tcell_agent 2.3.0 → 2.5.1

data/lib/tcell_agent/rust/native_agent.rb

@@ -9,55 +9,6 @@ require 'tcell_agent/utils/headers'
 module TCellAgent
   module Rust
     class NativeAgent # rubocop:disable Metrics/ClassLength
-      def self.test_event_sender(events)
-        config = TCellAgent.configuration
-        event_sender = {
-          :uuid =>            config.uuid,
-          :hostname =>        config.host_identifier,
-          :agent_type =>      'Ruby',
-          :agent_version =>   TCellAgent::VERSION,
-          :app_id =>          config.app_id,
-          :api_key =>         config.api_key,
-          :tcell_input_url => config.tcell_input_url,
-          :events =>          events
-        }
-        event_sender_pointer = FFI::MemoryPointer.from_string(
-          JSON.dump(event_sender)
-        )
-
-        buf = FFI::MemoryPointer.new(:uint8, 1024 * 8)
-        # config_pointer.size - 1: strips null terminator
-        result_size = TCellAgent::Rust::NativeLibrary.test_event_sender(
-          event_sender_pointer, event_sender_pointer.size - 1, buf, buf.size
-        )
-
-        response = NativeAgentResponse.new('test_event_sender', buf, result_size)
-
-        response.errors
-      end
-
-      def self.test_policies
-        config = TCellAgent.configuration
-        policies_info = {
-          :app_id =>        config.app_id,
-          :api_key =>       config.api_key,
-          :tcell_api_url => config.tcell_api_url
-        }
-        policies_info_pointer = FFI::MemoryPointer.from_string(
-          JSON.dump(policies_info)
-        )
-
-        buf = FFI::MemoryPointer.new(:uint8, 1024 * 8)
-        # config_pointer.size - 1: strips null terminator
-        result_size = TCellAgent::Rust::NativeLibrary.test_policies(
-          policies_info_pointer, policies_info_pointer.size - 1, buf, buf.size
-        )
-
-        response = NativeAgentResponse.new('test_event_sender', buf, result_size)
-
-        response.errors
-      end
-
       def self.test_agent(config)
         agent_config = TCellAgent::Rust::AgentConfig.new(config)
 
@@ -133,6 +84,7 @@ module TCellAgent
           :headers => header_params,
           :cookies => cookie_params,
           :path_params => path_params,
+          :reverse_proxy_header_value => appsensor_meta.reverse_proxy_header_value,
           :remote_address => appsensor_meta.remote_address,
           :full_uri => appsensor_meta.location,
           :session_id => appsensor_meta.session_id,
@@ -143,7 +95,6 @@ module TCellAgent
           :content_type => appsensor_meta.content_type,
           :request_body => appsensor_meta.raw_request_body
         }
-
         request_response_json[:sql_exceptions] = appsensor_meta.sql_exceptions if appsensor_meta.sql_exceptions
         request_response_json[:database_result_sizes] = appsensor_meta.database_result_sizes if appsensor_meta.database_result_sizes
 
@@ -184,13 +135,15 @@ module TCellAgent
           :method => appsensor_meta.method,
           :path => appsensor_meta.path,
           :remote_address => appsensor_meta.remote_address,
+          :reverse_proxy_header_value => appsensor_meta.reverse_proxy_header_value,
           :request_bytes_length => appsensor_meta.request_content_bytes_len,
           :query_params => query_params,
-          :post_params =>  post_params,
+          :post_params => post_params,
           :headers => header_params,
           :cookies => cookie_params,
           :content_type => appsensor_meta.content_type,
-          :full_uri => appsensor_meta.location
+          :full_uri => appsensor_meta.location,
+          :request_body => appsensor_meta.raw_request_body
         }
 
         patches_request_pointer = FFI::MemoryPointer.from_string(
@@ -213,6 +166,37 @@ module TCellAgent
         response.response
       end
 
+      def apply_suspicious_quick_check(appsensor_meta)
+        return {} unless appsensor_meta
+
+        sus_quick_check_request_json = {
+          :reverse_proxy_header_value => appsensor_meta.reverse_proxy_header_value,
+          :method => appsensor_meta.method,
+          :path => appsensor_meta.path,
+          :full_uri => appsensor_meta.location,
+          :request_bytes_length => appsensor_meta.request_content_bytes_len
+        }
+
+        if appsensor_meta.reverse_proxy_header_value.nil?
+          sus_quick_check_request_json.merge(
+            {
+              :client_ip_override => appsensor_meta.remote_address
+            }
+          )
+        end
+
+        sus_quick_check_request_ptr = FFI::MemoryPointer.from_string(
+          JSON.dump(sus_quick_check_request_json)
+        )
+
+        # sus_quick_check_request_ptr.size - 1: strips null terminator
+        TCellAgent::Rust::NativeLibrary.suspicious_quick_check_apply(
+          FFI::Pointer.new(@agent_ptr),
+          sus_quick_check_request_ptr,
+          sus_quick_check_request_ptr.size - 1
+        )
+      end
+
       def apply_cmdi(command, tcell_context)
         return unless TCellAgent::Utils::Strings.present?(command)
 
@@ -220,6 +204,7 @@ module TCellAgent
           :command => command,
           :method => tcell_context.request_method,
           :path => tcell_context.path,
+          :reverse_proxy_header_value => tcell_context.reverse_proxy_header_value,
           :remote_address => tcell_context.remote_address,
           :route_id => tcell_context.route_id,
           :session_id => tcell_context.session_id,
@@ -247,10 +232,11 @@ module TCellAgent
         response.response
       end
 
-      def get_headers(tcell_context)
+      def get_headers(content_type, tcell_context)
         return unless tcell_context
 
         headers_request = {
+          :content_type => content_type,
           :method => tcell_context.request_method,
           :path => tcell_context.path,
           :route_id => tcell_context.route_id.to_s,
@@ -288,8 +274,9 @@ module TCellAgent
           :status_code => status_code,
           :method => tcell_context.request_method,
           :path => tcell_context.path,
+          :reverse_proxy_header_value => tcell_context.reverse_proxy_header_value,
           :remote_addr => tcell_context.remote_address,
-          :full_uri => tcell_context.fullpath,
+          :full_uri => tcell_context.uri,
           :route_id => tcell_context.route_id,
           :session_id => tcell_context.session_id,
           :user_id => tcell_context.user_id
@@ -353,11 +340,12 @@ module TCellAgent
           :event_name => event_name,
           :user_id => user_id,
           :user_agent => tcell_context.user_agent,
+          :reverse_proxy_header_value => tcell_context.reverse_proxy_header_value,
           :remote_address => tcell_context.remote_address,
           :header_keys => header_keys,
-          :passsword => password,
+          :password => password,
           :session_id => tcell_context.session_id,
-          :full_uri => tcell_context.fullpath,
+          :full_uri => tcell_context.uri,
           :referrer => tcell_context.referrer,
           :user_valid => user_valid
         }
@@ -395,11 +383,14 @@ module TCellAgent
         if tcell_context
           file_access_info = file_access_info.merge(
             {
-              :full_uri => tcell_context.fullpath,
+              :full_uri => tcell_context.uri,
+              :reverse_proxy_header_value => tcell_context.reverse_proxy_header_value,
               :remote_address => tcell_context.remote_address,
               :route_id => tcell_context.route_id,
               :session_id => tcell_context.session_id,
-              :user_id => tcell_context.user_id
+              :user_id => tcell_context.user_id,
+              :method => tcell_context.request_method,
+              :request_path => tcell_context.path
             }
           )
         end
@@ -471,6 +462,7 @@ module TCellAgent
           :session_id => tcell_context && tcell_context.session_id,
           :user_id => tcell_context && tcell_context.user_id,
           :user_agent => tcell_context && tcell_context.user_agent,
+          :reverse_proxy_header_value => tcell_context.reverse_proxy_header_value,
           :remote_address => tcell_context && tcell_context.remote_address
         }
         message_pointer = FFI::MemoryPointer.from_string(
@@ -522,7 +514,7 @@ module TCellAgent
         end
       end
 
-      # Note: for tests
+      # NOTE: for tests
       def update_policies(policies)
         return {} unless TCellAgent::Utils::Strings.present?(policies)
 

data/lib/tcell_agent/rust/native_library.rb

@@ -6,22 +6,20 @@ module TCellAgent
       require 'ffi'
       extend FFI::Library
 
-      VERSION = '6.2.1'.freeze
-      prefix = 'lib'
       extension = '.so'
       variant = ''
       if /cygwin|mswin|mingw|bccwin|wince|emx/ =~ RUBY_PLATFORM
+        variant = '-x64'
         extension = '.dll'
-        prefix = ''
       elsif /darwin/ =~ RUBY_PLATFORM
         extension = '.dylib'
       elsif /musl/ =~ RUBY_PLATFORM
-        variant = 'alpine-'
+        variant = '-alpine'
       end
 
       begin
         ffi_lib File.join(File.dirname(__FILE__),
-                          "#{prefix}tcellagent-#{variant}#{VERSION}#{extension}")
+                          "libtcellagent#{variant}#{extension}")
 
         # All the rust library calls have the following response api:
         #
@@ -36,6 +34,7 @@ module TCellAgent
         attach_function :poll_new_policies, %i[pointer pointer size_t], :int
         attach_function :appfirewall_apply, %i[pointer pointer size_t pointer size_t], :int
         attach_function :patches_apply, %i[pointer pointer size_t pointer size_t], :int
+        attach_function :suspicious_quick_check_apply, %i[pointer pointer size_t], :int
         attach_function :cmdi_apply, %i[pointer pointer size_t pointer size_t], :int
         attach_function :get_headers, %i[pointer pointer size_t pointer size_t], :int
         attach_function :get_js_agent_script_tag, %i[pointer pointer size_t pointer size_t], :int
@@ -48,17 +47,15 @@ module TCellAgent
         attach_function :log_message, %i[pointer pointer size_t pointer size_t], :int
 
         attach_function :update_policies, %i[pointer pointer size_t pointer size_t], :int
-        attach_function :test_event_sender, %i[pointer size_t pointer size_t], :int
-        attach_function :test_policies, %i[pointer size_t pointer size_t], :int
         attach_function :test_agent, %i[pointer size_t pointer size_t], :int
 
         def self.common_lib_available?
           true
         end
-      rescue LoadError => load_error
+      rescue LoadError => e
         logger = TCellAgent::ModuleLogger.new(TCellAgent::RubyLogger.new, name)
-        logger.error("Failed loading agent library. #{load_error.message}")
-        logger.exception(load_error)
+        logger.error("Failed loading agent library. #{e.message}")
+        logger.exception(e)
 
         def self.common_lib_available? # rubocop:disable Lint/DuplicateMethods
           false

data/lib/tcell_agent/sensor_events/server_agent.rb

@@ -7,59 +7,6 @@ require 'etc'
 
 module TCellAgent
   module SensorEvents
-    class ServerAgentDetailsSensorEvent < TCellSensorEvent
-      include TCellAgent::ModuleLoggerAccess
-
-      def initialize
-        super('server_agent_details')
-        @flush = true
-        @ensure = true
-
-        self['user'] = 'unknown'
-        self['group'] = 'unknown'
-
-        begin
-          login = Etc.getlogin
-          if login
-            self['user'] = login
-            begin
-              info = Etc.getpwnam(login)
-              self['group'] = info.gid.to_s
-            rescue StandardError => te
-              module_logger.debug("Could not get group id: #{te.message}")
-              module_logger.exception(te)
-            end
-          end
-        rescue StandardError => to
-          module_logger.debug("Could not get user & group: #{to.message}")
-          module_logger.exception(te)
-        end
-
-        module_logger.debug("User #{self['user']}")
-        module_logger.debug("Group #{self['group']}")
-      end
-    end
-
-    class ServerAgentDetailsLanguageEvent < TCellSensorEvent
-      def initialize(language, language_version)
-        super('server_agent_details')
-        @flush = true
-        @ensure = true
-        self['language'] = language
-        self['language_version'] = language_version
-      end
-    end
-
-    class ServerAgentAppFrameworkEvent < TCellSensorEvent
-      def initialize(framework_name, framework_version)
-        super('server_agent_details')
-        @flush = true
-        @ensure = true
-        self['app_framework'] = framework_name
-        self['app_framework_version'] = framework_version
-      end
-    end
-
     class ServerAgentPackagesSensorEvent < TCellSensorEvent
       include TCellAgent::ModuleLoggerAccess
 
@@ -75,59 +22,15 @@ module TCellAgent
               packages.push(package)
               module_logger.debug("Adding packages #{x.name}")
             end
-          rescue StandardError => te
-            module_logger.error("Exception adding package: #{te.message}")
-            module_logger.exception(te)
+          rescue StandardError => e
+            module_logger.error("Exception adding package: #{e.message}")
+            module_logger.exception(e)
           end
         end
         self['packages'] = packages
       end
     end
 
-    class AppFramework < TCellSensorEvent
-      def initialize(name, version)
-        super('appserver_framework')
-        @flush = false
-        @ensure = true
-        self['n'] = name
-        self['v'] = version
-      end
-    end
-
-    class AppAuthFramework < TCellSensorEvent
-      def initialize(name, version)
-        super('appserver_auth_framework')
-        @flush = false
-        @ensure = true
-        self['n'] = name
-        self['v'] = version
-      end
-    end
-
-    class AppFrameworkSetting < TCellSensorEvent
-      def initialize(framework_name, setting, value)
-        super('appserver_framework_setting')
-        @flush = false
-        @ensure = true
-        self['framework'] = framework_name
-        self['s'] = setting
-        self['v'] = value
-      end
-    end
-
-    class AppCookie < TCellSensorEvent
-      def initialize(name, value, secure, http_only, session)
-        super('appserver_framework_setting')
-        @flush = false
-        @ensure = true
-        self['n'] = name
-        self['v'] = value
-        self['http_only'] = http_only
-        self['secure'] = secure
-        self['session'] = session
-      end
-    end
-
     class AppRoutesSensorEvent < TCellSensorEvent
       def initialize(uri, method, route_id, params = nil, destination = nil)
         super('appserver_routes')

data/lib/tcell_agent/sensor_events/util/sanitizer_utilities.rb

@@ -19,6 +19,7 @@ module TCellAgent
         params = CGI.parse(query)
         params.each do |param_name, param_values|
           next if param_values.nil? || param_values.empty?
+
           params[param_name] = ['']
         end
         params.map { |k, v| "#{k}=#{v.join(',')}" }.join('&')

data/lib/tcell_agent/servers/puma.rb

@@ -1,6 +1,6 @@
 if defined?(Puma.cli_config)
   if Puma.cli_config.options[:preload_app]
-    if Puma.cli_config.options[:workers] == 0 # rubocop:disable Style/NumericPredicate
+    if Puma.cli_config.options[:workers] == 0
       # Puma is running in single mode, so run both the initial instrumentation and
       # start the agent
       Puma::Runner.class_eval do
@@ -15,24 +15,41 @@ if defined?(Puma.cli_config)
     else
       Puma::Server.class_eval do
         alias_method :tcell_original_run, :run
-        def run(background = true)
-          TCellAgent.thread_agent.start('Puma Cluster Mode (Worker)')
 
-          tcell_original_run(background)
+        if defined?(Gem::Version) &&
+           defined?(Puma::Const::PUMA_VERSION) &&
+           (Gem::Version.new(Puma::Const::PUMA_VERSION) < Gem::Version.new('5.1.0'))
+          def run(background = true)
+            TCellAgent.thread_agent.start('Puma')
+            tcell_original_run(background)
+          end
+        else
+          def run(background = true, thread_name: 'server')
+            TCellAgent.thread_agent.start('Puma')
+            tcell_original_run(background, :thread_name => thread_name)
+          end
         end
       end
     end
-
   else
     # this ensures instrumentation runs for preload_app = false.
     # Instrumentation will run for each worker but there's
     # nothing we can do about that (Unicorn's preload_app behaves the same way)
     Puma::Server.class_eval do
       alias_method :tcell_original_run, :run
-      def run(background = true)
-        TCellAgent.thread_agent.start('Puma Cluster Mode (Worker)')
 
-        tcell_original_run(background)
+      if defined?(Gem::Version) &&
+         defined?(Puma::Const::PUMA_VERSION) &&
+         (Gem::Version.new(Puma::Const::PUMA_VERSION) < Gem::Version.new('5.1.0'))
+        def run(background = true)
+          TCellAgent.thread_agent.start('Puma')
+          tcell_original_run(background)
+        end
+      else
+        def run(background = true, thread_name: 'server')
+          TCellAgent.thread_agent.start('Puma')
+          tcell_original_run(background, :thread_name => thread_name)
+        end
       end
     end
   end

data/lib/tcell_agent/servers/rack_puma_handler.rb

@@ -9,10 +9,20 @@ Rack::Handler::Puma.class_eval do
       if defined?(Puma::Server) && !Puma::Server.instance_methods.include?(:tcell_original_run)
         Puma::Server.class_eval do
           alias_method :tcell_original_run, :run
-          def run(background = true)
-            TCellAgent.thread_agent.start('Puma')
 
-            tcell_original_run(background)
+          if defined?(Gem::Version) &&
+             defined?(Puma::Const::PUMA_VERSION) &&
+             (Gem::Version.new(Puma::Const::PUMA_VERSION) >= Gem::Version.new('5.1.0'))
+            def run(background = true, thread_name: 'server')
+              TCellAgent.thread_agent.start('Puma')
+              tcell_original_run(background, :thread_name => thread_name)
+            end
+          else
+            def run(background = true)
+              TCellAgent.thread_agent.start('Puma')
+
+              tcell_original_run(background)
+            end
           end
         end
       end

data/lib/tcell_agent/servers/webrick.rb

@@ -1,9 +1,19 @@
 Rack::Handler::WEBrick.class_eval do
   class << self
-    alias_method :original_run, :run
-    def run(app, options = {})
-      TCellAgent.thread_agent.start('WEBrick')
-      original_run(app, options)
+    alias_method :tcell_original_run, :run
+
+    if defined?(Gem::Version) &&
+       defined?(Rack.release) &&
+       Gem::Version.new(Rack.release) < Gem::Version.new('2.2.0')
+      def run(app, options = {})
+        TCellAgent.thread_agent.start('WEBrick')
+        tcell_original_run(app, options)
+      end
+    else
+      def run(app, **options)
+        TCellAgent.thread_agent.start('WEBrick')
+        tcell_original_run(app, **options)
+      end
     end
   end
 end

data/lib/tcell_agent/settings_reporter.rb

@@ -7,25 +7,11 @@ require 'thread'
 module TCellAgent
   def self.report_settings
     Thread.new do
-      TCellAgent::Instrumentation.safe_block('Instrumenting Agent Details') do
-        event = TCellAgent::SensorEvents::ServerAgentDetailsSensorEvent.new
-        TCellAgent.send_event(event)
-      end
-
       TCellAgent::Instrumentation.safe_block('Instrumenting Server Packages') do
         event = TCellAgent::SensorEvents::ServerAgentPackagesSensorEvent.new
         TCellAgent.send_event(event)
       end
 
-      TCellAgent::Instrumentation.safe_block('Instrumenting Language Info') do
-        TCellAgent.send_event(
-          TCellAgent::SensorEvents::ServerAgentDetailsLanguageEvent.new(
-            'Ruby',
-            RUBY_VERSION
-          )
-        )
-      end
-
       TCellAgent::Instrumentation.safe_block('Instrumenting Native Lib Status') do
         require 'tcell_agent/rust/native_agent'
 

data/lib/tcell_agent/sinatra.rb

@@ -16,6 +16,7 @@ module TCellAgent
       TCellAgent::Instrumentation.safe_block('Setting Headers') do
         headers_policy = TCellAgent.policy(TCellAgent::PolicyTypes::HEADERS)
         policy_headers = headers_policy.get_headers(
+          headers['Content-Type'],
           request.env[TCellAgent::Instrumentation::TCELL_ID]
         )
         policy_headers.each do |header_info|

data/lib/tcell_agent/tcell_context.rb

@@ -43,7 +43,8 @@ module TCellAgent
           tcell_context.session_id,
           tcell_context.user_id,
           tcell_context.transaction_id,
-          tcell_context.uri
+          tcell_context.uri,
+          tcell_context.reverse_proxy_header_value
         )
         meta_data.path = tcell_context.path
 
@@ -70,7 +71,8 @@ module TCellAgent
                   :response_headers,
                   :csrf_exception_name,
                   :sql_exceptions,
-                  :database_result_sizes
+                  :database_result_sizes,
+                  :reverse_proxy_header_value
 
     attr_reader :flattened_get_dict,
                 :flattened_cookie_dict,
@@ -85,7 +87,8 @@ module TCellAgent
                    session_id,
                    user_id,
                    transaction_id,
-                   location)
+                   location,
+                   reverse_proxy_header_value)
       @method = method
       @remote_address = remote_address
       @route_id = route_id
@@ -93,7 +96,7 @@ module TCellAgent
       @user_id = user_id
       @transaction_id = transaction_id
       @location = location
-      @path = path
+      @reverse_proxy_header_value = reverse_proxy_header_value
 
       @flattened_get_dict = {}
       @flattened_cookie_dict = {}
@@ -148,6 +151,7 @@ module TCellAgent
       if !content_length.nil? && content_length > TCELL_MAX_BODY_LENGTH || request.content_type.nil?
         return nil
       end
+
       raw_post_data = nil
       # Positions strio to the beginning of input, resetting lineno to zero.
       # rails 4.1 seems to read the stringIO directly and so body.gets is empty
@@ -171,10 +175,15 @@ module TCellAgent
       self.get_dict = request.GET
       self.cookie_dict = request.cookies
 
-      self.post_dict = if @content_type.start_with?('application/json', 'application/xml')
+      self.post_dict = if @content_type.start_with?('application/json', 'application/xml') ||
+                          (@content_type.start_with?('multipart/form-data') && @request_content_bytes_len == 0)
                          {}
                        else
-                         request.POST
+                         begin
+                           request.POST
+                         rescue EOFError
+                           {}
+                         end
                        end
 
       self.headers_dict = request.env

data/lib/tcell_agent/utils/headers.rb

@@ -1,4 +1,3 @@
-
 module TCellAgent
   module Utils
     module Headers

data/lib/tcell_agent/utils/strings.rb

@@ -1,10 +1,10 @@
 module TCellAgent
   module Utils
     module Strings
-      BLANK_RE = /\A[[:space:]]*\z/
+      BLANK_RE = /\A[[:space:]]*\z/.freeze
 
       def self.blank?(str)
-        str.nil? || str.empty? || BLANK_RE === str # rubocop:disable Style/CaseEquality
+        str.nil? || str.empty? || BLANK_RE === str
       end
 
       def self.present?(str)

data/lib/tcell_agent/version.rb

@@ -1,5 +1,5 @@
 # See the file "LICENSE" for the full license governing this code.
 
 module TCellAgent
-  VERSION = '2.3.0'.freeze
+  VERSION = '2.5.1'.freeze
 end

data/spec/cruby_spec_helper.rb

@@ -0,0 +1,26 @@
+require 'tcell_agent'
+
+TCellAgent.configuration.enabled = true
+TCellAgent.configuration.instrument = true
+TCellAgent.configuration.enable_intercept_requests = true
+TCellAgent.configuration.disabled_instrumentation = []
+TCellAgent.thread_agent.instrument_built_ins
+
+# This monkey patch turns off blocking for LFI/CMDI when run in CRuby specs/
+# test suite. The original method also depends on a Rails installation,
+# which CRuby does not have installed.
+module TCellAgent
+  module Instrumentation
+    module Lfi
+      def self.block_file_access?(_path, _mode)
+        false
+      end
+    end
+  end
+
+  module Cmdi
+    def self.block_command?(_cmd)
+      false
+    end
+  end
+end