tcell_agent 2.2.1 → 2.5.0

data/lib/tcell_agent/rust/native_library.rb

@@ -6,22 +6,20 @@ module TCellAgent
       require 'ffi'
       extend FFI::Library
 
-      VERSION = '5.0.2'.freeze
-      prefix = 'lib'
       extension = '.so'
       variant = ''
       if /cygwin|mswin|mingw|bccwin|wince|emx/ =~ RUBY_PLATFORM
+        variant = '-x64'
         extension = '.dll'
-        prefix = ''
       elsif /darwin/ =~ RUBY_PLATFORM
         extension = '.dylib'
       elsif /musl/ =~ RUBY_PLATFORM
-        variant = 'alpine-'
+        variant = '-alpine'
       end
 
       begin
         ffi_lib File.join(File.dirname(__FILE__),
-                          "#{prefix}tcellagent-#{variant}#{VERSION}#{extension}")
+                          "libtcellagent#{variant}#{extension}")
 
         # All the rust library calls have the following response api:
         #
@@ -36,6 +34,7 @@ module TCellAgent
         attach_function :poll_new_policies, %i[pointer pointer size_t], :int
         attach_function :appfirewall_apply, %i[pointer pointer size_t pointer size_t], :int
         attach_function :patches_apply, %i[pointer pointer size_t pointer size_t], :int
+        attach_function :suspicious_quick_check_apply, %i[pointer pointer size_t], :int
         attach_function :cmdi_apply, %i[pointer pointer size_t pointer size_t], :int
         attach_function :get_headers, %i[pointer pointer size_t pointer size_t], :int
         attach_function :get_js_agent_script_tag, %i[pointer pointer size_t pointer size_t], :int
@@ -48,17 +47,15 @@ module TCellAgent
         attach_function :log_message, %i[pointer pointer size_t pointer size_t], :int
 
         attach_function :update_policies, %i[pointer pointer size_t pointer size_t], :int
-        attach_function :test_event_sender, %i[pointer size_t pointer size_t], :int
-        attach_function :test_policies, %i[pointer size_t pointer size_t], :int
         attach_function :test_agent, %i[pointer size_t pointer size_t], :int
 
         def self.common_lib_available?
           true
         end
-      rescue LoadError => load_error
+      rescue LoadError => e
         logger = TCellAgent::ModuleLogger.new(TCellAgent::RubyLogger.new, name)
-        logger.error("Failed loading agent library. #{load_error.message}")
-        logger.exception(load_error)
+        logger.error("Failed loading agent library. #{e.message}")
+        logger.exception(e)
 
         def self.common_lib_available? # rubocop:disable Lint/DuplicateMethods
           false

data/lib/tcell_agent/sensor_events/server_agent.rb

@@ -7,59 +7,6 @@ require 'etc'
 
 module TCellAgent
   module SensorEvents
-    class ServerAgentDetailsSensorEvent < TCellSensorEvent
-      include TCellAgent::ModuleLoggerAccess
-
-      def initialize
-        super('server_agent_details')
-        @flush = true
-        @ensure = true
-
-        self['user'] = 'unknown'
-        self['group'] = 'unknown'
-
-        begin
-          login = Etc.getlogin
-          if login
-            self['user'] = login
-            begin
-              info = Etc.getpwnam(login)
-              self['group'] = info.gid.to_s
-            rescue StandardError => te
-              module_logger.debug("Could not get group id: #{te.message}")
-              module_logger.exception(te)
-            end
-          end
-        rescue StandardError => to
-          module_logger.debug("Could not get user & group: #{to.message}")
-          module_logger.exception(te)
-        end
-
-        module_logger.debug("User #{self['user']}")
-        module_logger.debug("Group #{self['group']}")
-      end
-    end
-
-    class ServerAgentDetailsLanguageEvent < TCellSensorEvent
-      def initialize(language, language_version)
-        super('server_agent_details')
-        @flush = true
-        @ensure = true
-        self['language'] = language
-        self['language_version'] = language_version
-      end
-    end
-
-    class ServerAgentAppFrameworkEvent < TCellSensorEvent
-      def initialize(framework_name, framework_version)
-        super('server_agent_details')
-        @flush = true
-        @ensure = true
-        self['app_framework'] = framework_name
-        self['app_framework_version'] = framework_version
-      end
-    end
-
     class ServerAgentPackagesSensorEvent < TCellSensorEvent
       include TCellAgent::ModuleLoggerAccess
 
@@ -75,59 +22,15 @@ module TCellAgent
               packages.push(package)
               module_logger.debug("Adding packages #{x.name}")
             end
-          rescue StandardError => te
-            module_logger.error("Exception adding package: #{te.message}")
-            module_logger.exception(te)
+          rescue StandardError => e
+            module_logger.error("Exception adding package: #{e.message}")
+            module_logger.exception(e)
           end
         end
         self['packages'] = packages
       end
     end
 
-    class AppFramework < TCellSensorEvent
-      def initialize(name, version)
-        super('appserver_framework')
-        @flush = false
-        @ensure = true
-        self['n'] = name
-        self['v'] = version
-      end
-    end
-
-    class AppAuthFramework < TCellSensorEvent
-      def initialize(name, version)
-        super('appserver_auth_framework')
-        @flush = false
-        @ensure = true
-        self['n'] = name
-        self['v'] = version
-      end
-    end
-
-    class AppFrameworkSetting < TCellSensorEvent
-      def initialize(framework_name, setting, value)
-        super('appserver_framework_setting')
-        @flush = false
-        @ensure = true
-        self['framework'] = framework_name
-        self['s'] = setting
-        self['v'] = value
-      end
-    end
-
-    class AppCookie < TCellSensorEvent
-      def initialize(name, value, secure, http_only, session)
-        super('appserver_framework_setting')
-        @flush = false
-        @ensure = true
-        self['n'] = name
-        self['v'] = value
-        self['http_only'] = http_only
-        self['secure'] = secure
-        self['session'] = session
-      end
-    end
-
     class AppRoutesSensorEvent < TCellSensorEvent
       def initialize(uri, method, route_id, params = nil, destination = nil)
         super('appserver_routes')

data/lib/tcell_agent/sensor_events/util/sanitizer_utilities.rb

@@ -19,6 +19,7 @@ module TCellAgent
         params = CGI.parse(query)
         params.each do |param_name, param_values|
           next if param_values.nil? || param_values.empty?
+
           params[param_name] = ['']
         end
         params.map { |k, v| "#{k}=#{v.join(',')}" }.join('&')

data/lib/tcell_agent/servers/puma.rb

@@ -1,6 +1,6 @@
 if defined?(Puma.cli_config)
   if Puma.cli_config.options[:preload_app]
-    if Puma.cli_config.options[:workers] == 0 # rubocop:disable Style/NumericPredicate
+    if Puma.cli_config.options[:workers] == 0
       # Puma is running in single mode, so run both the initial instrumentation and
       # start the agent
       Puma::Runner.class_eval do
@@ -15,24 +15,41 @@ if defined?(Puma.cli_config)
     else
       Puma::Server.class_eval do
         alias_method :tcell_original_run, :run
-        def run(background = true)
-          TCellAgent.thread_agent.start('Puma Cluster Mode (Worker)')
 
-          tcell_original_run(background)
+        if defined?(Gem::Version) &&
+           defined?(Puma::Const::PUMA_VERSION) &&
+           (Gem::Version.new(Puma::Const::PUMA_VERSION) < Gem::Version.new('5.1.0'))
+          def run(background = true)
+            TCellAgent.thread_agent.start('Puma')
+            original_run(background, options)
+          end
+        else
+          def run(background = true, thread_name: 'server')
+            TCellAgent.thread_agent.start('Puma')
+            original_run(background, :thread_name => thread_name)
+          end
         end
       end
     end
-
   else
     # this ensures instrumentation runs for preload_app = false.
     # Instrumentation will run for each worker but there's
     # nothing we can do about that (Unicorn's preload_app behaves the same way)
     Puma::Server.class_eval do
       alias_method :tcell_original_run, :run
-      def run(background = true)
-        TCellAgent.thread_agent.start('Puma Cluster Mode (Worker)')
 
-        tcell_original_run(background)
+      if defined?(Gem::Version) &&
+         defined?(Puma::Const::PUMA_VERSION) &&
+         (Gem::Version.new(Puma::Const::PUMA_VERSION) < Gem::Version.new('5.1.0'))
+        def run(background = true)
+          TCellAgent.thread_agent.start('Puma')
+          tcell_original_run(background)
+        end
+      else
+        def run(background = true, thread_name: 'server')
+          TCellAgent.thread_agent.start('Puma')
+          original_run(background, :thread_name => thread_name)
+        end
       end
     end
   end

data/lib/tcell_agent/servers/rack_puma_handler.rb

@@ -9,10 +9,20 @@ Rack::Handler::Puma.class_eval do
       if defined?(Puma::Server) && !Puma::Server.instance_methods.include?(:tcell_original_run)
         Puma::Server.class_eval do
           alias_method :tcell_original_run, :run
-          def run(background = true)
-            TCellAgent.thread_agent.start('Puma')
 
-            tcell_original_run(background)
+          if defined?(Gem::Version) &&
+             defined?(Puma::Const::PUMA_VERSION) &&
+             (Gem::Version.new(Puma::Const::PUMA_VERSION) >= Gem::Version.new('5.1.0'))
+            def run(background = true, thread_name: 'server')
+              TCellAgent.thread_agent.start('Puma')
+              original_run(background, :thread_name => thread_name)
+            end
+          else
+            def run(background = true)
+              TCellAgent.thread_agent.start('Puma')
+
+              tcell_original_run(background)
+            end
           end
         end
       end

data/lib/tcell_agent/servers/webrick.rb

@@ -1,9 +1,19 @@
 Rack::Handler::WEBrick.class_eval do
   class << self
     alias_method :original_run, :run
-    def run(app, options = {})
-      TCellAgent.thread_agent.start('WEBrick')
-      original_run(app, options)
+
+    if defined?(Gem::Version) &&
+       defined?(Rack.release) &&
+       Gem::Version.new(Rack.release) < Gem::Version.new('2.2.0')
+      def run(app, options = {})
+        TCellAgent.thread_agent.start('WEBrick')
+        original_run(app, options)
+      end
+    else
+      def run(app, **options)
+        TCellAgent.thread_agent.start('WEBrick')
+        original_run(app, **options)
+      end
     end
   end
 end

data/lib/tcell_agent/settings_reporter.rb

@@ -7,25 +7,11 @@ require 'thread'
 module TCellAgent
   def self.report_settings
     Thread.new do
-      TCellAgent::Instrumentation.safe_block('Instrumenting Agent Details') do
-        event = TCellAgent::SensorEvents::ServerAgentDetailsSensorEvent.new
-        TCellAgent.send_event(event)
-      end
-
       TCellAgent::Instrumentation.safe_block('Instrumenting Server Packages') do
         event = TCellAgent::SensorEvents::ServerAgentPackagesSensorEvent.new
         TCellAgent.send_event(event)
       end
 
-      TCellAgent::Instrumentation.safe_block('Instrumenting Language Info') do
-        TCellAgent.send_event(
-          TCellAgent::SensorEvents::ServerAgentDetailsLanguageEvent.new(
-            'Ruby',
-            RUBY_VERSION
-          )
-        )
-      end
-
       TCellAgent::Instrumentation.safe_block('Instrumenting Native Lib Status') do
         require 'tcell_agent/rust/native_agent'
 

data/lib/tcell_agent/sinatra.rb

@@ -16,6 +16,7 @@ module TCellAgent
       TCellAgent::Instrumentation.safe_block('Setting Headers') do
         headers_policy = TCellAgent.policy(TCellAgent::PolicyTypes::HEADERS)
         policy_headers = headers_policy.get_headers(
+          headers['Content-Type'],
           request.env[TCellAgent::Instrumentation::TCELL_ID]
         )
         policy_headers.each do |header_info|

data/lib/tcell_agent/tcell_context.rb

@@ -43,7 +43,8 @@ module TCellAgent
           tcell_context.session_id,
           tcell_context.user_id,
           tcell_context.transaction_id,
-          tcell_context.uri
+          tcell_context.uri,
+          tcell_context.reverse_proxy_header_value
         )
         meta_data.path = tcell_context.path
 
@@ -70,7 +71,8 @@ module TCellAgent
                   :response_headers,
                   :csrf_exception_name,
                   :sql_exceptions,
-                  :database_result_sizes
+                  :database_result_sizes,
+                  :reverse_proxy_header_value
 
     attr_reader :flattened_get_dict,
                 :flattened_cookie_dict,
@@ -85,7 +87,8 @@ module TCellAgent
                    session_id,
                    user_id,
                    transaction_id,
-                   location)
+                   location,
+                   reverse_proxy_header_value)
       @method = method
       @remote_address = remote_address
       @route_id = route_id
@@ -93,7 +96,7 @@ module TCellAgent
       @user_id = user_id
       @transaction_id = transaction_id
       @location = location
-      @path = path
+      @reverse_proxy_header_value = reverse_proxy_header_value
 
       @flattened_get_dict = {}
       @flattened_cookie_dict = {}
@@ -148,6 +151,7 @@ module TCellAgent
       if !content_length.nil? && content_length > TCELL_MAX_BODY_LENGTH || request.content_type.nil?
         return nil
       end
+
       raw_post_data = nil
       # Positions strio to the beginning of input, resetting lineno to zero.
       # rails 4.1 seems to read the stringIO directly and so body.gets is empty
@@ -171,10 +175,15 @@ module TCellAgent
       self.get_dict = request.GET
       self.cookie_dict = request.cookies
 
-      self.post_dict = if @content_type.start_with?('application/json', 'application/xml')
+      self.post_dict = if @content_type.start_with?('application/json', 'application/xml') ||
+                          (@content_type.start_with?('multipart/form-data') && @request_content_bytes_len == 0)
                          {}
                        else
-                         request.POST
+                         begin
+                           request.POST
+                         rescue EOFError
+                           {}
+                         end
                        end
 
       self.headers_dict = request.env

data/lib/tcell_agent/utils/headers.rb

@@ -1,4 +1,3 @@
-
 module TCellAgent
   module Utils
     module Headers

data/lib/tcell_agent/utils/strings.rb

@@ -1,10 +1,10 @@
 module TCellAgent
   module Utils
     module Strings
-      BLANK_RE = /\A[[:space:]]*\z/
+      BLANK_RE = /\A[[:space:]]*\z/.freeze
 
       def self.blank?(str)
-        str.nil? || str.empty? || BLANK_RE === str # rubocop:disable Style/CaseEquality
+        str.nil? || str.empty? || BLANK_RE === str
       end
 
       def self.present?(str)

data/lib/tcell_agent/version.rb

@@ -1,5 +1,5 @@
 # See the file "LICENSE" for the full license governing this code.
 
 module TCellAgent
-  VERSION = '2.2.1'.freeze
+  VERSION = '2.5.0'.freeze
 end

data/spec/cruby_spec_helper.rb

@@ -0,0 +1,26 @@
+require 'tcell_agent'
+
+TCellAgent.configuration.enabled = true
+TCellAgent.configuration.instrument = true
+TCellAgent.configuration.enable_intercept_requests = true
+TCellAgent.configuration.disabled_instrumentation = []
+TCellAgent.thread_agent.instrument_built_ins
+
+# This monkey patch turns off blocking for LFI/CMDI when run in CRuby specs/
+# test suite. The original method also depends on a Rails installation,
+# which CRuby does not have installed.
+module TCellAgent
+  module Instrumentation
+    module Lfi
+      def self.block_file_access?(_path, _mode)
+        false
+      end
+    end
+  end
+
+  module Cmdi
+    def self.block_command?(_cmd)
+      false
+    end
+  end
+end