tcell_agent 2.1.1 → 2.4.0

data/lib/tcell_agent/hooks/login_fraud.rb

@@ -3,7 +3,7 @@ require 'tcell_agent/agent'
 module TCellAgent
   module Hooks
     module LoginFraud
-      # Note: mock out in tests
+      # NOTE: mock out in tests
       def self.get_logger
         unless defined?(@login_fraud_logger)
           @login_fraud_logger = TCellAgent::ModuleLogger.new(TCellAgent.logger, name)

data/lib/tcell_agent/instrument_servers.rb

@@ -1,25 +1,21 @@
+# frozen_string_literal: true
+
 tcell_server = ENV['TCELL_AGENT_SERVER']
 
-if TCellAgent.configuration.should_instrument?
-  unless tcell_server && tcell_server == 'mock'
-    if (tcell_server && tcell_server == 'webrick') || defined?(Rails::Server)
-      require('tcell_agent/servers/rails_server')
+TCellAgent.thread_agent.instrument_built_ins if tcell_server &&
+                                                tcell_server == 'mock'
 
-    elsif (tcell_server && tcell_server == 'thin') || defined?(Thin)
-      require('tcell_agent/servers/thin')
+require('tcell_agent/servers/rails_server') if (tcell_server && tcell_server == 'webrick') ||
+                                               defined?(Rails::Server)
 
-    elsif (tcell_server && tcell_server == 'puma') || defined?(Puma)
-      require('tcell_agent/servers/puma')
+require('tcell_agent/servers/thin') if (tcell_server && tcell_server == 'thin') ||
+                                       defined?(Thin)
 
-    elsif (tcell_server && tcell_server == 'unicorn') || defined?(Unicorn)
-      require('tcell_agent/servers/unicorn')
+require('tcell_agent/servers/puma') if (tcell_server && tcell_server == 'puma') ||
+                                       defined?(Puma)
 
-    elsif (tcell_server && tcell_server == 'passenger') || defined?(PhusionPassenger)
-      require('tcell_agent/servers/passenger')
-    end
-  end
+require('tcell_agent/servers/unicorn') if (tcell_server && tcell_server == 'unicorn') ||
+                                          defined?(Unicorn)
 
-elsif (tcell_server && tcell_server == 'unicorn') || defined?(Unicorn)
-  # unicorn is always instrumented to support rolling restarts
-  require('tcell_agent/servers/unicorn')
-end
+require('tcell_agent/servers/passenger') if (tcell_server && tcell_server == 'passenger') ||
+                                            defined?(PhusionPassenger)

data/lib/tcell_agent/instrumentation.rb

@@ -65,7 +65,8 @@ module TCellAgent
                     :password, :route_id, :path, :uri, :fullpath, :context_filters_by_term,
                     :database_filters, :remote_address, :user_agent, :request_method,
                     :path_parameters, :patches_blocking_triggered, :grape_mount_endpoint,
-                    :referrer, :csrf_exception_name, :sql_exceptions, :database_result_sizes
+                    :referrer, :csrf_exception_name, :sql_exceptions, :database_result_sizes,
+                    :reverse_proxy_header_value
 
       def self.filterx(sanitize_string, event_flag, replace_flag, term)
         send_event = false
@@ -91,26 +92,31 @@ module TCellAgent
 
       def valid_term?(term)
         return true if !term.nil? && term != '' && term.to_s.length >= 5
+
         false
       end
 
       def add_response_db_filter(term, action_obj, database, schema, table, field)
         return unless valid_term?(term)
+
         context_filters_by_term[term.to_s].add(ContextFilter.new.for_database(database, schema, table, field, action_obj))
       end
 
       def add_filter_for_request_parameter(term, rule, parameter_name)
         return unless valid_term?(term)
+
         context_filters_by_term[term.to_s].add(ContextFilter.new.for_request('form', parameter_name, rule))
       end
 
       def add_filter_for_header_value(term, rule, header_name)
         return unless valid_term?(term)
+
         context_filters_by_term[term.to_s].add(ContextFilter.new.for_request('header', header_name, rule))
       end
 
       def add_filter_for_cookie_value(term, rule, cookie_name)
         return unless valid_term?(term)
+
         context_filters_by_term[term.to_s].add(ContextFilter.new.for_request('cookie', cookie_name, rule))
       end
 
@@ -139,6 +145,7 @@ module TCellAgent
           send_flag = TCellData.filterx(body, !event_filters.empty?, !replace_filters.empty?, term)
           send_flag ||= TCellData.filterx(body, !event_filters.empty?, !replace_filters.empty?, CGI.escapeHTML(term))
           next unless send_flag
+
           (replace_filters + event_filters).each do |filter|
             base_event = TCellAgent::SensorEvents::DlpEvent.new(
               route_id,
@@ -183,6 +190,7 @@ module TCellAgent
           event_filters = (context_filters.select { |context_filter| (context_filter.rule.log_redact != true && context_filter.rule.log_event == true) })
           send_flag = TCellData.filterx(log_msg, !event_filters.empty?, !replace_filters.empty?, term)
           next unless send_flag
+
           (replace_filters + event_filters).each do |filter|
             base_event = TCellAgent::SensorEvents::DlpEvent.new(
               route_id,
@@ -213,7 +221,7 @@ module TCellAgent
       end
     end
 
-    # Note: mock for tests
+    # NOTE: mock for tests
     def self.get_safe_block_logger
       unless defined?(@safe_block_logger)
         @safe_block_logger = TCellAgent::ModuleLogger.new(TCellAgent.logger, name)
@@ -224,15 +232,15 @@ module TCellAgent
 
     def self.safe_block(message, &block)
       block.call
-    rescue StandardError => ex
+    rescue StandardError => e
       logger = get_safe_block_logger
-      logger.error("Error #{message} (#{ex.class}): #{ex.message}")
-      logger.exception(ex)
+      logger.error("Error #{message} (#{e.class}): #{e.message}")
+      logger.exception(e)
     end
 
     def self.safe_block_no_log(_message, &block)
       block.call
-    rescue StandardError # rubocop:disable Lint/HandleExceptions
+    rescue StandardError
       # do nothing
     end
   end

data/lib/tcell_agent/instrumentation/cmdi.rb

@@ -25,18 +25,18 @@ module TCellAgent
       cmd = ''
 
       TCellAgent::Instrumentation.safe_block('CMDI Parsing *args') do
-        unless args.empty?
-          args_copy = Array.new(args)
-          args_copy.shift if args_copy.first.is_a?(Hash)
-          args_copy.pop if args_copy.last.is_a?(Hash)
-
-          if args_copy.first.is_a?(Array)
-            cmd_n_argv0 = args_copy.shift
-            args_copy.unshift(cmd_n_argv0.first)
-          end
+        return cmd if args.nil? || args.empty?
+
+        args_copy = Array.new(args)
+        args_copy.shift if args_copy.first.is_a?(Hash)
+        args_copy.pop if args_copy.last.is_a?(Hash)
 
-          cmd = args_copy.join(' ')
+        if args_copy.first.is_a?(Array)
+          cmd_n_argv0 = args_copy.shift
+          args_copy.unshift(cmd_n_argv0.first)
         end
+
+        cmd = args_copy.join(' ')
       end
 
       cmd
@@ -46,15 +46,47 @@ module TCellAgent
       cmd = ''
 
       TCellAgent::Instrumentation.safe_block('CMDI Parsing *args') do
-        unless args.empty?
-          args_copy = Array.new(args)
-          first_arg = args_copy.shift
+        return cmd if args.nil? || args.empty?
 
-          cmd = first_arg[1..-1] if first_arg && (first_arg.is_a? String) && first_arg[0] == '|'
-        end
+        args_copy = Array.new(args)
+        first_arg = args_copy.shift
+
+        cmd = first_arg[1..-1] if first_arg && (first_arg.is_a? String) && first_arg[0] == '|'
       end
 
       cmd
     end
+
+    def self.raise_if_block(cmd)
+      return unless TCellAgent::Cmdi.block_command?(cmd)
+
+      raise "tCell.io Agent: Command not allowed by policy: #{cmd}"
+    end
+
+    def self.default_cmdi_handler(args)
+      cmd = TCellAgent::Cmdi.parse_command(*args)
+
+      raise_if_block(cmd)
+    end
+
+    def self.popen_cmdi_handler(args)
+      return if args.empty?
+
+      cmd = ''
+
+      TCellAgent::Instrumentation.safe_block('CMDI Parsing popen *args') do
+        args_copy = Array.new(args)
+        args_copy.shift if args_copy.first.is_a?(Hash)
+        args_copy.pop if args_copy.last.is_a?(Hash)
+
+        cmd = if args_copy.first.is_a?(String)
+                args_copy.shift
+              else
+                TCellAgent::Cmdi.parse_command(*args_copy.shift)
+              end
+      end
+
+      raise_if_block(cmd)
+    end
   end
 end

data/lib/tcell_agent/instrumentation/lfi.rb

@@ -5,6 +5,8 @@ require 'tcell_agent/configuration'
 module TCellAgent
   module Instrumentation
     module Lfi
+      extend TCellAgent::ModuleLoggerAccess
+
       def self.block_file_access?(path, mode)
         TCellAgent::Instrumentation.safe_block('Checking Local Files Policy') do
           if TCellAgent::Utils::Strings.present?(path)
@@ -26,15 +28,23 @@ module TCellAgent
         path = ''
         mode = ''
 
-        return ['', ''] if args.empty?
-
         TCellAgent::Instrumentation.safe_block('LFI Parsing *args') do
+          return ['', ''] if args.nil? || args.empty?
+
           args_copy = Array.new(args)
           path = args_copy.shift
           mode = args_copy.shift || 'r'
 
           if path && path.to_s[0] != '|'
-            [File.expand_path(path).to_s, convert_mode(mode)]
+            path = File.expand_path(path.to_s)
+
+            mode = if mode && mode.is_a?(Hash)
+                     convert_mode(mode[:mode])
+                   else
+                     convert_mode(mode)
+                   end
+
+            [path, mode]
           else
             ['', '']
           end
@@ -46,15 +56,28 @@ module TCellAgent
         mode = 'Read'
 
         TCellAgent::Instrumentation.safe_block('LFI Parsing ARGF') do
-          if ARGF.eof? && !ARGV.empty?
-            argv_copy = Array.new(ARGV)
-            path = argv_copy.shift
-          else
-            path = ARGF.filename
-          end
+          begin
+            return ['', ''] if ARGF.file == $stdin
 
-          path = File.expand_path(path) unless path.nil?
-          [path.to_s, mode]
+            if ARGF.eof? && !ARGV.empty?
+              argv_copy = Array.new(ARGV)
+              path = argv_copy.shift
+            else
+              path = ARGF.filename
+            end
+
+            if path && path.to_s[0] != '|'
+              [File.expand_path(path.to_s), mode]
+            else
+              ['', '']
+            end
+          rescue Errno::ENOENT
+            module_logger.debug('LFI Parsing ARGF: attempted to read a non-existent file')
+            ['', '']
+          rescue Errno::EISDIR
+            module_logger.debug('LFI Parsing ARGF: attempted to read a directory')
+            [ARGF.filename, mode]
+          end
         end
       end
 
@@ -68,6 +91,40 @@ module TCellAgent
         end
         'Read'
       end
+
+      def self.raise_if_block(path, mode)
+        return unless block_file_access?(path, mode)
+
+        raise IOError, "tCell.io Agent: Attempted access to file #{path} with mode #{mode} denied"
+      end
+
+      def self.default_open_handler(args, override_mode = '')
+        path, mode = extract_path_mode(*args)
+
+        mode = override_mode unless override_mode.empty?
+
+        raise_if_block(path, mode)
+      end
+
+      def self.argf_open_handler
+        path, mode = TCellAgent::Instrumentation::Lfi.extract_path_mode_argf
+
+        raise_if_block(path, mode)
+      end
+
+      def self.cmdi_open_handler(args, override_mode = '')
+        path, mode = extract_path_mode(*args)
+
+        mode = override_mode unless override_mode.empty?
+
+        raise_if_block(path, mode)
+
+        return unless path.empty?
+
+        cmd = TCellAgent::Cmdi.parse_command_from_open(*args)
+
+        TCellAgent::Cmdi.raise_if_block(cmd) if cmd
+      end
     end
   end
 end

data/lib/tcell_agent/instrumentation/monkey_patches/ruby_2/file.rb

@@ -0,0 +1,21 @@
+class File
+  class << self
+    if TCellAgent.configuration.should_instrument?('File::new')
+      alias_method :tcell_original_new, :new
+      def new(*args, &block)
+        TCellAgent::Instrumentation::Lfi.default_open_handler(args)
+
+        tcell_original_new(*args, &block)
+      end
+    end
+
+    if TCellAgent.configuration.should_instrument?('File::open')
+      alias_method :tcell_original_open, :open
+      def open(*args, &block)
+        TCellAgent::Instrumentation::Lfi.default_open_handler(args)
+
+        tcell_original_open(*args, &block)
+      end
+    end
+  end
+end

data/lib/tcell_agent/instrumentation/monkey_patches/ruby_2/io.rb

@@ -0,0 +1,75 @@
+class IO
+  class << self
+    if TCellAgent.configuration.should_instrument?('IO::binread')
+      alias_method :tcell_original_binread, :binread
+      def binread(*args, &block)
+        TCellAgent::Instrumentation::Lfi.cmdi_open_handler(args)
+
+        tcell_original_binread(*args, &block)
+      end
+    end
+
+    if TCellAgent.configuration.should_instrument?('IO::binwrite')
+      alias_method :tcell_original_binwrite, :binwrite
+      def binwrite(*args, &block)
+        TCellAgent::Instrumentation::Lfi.default_open_handler(args, 'Write')
+
+        tcell_original_binwrite(*args, &block)
+      end
+    end
+
+    if TCellAgent.configuration.should_instrument?('IO::foreach')
+      alias_method :tcell_original_foreach, :foreach
+      def foreach(*args, &block)
+        TCellAgent::Instrumentation::Lfi.default_open_handler(args, 'Read')
+
+        tcell_original_foreach(*args, &block)
+      end
+    end
+
+    if TCellAgent.configuration.should_instrument?('IO::popen')
+      alias_method :tcell_original_popen, :popen
+      def popen(*args, &block)
+        TCellAgent::Cmdi.popen_cmdi_handler(args)
+
+        tcell_original_popen(*args, &block)
+      end
+    end
+
+    if TCellAgent.configuration.should_instrument?('IO::read')
+      alias_method :tcell_original_read, :read
+      def read(*args, &block)
+        TCellAgent::Instrumentation::Lfi.cmdi_open_handler(args, 'Read')
+
+        tcell_original_read(*args, &block)
+      end
+    end
+
+    if TCellAgent.configuration.should_instrument?('IO::readlines')
+      alias_method :tcell_original_readlines, :readlines
+      def readlines(*args, &block)
+        TCellAgent::Instrumentation::Lfi.cmdi_open_handler(args, 'Read')
+
+        tcell_original_readlines(*args, &block)
+      end
+    end
+
+    if TCellAgent.configuration.should_instrument?('IO::sysopen')
+      alias_method :tcell_original_sysopen, :sysopen
+      def sysopen(*args, &block)
+        TCellAgent::Instrumentation::Lfi.default_open_handler(args)
+
+        tcell_original_sysopen(*args, &block)
+      end
+    end
+
+    if TCellAgent.configuration.should_instrument?('IO::write')
+      alias_method :tcell_original_write, :write
+      def write(*args, &block)
+        TCellAgent::Instrumentation::Lfi.default_open_handler(args, 'Write')
+
+        tcell_original_write(*args, &block)
+      end
+    end
+  end
+end

data/lib/tcell_agent/instrumentation/monkey_patches/ruby_2/kernel.rb

@@ -0,0 +1,80 @@
+module Kernel
+  private
+
+  if TCellAgent.configuration.should_instrument?('Kernel#`')
+    alias_method :tcell_original_backtick, :`
+    def `(cmd)
+      TCellAgent::Cmdi.raise_if_block(cmd)
+
+      tcell_original_backtick(cmd)
+    end
+
+    module_function :`
+  end
+
+  if TCellAgent.configuration.should_instrument?('Kernel#exec')
+    alias_method :tcell_original_exec, :exec
+    def exec(*args)
+      TCellAgent::Cmdi.default_cmdi_handler(args)
+
+      tcell_original_exec(*args)
+    end
+
+    module_function :exec
+  end
+
+  if TCellAgent.configuration.should_instrument?('Kernel#gets')
+    alias_method :tcell_original_gets, :gets
+    def gets(*args, &block)
+      TCellAgent::Instrumentation::Lfi.argf_open_handler
+
+      tcell_original_gets(*args, &block)
+    end
+
+    module_function :gets
+  end
+
+  if TCellAgent.configuration.should_instrument?('Kernel#open')
+    alias_method :tcell_original_open, :open
+    def open(*args, &block)
+      TCellAgent::Instrumentation::Lfi.cmdi_open_handler(args)
+
+      tcell_original_open(*args, &block)
+    end
+
+    module_function :open
+  end
+
+  if TCellAgent.configuration.should_instrument?('Kernel#readline')
+    alias_method :tcell_original_readline, :readline
+    def readline(*args, &block)
+      TCellAgent::Instrumentation::Lfi.argf_open_handler
+
+      tcell_original_readline(*args, &block)
+    end
+
+    module_function :readline
+  end
+
+  if TCellAgent.configuration.should_instrument?('Kernel#spawn')
+    alias_method :tcell_original_spawn, :spawn
+    def spawn(*args)
+      TCellAgent::Cmdi.default_cmdi_handler(args)
+
+      tcell_original_spawn(*args)
+    end
+
+    module_function :spawn
+  end
+
+  if TCellAgent.configuration.should_instrument?('Kernel#system')
+    alias_method :tcell_original_system, :system
+    def system(*args)
+      TCellAgent::Cmdi.default_cmdi_handler(args)
+
+      tcell_original_system(*args)
+    end
+
+    module_function :system
+  end
+end