182
|
+
unless ENV['TCELL_AGENT_ALLOW_PAYLOADS'].nil?
|
183
|
+
@allow_payloads = [true, 'true', 'yes', '1'].include?(ENV['TCELL_AGENT_ALLOW_PAYLOADS'])
|
184
184
|
end
|
185
185
|
|
186
186
|
@tcell_api_url = compose_api_url!
|
187
|
-
@tcell_input_url ||=
|
188
|
-
@js_agent_url ||=
|
187
|
+
@tcell_input_url ||= 'https://input.tcell.io/api/v1'
|
188
|
+
@js_agent_url ||= 'https://jsagent.tcell.io/tcellagent.min.js'
|
189
189
|
|
190
|
-
if
|
190
|
+
if @host_identifier.nil?
|
191
191
|
begin
|
192
|
-
@host_identifier = (Socket.gethostname
|
192
|
+
@host_identifier = (Socket.gethostname || 'localhost')
|
193
193
|
rescue StandardError
|
194
|
-
@host_identifier =
|
194
|
+
@host_identifier = 'host_identifier_not_found'
|
195
195
|
end
|
196
196
|
end
|
197
197
|
|
@@ -199,12 +199,12 @@ module TCellAgent
|
|
199
199
|
end
|
200
200
|
|
201
201
|
def compose_api_url!
|
202
|
-
@tcell_api_url ||=
|
202
|
+
@tcell_api_url ||= 'https://api.tcell.io'
|
203
203
|
parsed_uri = URI.parse(@tcell_api_url)
|
204
204
|
|
205
205
|
api_url = [
|
206
206
|
parsed_uri.scheme,
|
207
|
-
|
207
|
+
'://',
|
208
208
|
parsed_uri.host
|
209
209
|
]
|
210
210
|
|
@@ -214,26 +214,26 @@ module TCellAgent
|
|
214
214
|
|
215
215
|
[
|
216
216
|
api_url.join(''),
|
217
|
-
|
218
|
-
|
219
|
-
|
220
|
-
|
221
|
-
|
222
|
-
|
223
|
-
|
224
|
-
|
225
|
-
|
226
|
-
|
227
|
-
|
228
|
-
|
229
|
-
|
230
|
-
|
231
|
-
|
217
|
+
'/agents/api/v1/apps/',
|
218
|
+
'{app_id}',
|
219
|
+
'/policies/latest',
|
220
|
+
'?',
|
221
|
+
'type=jsagentinjection:v1',
|
222
|
+
'&type=http-redirect:v1',
|
223
|
+
'&type=clickjacking:v1',
|
224
|
+
'&type=secure-headers:v1',
|
225
|
+
'&type=cmdi:v1',
|
226
|
+
'&type=csp-headers:v1',
|
227
|
+
'&type=dlp:v1',
|
228
|
+
'&type=login:v1',
|
229
|
+
'&type=regex:v1',
|
230
|
+
'&type=appsensor:v2',
|
231
|
+
'&type=patches:v1'
|
232
232
|
].join('')
|
233
233
|
end
|
234
234
|
|
235
235
|
def cache_filename_with_app_id
|
236
|
-
@cache_filename ||= File.join(@agent_home_dir,
|
236
|
+
@cache_filename ||= File.join(@agent_home_dir, 'cache', 'tcell_agent.cache')
|
237
237
|
|
238
238
|
if @app_id
|
239
239
|
"#{@cache_filename}.#{@app_id}"
|
@@ -243,140 +243,136 @@ module TCellAgent
|
|
243
243
|
end
|
244
244
|
|
245
245
|
def read_config_using_env
|
246
|
-
@app_id = ENV[
|
247
|
-
@api_key = ENV[
|
248
|
-
@hmac_key = ENV[
|
249
|
-
@password_hmac_key = ENV[
|
250
|
-
@host_identifier = ENV[
|
251
|
-
@tcell_api_url = ENV[
|
252
|
-
@tcell_input_url = ENV[
|
253
|
-
@demomode = ENV[
|
254
|
-
|
255
|
-
@agent_home_owner = ENV[
|
256
|
-
@agent_log_dir = ENV[
|
246
|
+
@app_id = ENV['TCELL_AGENT_APP_ID'] || @app_id
|
247
|
+
@api_key = ENV['TCELL_AGENT_API_KEY'] || @api_key
|
248
|
+
@hmac_key = ENV['TCELL_HMAC_KEY'] || @hmac_key
|
249
|
+
@password_hmac_key = ENV['TCELL_PASSWORD_HMAC_KEY'] || @password_hmac_key
|
250
|
+
@host_identifier = ENV['TCELL_AGENT_HOST_IDENTIFIER'] || @host_identifier
|
251
|
+
@tcell_api_url = ENV['TCELL_API_URL'] || @tcell_api_url
|
252
|
+
@tcell_input_url = ENV['TCELL_INPUT_URL'] || @tcell_input_url
|
253
|
+
@demomode = ENV['TCELL_DEMOMODE'] || @demomode
|
254
|
+
|
255
|
+
@agent_home_owner = ENV['TCELL_AGENT_HOME_OWNER'] || @agent_home_owner
|
256
|
+
@agent_log_dir = ENV['TCELL_AGENT_LOG_DIR'] || @agent_log_dir
|
257
257
|
end
|
258
258
|
|
259
259
|
def read_config_from_file(filename)
|
260
|
-
|
261
|
-
#puts "tCell.io: Loading from file"
|
262
|
-
begin
|
263
|
-
config_text = File.open(filename).read
|
264
|
-
config = JSON.parse(config_text)
|
260
|
+
return unless File.file?(filename)
|
265
261
|
|
266
|
-
|
267
|
-
|
268
|
-
|
269
|
-
|
262
|
+
begin
|
263
|
+
config_text = File.open(filename).read
|
264
|
+
config = JSON.parse(config_text)
|
265
|
+
|
266
|
+
messages = TCellAgent::Config::Validate.get_unknown_options(config)
|
267
|
+
messages.each do |message|
|
268
|
+
puts message
|
269
|
+
end
|
270
|
+
|
271
|
+
if config['version'] == 1
|
272
|
+
# Required
|
273
|
+
app_data = config['applications'][0] # Default
|
274
|
+
@version = 1
|
275
|
+
@app_id = app_data['app_id']
|
276
|
+
@api_key = app_data['api_key']
|
277
|
+
|
278
|
+
# Optional
|
279
|
+
@preload_policy_filename = app_data.fetch('preload_policy_filename', nil)
|
280
|
+
|
281
|
+
@disable_all = app_data.fetch('disable_all', @disable_all)
|
282
|
+
@enabled = app_data.fetch('enabled', @enabled)
|
283
|
+
|
284
|
+
@enable_event_manager = app_data.fetch('enable_event_manager', @enable_event_manager)
|
285
|
+
@enable_event_consumer = app_data.fetch('enable_event_consumer', @enable_event_consumer)
|
286
|
+
@enable_policy_polling = app_data.fetch('enable_policy_polling', @enable_policy_polling)
|
287
|
+
@enable_instrumentation = app_data.fetch('enable_instrumentation', @enable_instrumentation)
|
288
|
+
@enable_intercept_requests = app_data.fetch('enable_intercept_requests', @enable_intercept_requests)
|
289
|
+
@fetch_policies_from_tcell = app_data.fetch('fetch_policies_from_tcell', @fetch_policies_from_tcell)
|
290
|
+
@instrument_for_events = app_data.fetch('instrument_for_events', @instrument_for_events)
|
291
|
+
|
292
|
+
@agent_home_owner = app_data.fetch('agent_home_owner', @agent_home_owner)
|
293
|
+
|
294
|
+
@logging_options = app_data.fetch('logging_options', {})
|
295
|
+
@agent_log_dir = app_data.fetch('log_dir', @agent_log_dir)
|
296
|
+
@log_file_name = @logging_options.fetch('filename', @log_file_name)
|
297
|
+
|
298
|
+
@tcell_api_url = app_data.fetch('tcell_api_url', @tcell_api_url)
|
299
|
+
@tcell_input_url = app_data.fetch('tcell_input_url', @tcell_input_url)
|
300
|
+
|
301
|
+
@max_csp_header_bytes = app_data.fetch('max_csp_header_bytes', @max_csp_header_bytes)
|
302
|
+
|
303
|
+
@allow_payloads = app_data.fetch(
|
304
|
+
'allow_unencrypted_appsensor_payloads',
|
305
|
+
@allow_payloads
|
306
|
+
)
|
307
|
+
@allow_payloads = app_data.fetch(
|
308
|
+
'allow_unencrypted_appfirewall_payloads',
|
309
|
+
@allow_payloads
|
310
|
+
)
|
311
|
+
@allow_payloads = app_data.fetch(
|
312
|
+
'allow_payloads',
|
313
|
+
@allow_payloads
|
314
|
+
)
|
315
|
+
|
316
|
+
data_exposure = app_data.fetch('data_exposure', {})
|
317
|
+
@max_data_ex_db_records_per_request = data_exposure.fetch('max_data_ex_db_records_per_request', @max_data_ex_db_records_per_request)
|
270
318
|
|
271
|
-
|
272
|
-
|
273
|
-
|
274
|
-
|
275
|
-
|
276
|
-
|
277
|
-
|
278
|
-
|
279
|
-
|
280
|
-
|
281
|
-
|
282
|
-
|
283
|
-
|
284
|
-
|
285
|
-
@
|
286
|
-
|
287
|
-
|
288
|
-
@
|
289
|
-
@fetch_policies_from_tcell = app_data.fetch("fetch_policies_from_tcell", @fetch_policies_from_tcell)
|
290
|
-
@instrument_for_events = app_data.fetch("instrument_for_events", @instrument_for_events)
|
291
|
-
|
292
|
-
@agent_home_owner = app_data.fetch("agent_home_owner", @agent_home_owner)
|
293
|
-
|
294
|
-
@logging_options = app_data.fetch("logging_options", {})
|
295
|
-
@agent_log_dir = app_data.fetch("log_dir", @agent_log_dir)
|
296
|
-
@log_file_name = @logging_options.fetch("filename", @log_file_name)
|
297
|
-
|
298
|
-
@tcell_api_url = app_data.fetch("tcell_api_url", @tcell_api_url)
|
299
|
-
@tcell_input_url = app_data.fetch("tcell_input_url", @tcell_input_url)
|
300
|
-
|
301
|
-
@max_csp_header_bytes = app_data.fetch("max_csp_header_bytes", @max_csp_header_bytes)
|
302
|
-
|
303
|
-
@allow_payloads = app_data.fetch(
|
304
|
-
'allow_unencrypted_appsensor_payloads',
|
305
|
-
@allow_payloads
|
306
|
-
)
|
307
|
-
@allow_payloads = app_data.fetch(
|
308
|
-
'allow_unencrypted_appfirewall_payloads',
|
309
|
-
@allow_payloads
|
310
|
-
)
|
311
|
-
@allow_payloads = app_data.fetch(
|
312
|
-
'allow_payloads',
|
313
|
-
@allow_payloads
|
314
|
-
)
|
315
|
-
|
316
|
-
data_exposure = app_data.fetch('data_exposure', {})
|
317
|
-
@max_data_ex_db_records_per_request = data_exposure.fetch('max_data_ex_db_records_per_request', @max_data_ex_db_records_per_request)
|
318
|
-
|
319
|
-
@enabled_instrumentations = app_data.fetch('enabled_instrumentations', @enabled_instrumentations)
|
320
|
-
|
321
|
-
@reverse_proxy = app_data.fetch('reverse_proxy', @reverse_proxy)
|
322
|
-
@reverse_proxy_ip_address_header = app_data.fetch('reverse_proxy_ip_address_header', @reverse_proxy_ip_address_header)
|
323
|
-
|
324
|
-
@host_identifier = app_data.fetch("host_identifier", @host_identifier)
|
325
|
-
@hmac_key = app_data.fetch("hmac_key", @hmac_key)
|
326
|
-
|
327
|
-
@password_hmac_key = app_data.fetch("password_hmac_key", @password_hmac_key)
|
328
|
-
|
329
|
-
@uuid = SecureRandom.uuid
|
330
|
-
if (@uuid == nil)
|
331
|
-
@uuid = "secure-random-failed"
|
332
|
-
end
|
333
|
-
|
334
|
-
if app_data.key?("js_agent_api_base_url")
|
335
|
-
@js_agent_api_base_url = app_data["js_agent_api_base_url"]
|
336
|
-
end
|
337
|
-
if app_data.key?("js_agent_url")
|
338
|
-
@js_agent_url = app_data["js_agent_url"]
|
339
|
-
end
|
340
|
-
|
341
|
-
@demomode = app_data.fetch('demomode', @demomode)
|
342
|
-
else
|
343
|
-
puts " ********* ********* ********* *********"
|
344
|
-
puts "* tCell.io *"
|
345
|
-
puts "* Unsupported config file version *"
|
346
|
-
puts " ********* ********* ********* *********"
|
319
|
+
@enabled_instrumentations = app_data.fetch('enabled_instrumentations', @enabled_instrumentations)
|
320
|
+
|
321
|
+
@reverse_proxy = app_data.fetch('reverse_proxy', @reverse_proxy)
|
322
|
+
@reverse_proxy_ip_address_header = app_data.fetch('reverse_proxy_ip_address_header', @reverse_proxy_ip_address_header)
|
323
|
+
|
324
|
+
@host_identifier = app_data.fetch('host_identifier', @host_identifier)
|
325
|
+
@hmac_key = app_data.fetch('hmac_key', @hmac_key)
|
326
|
+
|
327
|
+
@password_hmac_key = app_data.fetch('password_hmac_key', @password_hmac_key)
|
328
|
+
|
329
|
+
@uuid = SecureRandom.uuid
|
330
|
+
@uuid = 'secure-random-failed' if @uuid.nil?
|
331
|
+
|
332
|
+
if app_data.key?('js_agent_api_base_url')
|
333
|
+
@js_agent_api_base_url = app_data['js_agent_api_base_url']
|
334
|
+
end
|
335
|
+
if app_data.key?('js_agent_url')
|
336
|
+
@js_agent_url = app_data['js_agent_url']
|
347
337
|
end
|
348
|
-
|
349
|
-
|
350
|
-
|
351
|
-
puts
|
352
|
-
puts
|
353
|
-
puts
|
354
|
-
|
355
|
-
|
356
|
-
|
338
|
+
|
339
|
+
@demomode = app_data.fetch('demomode', @demomode)
|
340
|
+
else
|
341
|
+
puts ' ********* ********* ********* *********'
|
342
|
+
puts '* tCell.io *'
|
343
|
+
puts '* Unsupported config file version *'
|
344
|
+
puts ' ********* ********* ********* *********'
|
345
|
+
end
|
346
|
+
rescue StandardError => e
|
347
|
+
puts ' ********* ********* ********* *********'
|
348
|
+
puts '* tCell.io *'
|
349
|
+
puts '* Could not load config file *'
|
350
|
+
puts ' ********* ********* ********* *********'
|
351
|
+
puts e
|
352
|
+
end
|
353
|
+
end
|
357
354
|
|
358
355
|
# old value could be set via initializers, this makes sure those initializers still work
|
359
356
|
# properly
|
360
357
|
def allow_unencrypted_appfirewall_payloads=(val)
|
361
358
|
@allow_payloads = val
|
362
359
|
end
|
360
|
+
|
363
361
|
# keep this around in case the value was read as well
|
364
362
|
def allow_unencrypted_appfirewall_payloads
|
365
363
|
@allow_payloads
|
366
364
|
end
|
367
365
|
|
368
366
|
def log_filename
|
369
|
-
@agent_log_dir ||= File.join(@agent_home_dir,
|
367
|
+
@agent_log_dir ||= File.join(@agent_home_dir, 'logs')
|
370
368
|
File.join(@agent_log_dir, @log_file_name)
|
371
369
|
end
|
372
370
|
|
373
371
|
def appfirewall_payloads_log_filename
|
374
|
-
@agent_log_dir ||= File.join(@agent_home_dir,
|
375
|
-
File.join(@agent_log_dir,
|
372
|
+
@agent_log_dir ||= File.join(@agent_home_dir, 'logs')
|
373
|
+
File.join(@agent_log_dir, 'tcell_agent_payloads.log')
|
376
374
|
end
|
377
|
-
|
378
|
-
end # class
|
375
|
+
end
|
379
376
|
|
380
377
|
TCellAgent.configuration ||= TCellAgent::Configuration.new
|
381
|
-
|
382
378
|
end
|