tcell_agent 1.1.3 → 1.1.4

data/lib/tcell_agent/patches.rb

@@ -1,13 +1,14 @@
+require 'tcell_agent/tcell_context'
+
 module TCellAgent
   module Instrumentation
-
     module Patches
       def self.block?(request)
-        TCellAgent::Instrumentation.safe_block("Checking patches blocking") do
-          rust_policies = TCellAgent.policy(TCellAgent::PolicyTypes::Rust)
+        TCellAgent::Instrumentation.safe_block('Checking patches blocking') do
+          rust_policies = TCellAgent.policy(TCellAgent::PolicyTypes::RUST)
 
           if rust_policies && rust_policies.patches_enabled
-            meta_data = TCellAgent::Patches::MetaData.build(request)
+            meta_data = TCellAgent::MetaData.from_request(request)
             block_request = rust_policies.block_request?(meta_data)
             request.env[TCellAgent::Instrumentation::TCELL_ID].patches_blocking_triggered = block_request
 
@@ -18,6 +19,5 @@ module TCellAgent
         false
       end
     end
-
   end
 end

data/lib/tcell_agent/policies/dataloss_policy.rb

@@ -1,322 +1,297 @@
 require 'set'
 require 'tcell_agent/policies/policy'
 
-
 module TCellAgent
-    module Policies
-        class DataLossPolicy < Policy
-            class FilterActions
-                attr_accessor :body_event
-                attr_accessor :body_redact
-                attr_accessor :body_hash
-
-                attr_accessor :log_event
-                attr_accessor :log_redact
-                attr_accessor :log_hash
-
-                attr_accessor :action_id
-            end
-
-            class RequestProtectionManager
-                FORM = "form"
-                COOKIE = "cookie"
-                HEADER = "header"
+  module Policies
+    class DataLossPolicy < Policy # rubocop:disable Metrics/ClassLength
+      class FilterActions
+        attr_accessor :body_event
+        attr_accessor :body_redact
+        attr_accessor :body_hash
+
+        attr_accessor :log_event
+        attr_accessor :log_redact
+        attr_accessor :log_hash
+
+        attr_accessor :action_id
+      end
+
+      class RequestProtectionManager
+        FORM = 'form'.freeze
+        COOKIE = 'cookie'.freeze
+        HEADER = 'header'.freeze
+      end
+
+      attr_accessor :enabled
+      attr_accessor :session_id_filter_actions
+      attr_accessor :request_filter_actions
+      attr_accessor :database_filter_actions
+
+      attr_accessor :policy_id
+
+      attr_accessor :table_field_actions
+      attr_accessor :session_id_actions
+      attr_accessor :database_actions
+
+      attr_accessor :database_discovery_enabled
+
+      attr_accessor :field_redact_body
+      attr_accessor :field_alerts
+
+      def initialize
+        init_options
+      end
+
+      def init_options
+        @enabled = false
+        @policy_id = nil
+
+        @table_field_actions = {}
+        @session_id_actions = []
+
+        @database_discovery_enabled = false
+
+        @field_redact_body = Set.new # ["work_infos.SSN"].to_set #
+        @field_alerts = Set.new
+
+        @session_id_filter_actions = nil
+        @request_filter_actions = {
+          RequestProtectionManager::FORM => Hash.new { |h, k| h[k] = Hash.new { |i_h, i_k| i_h[i_k] = Set.new } },
+          RequestProtectionManager::COOKIE => Hash.new { |h, k| h[k] = Hash.new { |i_h, i_k| i_h[i_k] = Set.new } },
+          RequestProtectionManager::HEADER => Hash.new { |h, k| h[k] = Hash.new { |i_h, i_k| i_h[i_k] = Set.new } }
+        }
+        @database_actions = Hash.new do |h, k|
+          h[k] = Hash.new do |d_h, d_k|
+            d_h[d_k] = Hash.new do |s_h, s_k|
+              s_h[s_k] = Hash.new do |t_h, t_k|
+                t_h[t_k] = Hash.new do |f_h, f_k|
+                  f_h[f_k] = Set.new
+                end
+              end
             end
+          end
+        end
 
-            attr_accessor :enabled
-            attr_accessor :session_id_filter_actions
-            attr_accessor :request_filter_actions
-            attr_accessor :database_filter_actions
-
-            # {
-            #    {"context":[]}
-            # }
-
-            attr_accessor :policy_id
-
-            attr_accessor :table_field_actions
-            attr_accessor :session_id_actions
-            attr_accessor :database_actions
-
-            attr_accessor :database_discovery_enabled
-
-            attr_accessor :field_redact_body
-            attr_accessor :field_alerts
-
-            def initialize
-                self.init_options
-            end
+        @log_actions = nil
+      end
 
-            def init_options
-                @enabled = false
-                @policy_id = nil
+      def get_actions_for_session_id(_route_id = nil)
+        @session_id_filter_actions
+      end
 
-                @table_field_actions = {}
-                @session_id_actions = []
+      def actions_for_form_parameter?
+        !@request_filter_actions[RequestProtectionManager::FORM].empty?
+      end
 
-                @database_discovery_enabled = false
+      def actions_for_headers?
+        !@request_filter_actions[RequestProtectionManager::HEADER].empty?
+      end
 
-                @field_redact_body = Set.new #["work_infos.SSN"].to_set #
-                @field_alerts = Set.new
+      def actions_for_cookie?
+        !@request_filter_actions[RequestProtectionManager::COOKIE].empty?
+      end
 
-                @session_id_filter_actions = nil
-                @request_filter_actions = {
-                    RequestProtectionManager::FORM=>Hash.new{|h,k| h[k] = Hash.new{|h,k| h[k] = Set.new}},
-                    RequestProtectionManager::COOKIE=>Hash.new{|h,k| h[k] = Hash.new{|h,k| h[k] = Set.new}},
-                    RequestProtectionManager::HEADER=>Hash.new{|h,k| h[k] = Hash.new{|h,k| h[k] = Set.new}}
-                }
-                @database_actions = Hash.new{|h,k| h[k] = Hash.new{|h,k| h[k] = Hash.new{|h,k| h[k] = Hash.new{|h,k| h[k] = Hash.new{|h,k| h[k] = Set.new}}}}}
+      def get_actions_for_cookie(cookie_name, route_id = nil)
+        get_actions_for_request(RequestProtectionManager::COOKIE, cookie_name, route_id)
+      end
 
-                @log_actions = nil
-            end
+      def get_actions_for_header(header_name, route_id = nil)
+        get_actions_for_request(RequestProtectionManager::HEADER, header_name.downcase, route_id)
+      end
 
-            def get_actions_for_session_id(route_id=nil)
-                return @session_id_filter_actions
-            end
+      def get_actions_for_form_parameter(parameter_name, route_id = nil)
+        get_actions_for_request(RequestProtectionManager::FORM, parameter_name.downcase, route_id)
+      end
 
-            def has_actions_for_form_parameter?
-                return @request_filter_actions[RequestProtectionManager::FORM].size > 0
+      def get_actions_for_request(context, variable, route_id = nil)
+        return nil if context.nil? || variable.nil?
+        route_id = '*' if route_id.nil?
+        if context != RequestProtectionManager::COOKIE
+          variable = variable.downcase
+        end
+        actions = Set.new
+        if @request_filter_actions.key?(context)
+          if @request_filter_actions[context].key?(route_id)
+            if @request_filter_actions[context][route_id].key?(variable)
+              actions.merge(@request_filter_actions[context][route_id][variable])
             end
-
-            def has_actions_for_headers?
-                return @request_filter_actions[RequestProtectionManager::HEADER].size > 0
+          end
+          if route_id != '*' && @request_filter_actions[context].key?('*')
+            if @request_filter_actions[context]['*'].key?(variable)
+              actions.merge(@request_filter_actions[context]['*'][variable])
             end
-
-            def has_actions_for_cookie?
-                return @request_filter_actions[RequestProtectionManager::COOKIE].size > 0
+          end
+        end
+        return nil if actions.size <= 0
+        actions
+      end
+
+      def get_actions_for_table(database, schema, table, field, route_id = '*')
+        route_id = '*' if route_id.nil?
+        actions = Set.new
+        [database, '*'].each do |d|
+          next if @database_actions.key?(d) == false
+          [schema, '*'].each do |s|
+            next if @database_actions[d].key?(s) == false
+            [table, '*'].each do |t|
+              next if @database_actions[d][s].key?(t) == false
+              [field, '*'].each do |f|
+                next if @database_actions[d][s][t].key?(f) == false
+                route_id_rules = @database_actions[d][s][t][f]
+                if route_id_rules.key?(route_id)
+                  actions.merge(@database_actions[d][s][t][f][route_id])
+                end
+                if route_id != '*' && route_id_rules.key?('*')
+                  actions.merge(@database_actions[d][s][t][f]['*'])
+                end
+              end
             end
+          end
+        end
+        return nil if actions.empty?
+        actions
+      end
+
+      def get_actions_for(table, field)
+        actions = Set.new
+        key = "#{table}.#{field}"
+        actions.merge(@table_field_actions.fetch(key, [].to_set))
+        actions
+      end
+
+      def self.actions_from_json(options)
+        actions = nil
+        if options.key?('log')
+          if options['log'].include? 'redact'
+            actions ||= FilterActions.new
+            actions.log_redact = true
+          end
+          if options['log'].include? 'event'
+            actions ||= FilterActions.new
+            actions.log_event = true
+          end
+          if options['log'].include? 'hash'
+            actions ||= FilterActions.new
+            actions.log_hash = true
+          end
+        end
+        if options.key?('body')
+          if options['body'].include? 'redact'
+            actions ||= FilterActions.new
+            actions.body_redact = true
+          end
+          if options['body'].include? 'event'
+            actions ||= FilterActions.new
+            actions.body_event = true
+          end
+          if options['body'].include? 'hash'
+            actions ||= FilterActions.new
+            actions.body_hash = true
+          end
+        end
+        actions
+      end
 
-            def get_actions_for_cookie(cookie_name, route_id=nil)
-                get_actions_for_request(RequestProtectionManager::COOKIE, cookie_name, route_id)
-            end
+      def self.from_json(policy_json)
+        return nil unless policy_json
 
-            def get_actions_for_header(header_name, route_id=nil)
-                get_actions_for_request(RequestProtectionManager::HEADER, header_name.downcase, route_id)
-            end
+        policy = DataLossPolicy.new
+        policy.policy_id = policy_json['policy_id']
+        raise 'Policy ID missing' unless policy.policy_id
 
-            def get_actions_for_form_parameter(parameter_name, route_id=nil)
-                get_actions_for_request(RequestProtectionManager::FORM, parameter_name.downcase, route_id)
-            end
+        data_json = (policy_json['data'] || {})
 
-            def get_actions_for_request(context, variable, route_id=nil)
-                if (context == nil || variable == nil)
-                    return nil
-                end
-                if (route_id == nil)
-                    route_id = "*"
-                end
-                if (context != RequestProtectionManager::COOKIE)
-                    variable = variable.downcase
-                end
-                actions = Set.new
-                if @request_filter_actions.has_key?(context)
-                    if @request_filter_actions[context].has_key?(route_id)
-                        if @request_filter_actions[context][route_id].has_key?(variable)
-                            actions.merge(@request_filter_actions[context][route_id][variable])
-                        end
-                    end
-                    if route_id != "*" && @request_filter_actions[context].has_key?("*")
-                        if @request_filter_actions[context]["*"].has_key?(variable)
-                            actions.merge(@request_filter_actions[context]["*"][variable])
-                        end
-                    end
-                end
-                if (actions.size <= 0)
-                    return nil
-                end
-                return actions
-            end
+        if data_json.key?('data_discovery')
+          data_discovery_json = data_json['data_discovery']
+          policy.database_discovery_enabled = data_discovery_json.fetch('database_enabled', false)
+          policy.enabled = policy.database_discovery_enabled
+        end
 
-            def get_actions_for_table(database, schema, table, field, route_id="*")
-                if route_id == nil
-                    route_id = "*"
-                end
-                actions = Set.new
-                [database, "*"].each do |d|
-                    if (@database_actions.has_key?(d) == false)
-                        next
-                    end
-                    [schema, "*"].each do |s|
-                        if (@database_actions[d].has_key?(s) == false)
-                            next
-                        end
-                        [table, "*"].each do |t|
-                            if (@database_actions[d][s].has_key?(t) == false)
-                                next
-                            end
-                            [field, "*"].each do |f|
-                                if (@database_actions[d][s][t].has_key?(f) == false)
-                                    next
-                                end
-                                route_id_rules = @database_actions[d][s][t][f]
-                                if (route_id_rules.has_key?(route_id))  
-                                    actions.merge(@database_actions[d][s][t][f][route_id])
-                                end
-                                if (route_id != "*" && route_id_rules.has_key?("*"))
-                                    actions.merge(@database_actions[d][s][t][f]["*"])
-                                end
-                            end
-                        end
-                    end
-                end
-                if (actions.size == 0)
-                    return nil
-                end
-                actions
-            end
+        if data_json.key?('session_id_protections')
+          session_id_protection = data_json['session_id_protections']
+          rule_id = session_id_protection.fetch('id', nil)
+          filter_actions = DataLossPolicy.actions_from_json(session_id_protection)
+          unless filter_actions.nil?
+            policy.enabled = true
+            filter_actions.action_id = rule_id
+            policy.session_id_filter_actions = filter_actions
+          end
+        end
 
-            def get_actions_for(table, field)
-                actions = Set.new
-                key = "#{table}.#{field}"
-                actions.merge(@table_field_actions.fetch(key,[].to_set))
-                return actions
+        if data_json.key?('request_protections')
+          data_json['request_protections'].each do |protection|
+            context = protection.fetch('variable_context', nil)
+            variables = protection.fetch('variables', nil)
+            scope = protection.fetch('scope', 'global')
+            rule_id = protection.fetch('id', nil)
+            options = protection.fetch('actions', nil)
+            route_ids = []
+
+            if scope == 'global'
+              route_ids = ['*']
+            elsif scope == 'route'
+              route_ids = protection.fetch('route_ids', [])
+            else
+              next
             end
 
-            def self.actions_from_json(options)
-                actions = nil
-                if options.has_key?("log")
-                    if (options["log"].include? "redact")
-                        actions ||= FilterActions.new
-                        actions.log_redact = true
-                    end
-                    if (options["log"].include? "event")
-                        actions ||= FilterActions.new
-                        actions.log_event = true
-                    end
-                    if (options["log"].include? "hash")
-                        actions ||= FilterActions.new
-                        actions.log_hash = true
-                    end
-                end
-                if options.has_key?("body")
-                    if (options["body"].include? "redact")
-                        actions ||= FilterActions.new
-                        actions.body_redact = true
-                    end
-                    if (options["body"].include? "event")
-                        actions ||= FilterActions.new
-                        actions.body_event = true
-                    end
-                    if (options["body"].include? "hash")
-                        actions ||= FilterActions.new
-                        actions.body_hash = true
-                    end
-                end
-                actions
-            end
-
-            def self.from_json(policy_json)
-                if (!policy_json)
-                    return nil
-                end
-
-                policy = DataLossPolicy.new
-                if policy_json.has_key?("policy_id")
-                    policy.policy_id = policy_json["policy_id"]
+            next unless context && policy.request_filter_actions.key?(context) && variables && options
+            filter_actions = DataLossPolicy.actions_from_json(options)
+            next if filter_actions.nil?
+            policy.enabled = true
+            filter_actions.action_id = rule_id
+            variables.each do |variable|
+              route_ids.each  do |route_id|
+                if context == RequestProtectionManager::COOKIE
+                  # Case sensitive variable name
+                  policy.request_filter_actions[context][route_id][variable].add(filter_actions)
                 else
-                    raise "Policy ID missing"
+                  policy.request_filter_actions[context][route_id][variable.downcase].add(filter_actions)
                 end
+              end
+            end
+          end
+        end
 
-                if policy_json.has_key?("data")
-                    data_json = policy_json["data"]
-                    if data_json.has_key?("data_discovery")
-                        data_discovery_json = data_json["data_discovery"]
-                        policy.database_discovery_enabled = data_discovery_json.fetch('database_enabled', false)
-                        policy.enabled = policy.database_discovery_enabled
-                    end
-                    if data_json.has_key?("session_id_protections")
-                        session_id_protection = data_json["session_id_protections"]
-                        rule_id = session_id_protection.fetch("id",nil)
-                        filter_actions = DataLossPolicy.actions_from_json(session_id_protection)
-                        if filter_actions != nil
-                            policy.enabled = true
-                            filter_actions.action_id = rule_id
-                            policy.session_id_filter_actions = filter_actions
-                        end
-                    end
-
-                    if data_json.has_key?("request_protections")
-                        data_json["request_protections"].each do |protection|
-                            context = protection.fetch('variable_context', nil)
-                            variables = protection.fetch('variables', nil)
-                            scope = protection.fetch('scope', "global")
-                            rule_id = protection.fetch("id",nil)
-                            options = protection.fetch('actions', nil)
-                            route_ids = []
-
-                            if (scope == "global")
-                                route_ids = ["*"]
-                            elsif (scope == "route")
-                                route_ids = protection.fetch("route_ids",[])
-                            else
-                                next
-                            end
-
-                            if context && policy.request_filter_actions.has_key?(context) && variables && options
-                                filter_actions = DataLossPolicy.actions_from_json(options)
-                                if filter_actions != nil
-                                    policy.enabled = true
-                                    filter_actions.action_id = rule_id
-                                    variables.each do |variable|
-                                        route_ids.each  do |route_id|
-                                            if (context == RequestProtectionManager::COOKIE)
-                                                # Case sensitive variable name
-                                                policy.request_filter_actions[context][route_id][variable].add(filter_actions)
-                                            else
-                                                policy.request_filter_actions[context][route_id][variable.downcase].add(filter_actions)
-                                            end
-                                        end
-                                    end
-                                end
-                            end
-                        end
-                    end
-
-                    if data_json.has_key?("db_protections")
-                        protections = data_json["db_protections"]
-                        if protections
-                            protections.each do |protection_json|
-                                scope = protection_json.fetch("scope",nil)
-                                _databases = protection_json.fetch("databases",["*"])
-                                _schemas = protection_json.fetch("schemas",["*"])
-                                _tables = protection_json.fetch("tables",["*"])
-                                _fields = protection_json.fetch("fields",nil)
-                                rule_id = protection_json.fetch("id",nil)
-                                actions = protection_json.fetch("actions",{})
-                                filter_actions = DataLossPolicy.actions_from_json(actions)
-                                _route_ids = ["*"]
-
-                                if scope != nil && scope != "global"
-                                    if scope=="route"
-                                        _route_ids = protection_json.fetch("route_ids",[])
-                                    end
-                                end
-                                if _fields == nil
-                                    next
-                                elsif filter_actions == nil
-                                    next
-                                end
-
-                                policy.enabled = true
-                                filter_actions.action_id = rule_id
-                                _databases.each do |_database|
-                                    _schemas.each do |_schema|
-                                        _tables.each do |_table|
-                                            _fields.each do |_field|
-                                                _route_ids.each do |_route_id|
-                                                    policy.database_actions[_database][_schema][_table][_field][_route_id].add(filter_actions)
-                                                end
-                                            end
-                                        end
-                                    end
-                                end
-                            end
-                        end
+        if data_json.key?('db_protections')
+          protections = data_json['db_protections']
+          if protections
+            protections.each do |protection_json|
+              scope = protection_json.fetch('scope', nil)
+              databases = protection_json.fetch('databases', ['*'])
+              schemas = protection_json.fetch('schemas', ['*'])
+              tables = protection_json.fetch('tables', ['*'])
+              fields = protection_json.fetch('fields', nil)
+              rule_id = protection_json.fetch('id', nil)
+              actions = protection_json.fetch('actions', {})
+              filter_actions = DataLossPolicy.actions_from_json(actions)
+              route_ids = ['*']
+
+              if !scope.nil? && scope != 'global' && scope == 'route'
+                route_ids = protection_json.fetch('route_ids', [])
+              end
+
+              next if fields.nil? || filter_actions.nil?
+
+              policy.enabled = true
+              filter_actions.action_id = rule_id
+              databases.each do |database|
+                schemas.each do |schema|
+                  tables.each do |table|
+                    fields.each do |field|
+                      route_ids.each do |route_id|
+                        policy.database_actions[database][schema][table][field][route_id].add(filter_actions)
+                      end
                     end
+                  end
                 end
-
-                return policy
+              end
             end
+          end
         end
+
+        policy
+      end
     end
+  end
 end