tcell_agent 1.1.3 → 1.1.4
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/bin/tcell_agent +10 -2
- data/lib/tcell_agent.rb +3 -3
- data/lib/tcell_agent/agent.rb +42 -52
- data/lib/tcell_agent/agent/event_processor.rb +129 -162
- data/lib/tcell_agent/agent/fork_pipe_manager.rb +57 -62
- data/lib/tcell_agent/agent/policy_manager.rb +83 -104
- data/lib/tcell_agent/agent/policy_types.rb +24 -29
- data/lib/tcell_agent/agent/route_manager.rb +36 -46
- data/lib/tcell_agent/agent/static_agent.rb +19 -21
- data/lib/tcell_agent/api.rb +23 -28
- data/lib/tcell_agent/appsensor/injections_reporter.rb +7 -11
- data/lib/tcell_agent/authlogic.rb +7 -7
- data/lib/tcell_agent/cmdi.rb +22 -23
- data/lib/tcell_agent/config/unknown_options.rb +71 -69
- data/lib/tcell_agent/configuration.rb +187 -191
- data/lib/tcell_agent/devise.rb +13 -15
- data/lib/tcell_agent/hooks/login_fraud.rb +1 -1
- data/lib/tcell_agent/instrumentation.rb +120 -124
- data/lib/tcell_agent/logger.rb +29 -45
- data/lib/tcell_agent/patches.rb +5 -5
- data/lib/tcell_agent/policies/dataloss_policy.rb +263 -288
- data/lib/tcell_agent/policies/http_redirect_policy.rb +25 -37
- data/lib/tcell_agent/policies/http_tx_policy.rb +48 -52
- data/lib/tcell_agent/policies/login_fraud_policy.rb +15 -20
- data/lib/tcell_agent/policies/policy.rb +0 -2
- data/lib/tcell_agent/policies/rust_policies.rb +24 -29
- data/lib/tcell_agent/rails.rb +2 -3
- data/lib/tcell_agent/rails/auth/authlogic.rb +2 -2
- data/lib/tcell_agent/rails/auth/devise.rb +2 -2
- data/lib/tcell_agent/rails/auth/doorkeeper.rb +2 -2
- data/lib/tcell_agent/rails/better_ip.rb +12 -16
- data/lib/tcell_agent/rails/csrf_exception.rb +4 -7
- data/lib/tcell_agent/rails/dlp.rb +208 -107
- data/lib/tcell_agent/rails/dlp/process_request.rb +37 -47
- data/lib/tcell_agent/rails/dlp_handler.rb +9 -11
- data/lib/tcell_agent/rails/js_agent_insert.rb +11 -14
- data/lib/tcell_agent/rails/middleware/body_filter_middleware.rb +8 -7
- data/lib/tcell_agent/rails/middleware/context_middleware.rb +4 -5
- data/lib/tcell_agent/rails/middleware/global_middleware.rb +5 -8
- data/lib/tcell_agent/rails/middleware/headers_middleware.rb +24 -27
- data/lib/tcell_agent/rails/on_start.rb +5 -5
- data/lib/tcell_agent/rails/responses.rb +7 -9
- data/lib/tcell_agent/rails/routes.rb +62 -81
- data/lib/tcell_agent/rails/routes/grape.rb +25 -30
- data/lib/tcell_agent/rails/routes/route_id.rb +9 -14
- data/lib/tcell_agent/rails/settings_reporter.rb +44 -33
- data/lib/tcell_agent/rails/tcell_body_proxy.rb +15 -18
- data/lib/tcell_agent/routes/table.rb +31 -33
- data/lib/tcell_agent/rust/{libtcellagent-1.3.0.dylib → libtcellagent-1.3.1.dylib} +0 -0
- data/lib/tcell_agent/rust/{libtcellagent-1.3.0.so → libtcellagent-1.3.1.so} +0 -0
- data/lib/tcell_agent/rust/{libtcellagent-alpine-1.3.0.so → libtcellagent-alpine-1.3.1.so} +0 -0
- data/lib/tcell_agent/rust/models.rb +32 -37
- data/lib/tcell_agent/rust/tcellagent-1.3.1.dll +0 -0
- data/lib/tcell_agent/rust/whisperer.rb +101 -104
- data/lib/tcell_agent/sensor_events/app_config.rb +7 -7
- data/lib/tcell_agent/sensor_events/appsensor_event.rb +26 -27
- data/lib/tcell_agent/sensor_events/appsensor_meta_event.rb +20 -88
- data/lib/tcell_agent/sensor_events/command_injection.rb +52 -80
- data/lib/tcell_agent/sensor_events/discovery.rb +27 -27
- data/lib/tcell_agent/sensor_events/dlp.rb +50 -56
- data/lib/tcell_agent/sensor_events/honeytokens.rb +9 -9
- data/lib/tcell_agent/sensor_events/metrics.rb +20 -21
- data/lib/tcell_agent/sensor_events/patches.rb +10 -12
- data/lib/tcell_agent/sensor_events/sensor.rb +32 -36
- data/lib/tcell_agent/sensor_events/server_agent.rb +130 -127
- data/lib/tcell_agent/sensor_events/util/sanitizer_utilities.rb +60 -80
- data/lib/tcell_agent/sensor_events/util/utils.rb +3 -5
- data/lib/tcell_agent/servers/passenger.rb +5 -9
- data/lib/tcell_agent/servers/puma.rb +18 -27
- data/lib/tcell_agent/servers/rails_server.rb +5 -9
- data/lib/tcell_agent/servers/thin.rb +2 -4
- data/lib/tcell_agent/servers/unicorn.rb +18 -27
- data/lib/tcell_agent/servers/webrick.rb +2 -4
- data/lib/tcell_agent/settings_reporter.rb +126 -0
- data/lib/tcell_agent/sinatra.rb +24 -26
- data/lib/tcell_agent/start_background_thread.rb +21 -142
- data/lib/tcell_agent/system_info.rb +4 -3
- data/lib/tcell_agent/tcell_context.rb +150 -0
- data/lib/tcell_agent/userinfo.rb +3 -3
- data/lib/tcell_agent/utils/io.rb +19 -24
- data/lib/tcell_agent/utils/params.rb +9 -15
- data/lib/tcell_agent/utils/queue_with_timeout.rb +26 -32
- data/lib/tcell_agent/utils/strings.rb +4 -6
- data/lib/tcell_agent/version.rb +1 -1
- data/spec/lib/tcell_agent/agent/policy_manager_spec.rb +5 -5
- data/spec/lib/tcell_agent/agent/static_agent_spec.rb +7 -7
- data/spec/lib/tcell_agent/cmdi_spec.rb +21 -21
- data/spec/lib/tcell_agent/hooks/login_fraud_spec.rb +29 -24
- data/spec/lib/tcell_agent/instrumentation_spec.rb +4 -4
- data/spec/lib/tcell_agent/patches_spec.rb +8 -8
- data/spec/lib/tcell_agent/policies/appsensor_policy_spec.rb +23 -23
- data/spec/lib/tcell_agent/policies/patches_policy_spec.rb +2 -2
- data/spec/lib/tcell_agent/rails/csrf_exception_spec.rb +69 -0
- data/spec/lib/tcell_agent/rails/dlp_spec.rb +1039 -0
- data/spec/lib/tcell_agent/rails/js_agent_insert_spec.rb +271 -0
- data/spec/lib/tcell_agent/rails/logger_spec.rb +5 -5
- data/spec/lib/tcell_agent/rails/middleware/appsensor_middleware_spec.rb +3 -3
- data/spec/lib/tcell_agent/rails/middleware/dlp_middleware_spec.rb +4 -4
- data/spec/lib/tcell_agent/rails/middleware/global_middleware_spec.rb +5 -5
- data/spec/lib/tcell_agent/rails/middleware/redirect_middleware_spec.rb +1 -1
- data/spec/lib/tcell_agent/rails/middleware/tcell_body_proxy_spec.rb +11 -8
- data/spec/lib/tcell_agent/rails/responses_spec.rb +2 -2
- data/spec/lib/tcell_agent/rails/routes/grape_spec.rb +2 -2
- data/spec/lib/tcell_agent/rails/routes/route_id_spec.rb +1 -1
- data/spec/lib/tcell_agent/rails/routes/routes_spec.rb +4 -4
- data/spec/lib/tcell_agent/rust/models_spec.rb +83 -75
- data/spec/lib/tcell_agent/rust/whisperer_spec.rb +14 -14
- data/spec/lib/tcell_agent/sensor_events/appsensor_meta_event_spec.rb +19 -70
- data/spec/lib/tcell_agent/sensor_events/sessions_metric_spec.rb +1 -1
- data/spec/lib/tcell_agent/settings_reporter_spec.rb +162 -0
- data/spec/lib/tcell_agent/tcell_context_spec.rb +154 -0
- data/spec/spec_helper.rb +5 -0
- metadata +18 -10
- data/lib/tcell_agent/appsensor/meta_data.rb +0 -132
- data/lib/tcell_agent/patches/meta_data.rb +0 -59
- data/lib/tcell_agent/rust/tcellagent-1.3.0.dll +0 -0
- data/spec/lib/tcell_agent/appsensor/meta_data_spec.rb +0 -71
@@ -3,27 +3,29 @@ require 'set'
|
|
3
3
|
module TCellAgent
|
4
4
|
module Config
|
5
5
|
module Validate
|
6
|
-
|
7
6
|
def self.get_unknown_options(config_json)
|
8
7
|
messages = []
|
9
8
|
|
10
|
-
known_tcell_env_vars = Set.new(
|
11
|
-
|
12
|
-
|
13
|
-
|
14
|
-
|
15
|
-
|
16
|
-
|
17
|
-
|
18
|
-
|
19
|
-
|
20
|
-
|
21
|
-
|
22
|
-
|
23
|
-
|
24
|
-
|
25
|
-
|
26
|
-
|
9
|
+
known_tcell_env_vars = Set.new(
|
10
|
+
[
|
11
|
+
'TCELL_AGENT_SERVER', # this is only meant for specs
|
12
|
+
'TCELL_AGENT_APP_ID',
|
13
|
+
'TCELL_AGENT_API_KEY',
|
14
|
+
'TCELL_HMAC_KEY',
|
15
|
+
'TCELL_PASSWORD_HMAC_KEY',
|
16
|
+
'TCELL_AGENT_HOST_IDENTIFIER',
|
17
|
+
'TCELL_API_URL',
|
18
|
+
'TCELL_INPUT_URL',
|
19
|
+
'TCELL_DEMOMODE',
|
20
|
+
'TCELL_AGENT_HOME',
|
21
|
+
'TCELL_AGENT_LOG_DIR',
|
22
|
+
'TCELL_AGENT_CONFIG',
|
23
|
+
'TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS',
|
24
|
+
'TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS',
|
25
|
+
'TCELL_AGENT_ALLOW_PAYLOADS',
|
26
|
+
'TCELL_AGENT_HOME_OWNER'
|
27
|
+
]
|
28
|
+
)
|
27
29
|
|
28
30
|
ENV.keys.each do |environment_key|
|
29
31
|
if environment_key =~ /^TCELL_/ && !known_tcell_env_vars.include?(environment_key)
|
@@ -35,70 +37,71 @@ module TCellAgent
|
|
35
37
|
key_differences = []
|
36
38
|
|
37
39
|
if config_json
|
38
|
-
first_level_keys = [
|
40
|
+
first_level_keys = %w[version applications]
|
39
41
|
|
40
42
|
key_differences = config_json.keys - first_level_keys
|
41
43
|
|
42
|
-
applications = config_json.fetch(
|
44
|
+
applications = config_json.fetch('applications', nil)
|
43
45
|
if applications
|
44
46
|
|
45
47
|
if applications.size > 1
|
46
|
-
messages <<
|
48
|
+
messages << 'Multiple applications detected in config file'
|
47
49
|
|
48
50
|
elsif applications.size == 1
|
49
51
|
application = applications[0]
|
50
52
|
|
51
|
-
second_level_keys = [
|
52
|
-
|
53
|
-
|
54
|
-
|
55
|
-
|
56
|
-
|
57
|
-
|
58
|
-
|
59
|
-
|
60
|
-
|
61
|
-
|
62
|
-
|
63
|
-
|
64
|
-
|
65
|
-
|
66
|
-
|
67
|
-
|
68
|
-
|
69
|
-
|
70
|
-
|
71
|
-
|
72
|
-
|
73
|
-
|
74
|
-
|
75
|
-
|
76
|
-
|
77
|
-
|
78
|
-
|
79
|
-
|
80
|
-
|
81
|
-
|
82
|
-
|
83
|
-
|
84
|
-
|
85
|
-
|
86
|
-
|
87
|
-
|
88
|
-
|
89
|
-
|
90
|
-
|
91
|
-
|
53
|
+
second_level_keys = %w[
|
54
|
+
name
|
55
|
+
app_id
|
56
|
+
api_key
|
57
|
+
fetch_policies_from_tcell
|
58
|
+
preload_policy_filename
|
59
|
+
log_dir
|
60
|
+
tcell_api_url
|
61
|
+
tcell_input_url
|
62
|
+
host_identifier
|
63
|
+
hipaaSafeMode
|
64
|
+
hmac_key
|
65
|
+
password_hmac_key
|
66
|
+
js_agent_api_base_url
|
67
|
+
js_agent_url
|
68
|
+
max_csp_header_bytes
|
69
|
+
event_batch_size_limit
|
70
|
+
allow_unencrypted_appsensor_payloads
|
71
|
+
allow_unencrypted_appfirewall_payloads
|
72
|
+
allow_payloads
|
73
|
+
reverse_proxy
|
74
|
+
reverse_proxy_ip_address_header
|
75
|
+
demomode
|
76
|
+
logging_options
|
77
|
+
data_exposure
|
78
|
+
disable_all
|
79
|
+
enabled
|
80
|
+
enable_event_manager
|
81
|
+
enable_event_consumer
|
82
|
+
enable_policy_polling
|
83
|
+
enable_instrumentation
|
84
|
+
enable_intercept_requests
|
85
|
+
instrument_for_events
|
86
|
+
agent_home_owner
|
87
|
+
enabled_instrumentations
|
88
|
+
]
|
89
|
+
|
90
|
+
key_differences += (application.keys - second_level_keys)
|
91
|
+
|
92
|
+
if application.fetch('logging_options', nil)
|
93
|
+
logging_options = application['logging_options']
|
94
|
+
key_differences += (logging_options.keys - %w[enabled level filename])
|
92
95
|
end
|
93
96
|
|
94
|
-
if application.fetch(
|
95
|
-
data_exposure = application[
|
96
|
-
key_differences
|
97
|
+
if application.fetch('data_exposure', nil)
|
98
|
+
data_exposure = application['data_exposure']
|
99
|
+
key_differences += (data_exposure.keys - ['max_data_ex_db_records_per_request'])
|
97
100
|
end
|
98
101
|
|
99
|
-
if application.fetch(
|
100
|
-
enabled_instrumentations = application[
|
101
|
-
key_differences
|
102
|
+
if application.fetch('enabled_instrumentations', nil)
|
103
|
+
enabled_instrumentations = application['enabled_instrumentations']
|
104
|
+
key_differences += (enabled_instrumentations.keys - %w[doorkeeper devise authlogic])
|
102
105
|
end
|
103
106
|
end
|
104
107
|
end
|
@@ -114,7 +117,6 @@ module TCellAgent
|
|
114
117
|
|
115
118
|
messages
|
116
119
|
end
|
117
|
-
|
118
120
|
end
|
119
121
|
end
|
120
122
|
end
|
@@ -21,46 +21,46 @@ module TCellAgent
|
|
21
21
|
yield(configuration)
|
22
22
|
end
|
23
23
|
|
24
|
-
class Configuration
|
24
|
+
class Configuration # rubocop:disable Metrics/ClassLength
|
25
25
|
attr_accessor :version,
|
26
|
-
|
27
|
-
|
28
|
-
|
29
|
-
|
30
|
-
|
31
|
-
|
32
|
-
|
33
|
-
|
34
|
-
|
35
|
-
|
36
|
-
|
37
|
-
|
38
|
-
|
39
|
-
|
40
|
-
|
41
|
-
|
42
|
-
|
43
|
-
|
44
|
-
|
45
|
-
|
46
|
-
|
47
|
-
|
48
|
-
|
49
|
-
|
50
|
-
|
51
|
-
|
52
|
-
|
53
|
-
|
54
|
-
|
55
|
-
|
26
|
+
:app_id,
|
27
|
+
:api_key,
|
28
|
+
:hmac_key,
|
29
|
+
:tcell_api_url,
|
30
|
+
:tcell_input_url,
|
31
|
+
:logging_options,
|
32
|
+
:logger,
|
33
|
+
:appfirewall_payloads_logger, # appfirewall_payloads_logger can be specified from initializers
|
34
|
+
:fetch_policies_from_tcell, :instrument_for_events,
|
35
|
+
:preload_policy_filename,
|
36
|
+
:host_identifier,
|
37
|
+
:uuid,
|
38
|
+
:event_batch_size_limit, :event_time_limit_seconds,
|
39
|
+
:base_dir,
|
40
|
+
:cache_filename,
|
41
|
+
:js_agent_api_base_url,
|
42
|
+
:js_agent_url,
|
43
|
+
:config_filename,
|
44
|
+
:agent_log_dir,
|
45
|
+
:max_data_ex_db_records_per_request,
|
46
|
+
:agent_home_dir,
|
47
|
+
:agent_home_owner,
|
48
|
+
:reverse_proxy,
|
49
|
+
:reverse_proxy_ip_address_header,
|
50
|
+
:log_file_name,
|
51
|
+
:log_tag,
|
52
|
+
:max_csp_header_bytes,
|
53
|
+
:demomode,
|
54
|
+
:allow_payloads,
|
55
|
+
:password_hmac_key
|
56
56
|
|
57
57
|
attr_accessor :disable_all,
|
58
|
-
|
59
|
-
|
60
|
-
|
61
|
-
|
62
|
-
|
63
|
-
|
58
|
+
:enabled,
|
59
|
+
:enable_event_manager, # false = Do not start the even manager
|
60
|
+
:enable_event_consumer, # false = Do not consume events, drop them
|
61
|
+
:enable_policy_polling, # false = Do not poll for policies
|
62
|
+
:enable_instrumentation, # false = Do not add instrumentation
|
63
|
+
:enable_intercept_requests # false = Do not insert middleware
|
64
64
|
|
65
65
|
attr_accessor :enabled_instrumentations
|
66
66
|
|
@@ -87,30 +87,30 @@ module TCellAgent
|
|
87
87
|
end
|
88
88
|
|
89
89
|
def should_instrument_doorkeeper?
|
90
|
-
if @enabled_instrumentations.
|
91
|
-
!!(@enabled_instrumentations['doorkeeper'] || @enabled_instrumentations[:doorkeeper])
|
90
|
+
if @enabled_instrumentations.key?('doorkeeper') || @enabled_instrumentations.key?(:doorkeeper)
|
91
|
+
!!(@enabled_instrumentations['doorkeeper'] || @enabled_instrumentations[:doorkeeper]) # rubocop:disable Style/DoubleNegation
|
92
92
|
else
|
93
93
|
true
|
94
94
|
end
|
95
95
|
end
|
96
96
|
|
97
97
|
def should_instrument_devise?
|
98
|
-
if @enabled_instrumentations.
|
99
|
-
!!(@enabled_instrumentations['devise'] || @enabled_instrumentations[:devise])
|
98
|
+
if @enabled_instrumentations.key?('devise') || @enabled_instrumentations.key?(:devise)
|
99
|
+
!!(@enabled_instrumentations['devise'] || @enabled_instrumentations[:devise]) # rubocop:disable Style/DoubleNegation
|
100
100
|
else
|
101
101
|
true
|
102
102
|
end
|
103
103
|
end
|
104
104
|
|
105
105
|
def should_instrument_authlogic?
|
106
|
-
if @enabled_instrumentations.
|
107
|
-
!!(@enabled_instrumentations['authlogic'] || @enabled_instrumentations[:authlogic])
|
106
|
+
if @enabled_instrumentations.key?('authlogic') || @enabled_instrumentations.key?(:authlogic)
|
107
|
+
!!(@enabled_instrumentations['authlogic'] || @enabled_instrumentations[:authlogic]) # rubocop:disable Style/DoubleNegation
|
108
108
|
else
|
109
109
|
true
|
110
110
|
end
|
111
111
|
end
|
112
112
|
|
113
|
-
def initialize(filename=
|
113
|
+
def initialize(filename = 'config/tcell_agent.config', _useapp = nil)
|
114
114
|
# These will be set when the agent starts up, to give rails initializers
|
115
115
|
# a chance to run
|
116
116
|
@cache_filename = nil
|
@@ -141,7 +141,7 @@ module TCellAgent
|
|
141
141
|
:authlogic => true
|
142
142
|
}
|
143
143
|
|
144
|
-
@log_file_name =
|
144
|
+
@log_file_name = 'tcell_agent.log'
|
145
145
|
|
146
146
|
@event_batch_size_limit = 50
|
147
147
|
@event_time_limit_seconds = 15
|
@@ -154,8 +154,8 @@ module TCellAgent
|
|
154
154
|
@max_csp_header_bytes = nil
|
155
155
|
@password_hmac_key = nil
|
156
156
|
|
157
|
-
@agent_home_dir = ENV[
|
158
|
-
@config_filename = ENV[
|
157
|
+
@agent_home_dir = ENV['TCELL_AGENT_HOME'] || File.join(Dir.getwd, 'tcell')
|
158
|
+
@config_filename = ENV['TCELL_AGENT_CONFIG'] || File.join(Dir.getwd, filename)
|
159
159
|
|
160
160
|
read_config_from_file(@config_filename)
|
161
161
|
read_config_using_env
|
@@ -165,33 +165,33 @@ module TCellAgent
|
|
165
165
|
@event_time_limit_seconds = 2
|
166
166
|
end
|
167
167
|
|
168
|
-
if ENV[
|
169
|
-
puts
|
168
|
+
if ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS']
|
169
|
+
puts 'tCell.io Agent: [DEPRECATED] TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS is deprecated and will be removed in a future release. Please switch to TCELL_AGENT_ALLOW_PAYLOADS.'
|
170
170
|
end
|
171
171
|
|
172
|
-
if
|
173
|
-
puts
|
172
|
+
if ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS']
|
173
|
+
puts 'tCell.io Agent: [DEPRECATED] TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS is deprecated and will be removed in a future release. Please switch to TCELL_AGENT_ALLOW_PAYLOADS.'
|
174
174
|
end
|
175
175
|
|
176
|
-
|
177
|
-
@allow_payloads = [true,
|
176
|
+
unless ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS'].nil?
|
177
|
+
@allow_payloads = [true, 'true', 'yes', '1'].include?(ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS'])
|
178
178
|
end
|
179
|
-
|
180
|
-
@allow_payloads = [true,
|
179
|
+
unless ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS'].nil?
|
180
|
+
@allow_payloads = [true, 'true', 'yes', '1'].include?(ENV['TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS'])
|
181
181
|
end
|
182
|
-
|
183
|
-
@allow_payloads = [true,
|
182
|
+
unless ENV['TCELL_AGENT_ALLOW_PAYLOADS'].nil?
|
183
|
+
@allow_payloads = [true, 'true', 'yes', '1'].include?(ENV['TCELL_AGENT_ALLOW_PAYLOADS'])
|
184
184
|
end
|
185
185
|
|
186
186
|
@tcell_api_url = compose_api_url!
|
187
|
-
@tcell_input_url ||=
|
188
|
-
@js_agent_url ||=
|
187
|
+
@tcell_input_url ||= 'https://input.tcell.io/api/v1'
|
188
|
+
@js_agent_url ||= 'https://jsagent.tcell.io/tcellagent.min.js'
|
189
189
|
|
190
|
-
if
|
190
|
+
if @host_identifier.nil?
|
191
191
|
begin
|
192
|
-
@host_identifier = (Socket.gethostname
|
192
|
+
@host_identifier = (Socket.gethostname || 'localhost')
|
193
193
|
rescue StandardError
|
194
|
-
@host_identifier =
|
194
|
+
@host_identifier = 'host_identifier_not_found'
|
195
195
|
end
|
196
196
|
end
|
197
197
|
|
@@ -199,12 +199,12 @@ module TCellAgent
|
|
199
199
|
end
|
200
200
|
|
201
201
|
def compose_api_url!
|
202
|
-
@tcell_api_url ||=
|
202
|
+
@tcell_api_url ||= 'https://api.tcell.io'
|
203
203
|
parsed_uri = URI.parse(@tcell_api_url)
|
204
204
|
|
205
205
|
api_url = [
|
206
206
|
parsed_uri.scheme,
|
207
|
-
|
207
|
+
'://',
|
208
208
|
parsed_uri.host
|
209
209
|
]
|
210
210
|
|
@@ -214,26 +214,26 @@ module TCellAgent
|
|
214
214
|
|
215
215
|
[
|
216
216
|
api_url.join(''),
|
217
|
-
|
218
|
-
|
219
|
-
|
220
|
-
|
221
|
-
|
222
|
-
|
223
|
-
|
224
|
-
|
225
|
-
|
226
|
-
|
227
|
-
|
228
|
-
|
229
|
-
|
230
|
-
|
231
|
-
|
217
|
+
'/agents/api/v1/apps/',
|
218
|
+
'{app_id}',
|
219
|
+
'/policies/latest',
|
220
|
+
'?',
|
221
|
+
'type=jsagentinjection:v1',
|
222
|
+
'&type=http-redirect:v1',
|
223
|
+
'&type=clickjacking:v1',
|
224
|
+
'&type=secure-headers:v1',
|
225
|
+
'&type=cmdi:v1',
|
226
|
+
'&type=csp-headers:v1',
|
227
|
+
'&type=dlp:v1',
|
228
|
+
'&type=login:v1',
|
229
|
+
'&type=regex:v1',
|
230
|
+
'&type=appsensor:v2',
|
231
|
+
'&type=patches:v1'
|
232
232
|
].join('')
|
233
233
|
end
|
234
234
|
|
235
235
|
def cache_filename_with_app_id
|
236
|
-
@cache_filename ||= File.join(@agent_home_dir,
|
236
|
+
@cache_filename ||= File.join(@agent_home_dir, 'cache', 'tcell_agent.cache')
|
237
237
|
|
238
238
|
if @app_id
|
239
239
|
"#{@cache_filename}.#{@app_id}"
|
@@ -243,140 +243,136 @@ module TCellAgent
|
|
243
243
|
end
|
244
244
|
|
245
245
|
def read_config_using_env
|
246
|
-
@app_id = ENV[
|
247
|
-
@api_key = ENV[
|
248
|
-
@hmac_key = ENV[
|
249
|
-
@password_hmac_key = ENV[
|
250
|
-
@host_identifier = ENV[
|
251
|
-
@tcell_api_url = ENV[
|
252
|
-
@tcell_input_url = ENV[
|
253
|
-
@demomode = ENV[
|
254
|
-
|
255
|
-
@agent_home_owner = ENV[
|
256
|
-
@agent_log_dir = ENV[
|
246
|
+
@app_id = ENV['TCELL_AGENT_APP_ID'] || @app_id
|
247
|
+
@api_key = ENV['TCELL_AGENT_API_KEY'] || @api_key
|
248
|
+
@hmac_key = ENV['TCELL_HMAC_KEY'] || @hmac_key
|
249
|
+
@password_hmac_key = ENV['TCELL_PASSWORD_HMAC_KEY'] || @password_hmac_key
|
250
|
+
@host_identifier = ENV['TCELL_AGENT_HOST_IDENTIFIER'] || @host_identifier
|
251
|
+
@tcell_api_url = ENV['TCELL_API_URL'] || @tcell_api_url
|
252
|
+
@tcell_input_url = ENV['TCELL_INPUT_URL'] || @tcell_input_url
|
253
|
+
@demomode = ENV['TCELL_DEMOMODE'] || @demomode
|
254
|
+
|
255
|
+
@agent_home_owner = ENV['TCELL_AGENT_HOME_OWNER'] || @agent_home_owner
|
256
|
+
@agent_log_dir = ENV['TCELL_AGENT_LOG_DIR'] || @agent_log_dir
|
257
257
|
end
|
258
258
|
|
259
259
|
def read_config_from_file(filename)
|
260
|
-
|
261
|
-
#puts "tCell.io: Loading from file"
|
262
|
-
begin
|
263
|
-
config_text = File.open(filename).read
|
264
|
-
config = JSON.parse(config_text)
|
260
|
+
return unless File.file?(filename)
|
265
261
|
|
266
|
-
|
267
|
-
|
268
|
-
|
269
|
-
|
262
|
+
begin
|
263
|
+
config_text = File.open(filename).read
|
264
|
+
config = JSON.parse(config_text)
|
265
|
+
|
266
|
+
messages = TCellAgent::Config::Validate.get_unknown_options(config)
|
267
|
+
messages.each do |message|
|
268
|
+
puts message
|
269
|
+
end
|
270
|
+
|
271
|
+
if config['version'] == 1
|
272
|
+
# Required
|
273
|
+
app_data = config['applications'][0] # Default
|
274
|
+
@version = 1
|
275
|
+
@app_id = app_data['app_id']
|
276
|
+
@api_key = app_data['api_key']
|
277
|
+
|
278
|
+
# Optional
|
279
|
+
@preload_policy_filename = app_data.fetch('preload_policy_filename', nil)
|
280
|
+
|
281
|
+
@disable_all = app_data.fetch('disable_all', @disable_all)
|
282
|
+
@enabled = app_data.fetch('enabled', @enabled)
|
283
|
+
|
284
|
+
@enable_event_manager = app_data.fetch('enable_event_manager', @enable_event_manager)
|
285
|
+
@enable_event_consumer = app_data.fetch('enable_event_consumer', @enable_event_consumer)
|
286
|
+
@enable_policy_polling = app_data.fetch('enable_policy_polling', @enable_policy_polling)
|
287
|
+
@enable_instrumentation = app_data.fetch('enable_instrumentation', @enable_instrumentation)
|
288
|
+
@enable_intercept_requests = app_data.fetch('enable_intercept_requests', @enable_intercept_requests)
|
289
|
+
@fetch_policies_from_tcell = app_data.fetch('fetch_policies_from_tcell', @fetch_policies_from_tcell)
|
290
|
+
@instrument_for_events = app_data.fetch('instrument_for_events', @instrument_for_events)
|
291
|
+
|
292
|
+
@agent_home_owner = app_data.fetch('agent_home_owner', @agent_home_owner)
|
293
|
+
|
294
|
+
@logging_options = app_data.fetch('logging_options', {})
|
295
|
+
@agent_log_dir = app_data.fetch('log_dir', @agent_log_dir)
|
296
|
+
@log_file_name = @logging_options.fetch('filename', @log_file_name)
|
297
|
+
|
298
|
+
@tcell_api_url = app_data.fetch('tcell_api_url', @tcell_api_url)
|
299
|
+
@tcell_input_url = app_data.fetch('tcell_input_url', @tcell_input_url)
|
300
|
+
|
301
|
+
@max_csp_header_bytes = app_data.fetch('max_csp_header_bytes', @max_csp_header_bytes)
|
302
|
+
|
303
|
+
@allow_payloads = app_data.fetch(
|
304
|
+
'allow_unencrypted_appsensor_payloads',
|
305
|
+
@allow_payloads
|
306
|
+
)
|
307
|
+
@allow_payloads = app_data.fetch(
|
308
|
+
'allow_unencrypted_appfirewall_payloads',
|
309
|
+
@allow_payloads
|
310
|
+
)
|
311
|
+
@allow_payloads = app_data.fetch(
|
312
|
+
'allow_payloads',
|
313
|
+
@allow_payloads
|
314
|
+
)
|
315
|
+
|
316
|
+
data_exposure = app_data.fetch('data_exposure', {})
|
317
|
+
@max_data_ex_db_records_per_request = data_exposure.fetch('max_data_ex_db_records_per_request', @max_data_ex_db_records_per_request)
|
270
318
|
|
271
|
-
|
272
|
-
|
273
|
-
|
274
|
-
|
275
|
-
|
276
|
-
|
277
|
-
|
278
|
-
|
279
|
-
|
280
|
-
|
281
|
-
|
282
|
-
|
283
|
-
|
284
|
-
|
285
|
-
@
|
286
|
-
|
287
|
-
|
288
|
-
@
|
289
|
-
@fetch_policies_from_tcell = app_data.fetch("fetch_policies_from_tcell", @fetch_policies_from_tcell)
|
290
|
-
@instrument_for_events = app_data.fetch("instrument_for_events", @instrument_for_events)
|
291
|
-
|
292
|
-
@agent_home_owner = app_data.fetch("agent_home_owner", @agent_home_owner)
|
293
|
-
|
294
|
-
@logging_options = app_data.fetch("logging_options", {})
|
295
|
-
@agent_log_dir = app_data.fetch("log_dir", @agent_log_dir)
|
296
|
-
@log_file_name = @logging_options.fetch("filename", @log_file_name)
|
297
|
-
|
298
|
-
@tcell_api_url = app_data.fetch("tcell_api_url", @tcell_api_url)
|
299
|
-
@tcell_input_url = app_data.fetch("tcell_input_url", @tcell_input_url)
|
300
|
-
|
301
|
-
@max_csp_header_bytes = app_data.fetch("max_csp_header_bytes", @max_csp_header_bytes)
|
302
|
-
|
303
|
-
@allow_payloads = app_data.fetch(
|
304
|
-
'allow_unencrypted_appsensor_payloads',
|
305
|
-
@allow_payloads
|
306
|
-
)
|
307
|
-
@allow_payloads = app_data.fetch(
|
308
|
-
'allow_unencrypted_appfirewall_payloads',
|
309
|
-
@allow_payloads
|
310
|
-
)
|
311
|
-
@allow_payloads = app_data.fetch(
|
312
|
-
'allow_payloads',
|
313
|
-
@allow_payloads
|
314
|
-
)
|
315
|
-
|
316
|
-
data_exposure = app_data.fetch('data_exposure', {})
|
317
|
-
@max_data_ex_db_records_per_request = data_exposure.fetch('max_data_ex_db_records_per_request', @max_data_ex_db_records_per_request)
|
318
|
-
|
319
|
-
@enabled_instrumentations = app_data.fetch('enabled_instrumentations', @enabled_instrumentations)
|
320
|
-
|
321
|
-
@reverse_proxy = app_data.fetch('reverse_proxy', @reverse_proxy)
|
322
|
-
@reverse_proxy_ip_address_header = app_data.fetch('reverse_proxy_ip_address_header', @reverse_proxy_ip_address_header)
|
323
|
-
|
324
|
-
@host_identifier = app_data.fetch("host_identifier", @host_identifier)
|
325
|
-
@hmac_key = app_data.fetch("hmac_key", @hmac_key)
|
326
|
-
|
327
|
-
@password_hmac_key = app_data.fetch("password_hmac_key", @password_hmac_key)
|
328
|
-
|
329
|
-
@uuid = SecureRandom.uuid
|
330
|
-
if (@uuid == nil)
|
331
|
-
@uuid = "secure-random-failed"
|
332
|
-
end
|
333
|
-
|
334
|
-
if app_data.key?("js_agent_api_base_url")
|
335
|
-
@js_agent_api_base_url = app_data["js_agent_api_base_url"]
|
336
|
-
end
|
337
|
-
if app_data.key?("js_agent_url")
|
338
|
-
@js_agent_url = app_data["js_agent_url"]
|
339
|
-
end
|
340
|
-
|
341
|
-
@demomode = app_data.fetch('demomode', @demomode)
|
342
|
-
else
|
343
|
-
puts " ********* ********* ********* *********"
|
344
|
-
puts "* tCell.io *"
|
345
|
-
puts "* Unsupported config file version *"
|
346
|
-
puts " ********* ********* ********* *********"
|
319
|
+
@enabled_instrumentations = app_data.fetch('enabled_instrumentations', @enabled_instrumentations)
|
320
|
+
|
321
|
+
@reverse_proxy = app_data.fetch('reverse_proxy', @reverse_proxy)
|
322
|
+
@reverse_proxy_ip_address_header = app_data.fetch('reverse_proxy_ip_address_header', @reverse_proxy_ip_address_header)
|
323
|
+
|
324
|
+
@host_identifier = app_data.fetch('host_identifier', @host_identifier)
|
325
|
+
@hmac_key = app_data.fetch('hmac_key', @hmac_key)
|
326
|
+
|
327
|
+
@password_hmac_key = app_data.fetch('password_hmac_key', @password_hmac_key)
|
328
|
+
|
329
|
+
@uuid = SecureRandom.uuid
|
330
|
+
@uuid = 'secure-random-failed' if @uuid.nil?
|
331
|
+
|
332
|
+
if app_data.key?('js_agent_api_base_url')
|
333
|
+
@js_agent_api_base_url = app_data['js_agent_api_base_url']
|
334
|
+
end
|
335
|
+
if app_data.key?('js_agent_url')
|
336
|
+
@js_agent_url = app_data['js_agent_url']
|
347
337
|
end
|
348
|
-
|
349
|
-
|
350
|
-
|
351
|
-
puts
|
352
|
-
puts
|
353
|
-
puts
|
354
|
-
|
355
|
-
|
356
|
-
|
338
|
+
|
339
|
+
@demomode = app_data.fetch('demomode', @demomode)
|
340
|
+
else
|
341
|
+
puts ' ********* ********* ********* *********'
|
342
|
+
puts '* tCell.io *'
|
343
|
+
puts '* Unsupported config file version *'
|
344
|
+
puts ' ********* ********* ********* *********'
|
345
|
+
end
|
346
|
+
rescue StandardError => e
|
347
|
+
puts ' ********* ********* ********* *********'
|
348
|
+
puts '* tCell.io *'
|
349
|
+
puts '* Could not load config file *'
|
350
|
+
puts ' ********* ********* ********* *********'
|
351
|
+
puts e
|
352
|
+
end
|
353
|
+
end
|
357
354
|
|
358
355
|
# old value could be set via initializers, this makes sure those initializers still work
|
359
356
|
# properly
|
360
357
|
def allow_unencrypted_appfirewall_payloads=(val)
|
361
358
|
@allow_payloads = val
|
362
359
|
end
|
360
|
+
|
363
361
|
# keep this around in case the value was read as well
|
364
362
|
def allow_unencrypted_appfirewall_payloads
|
365
363
|
@allow_payloads
|
366
364
|
end
|
367
365
|
|
368
366
|
def log_filename
|
369
|
-
@agent_log_dir ||= File.join(@agent_home_dir,
|
367
|
+
@agent_log_dir ||= File.join(@agent_home_dir, 'logs')
|
370
368
|
File.join(@agent_log_dir, @log_file_name)
|
371
369
|
end
|
372
370
|
|
373
371
|
def appfirewall_payloads_log_filename
|
374
|
-
@agent_log_dir ||= File.join(@agent_home_dir,
|
375
|
-
File.join(@agent_log_dir,
|
372
|
+
@agent_log_dir ||= File.join(@agent_home_dir, 'logs')
|
373
|
+
File.join(@agent_log_dir, 'tcell_agent_payloads.log')
|
376
374
|
end
|
377
|
-
|
378
|
-
end # class
|
375
|
+
end
|
379
376
|
|
380
377
|
TCellAgent.configuration ||= TCellAgent::Configuration.new
|
381
|
-
|
382
378
|
end
|