Appsec hooks fixes (#2769)

This commit is contained in:
blotus 2024-01-22 13:33:20 +01:00 committed by GitHub
parent dc698ecea8
commit 84606eb207
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 53 additions and 22 deletions

View file

@ -130,9 +130,9 @@ type AppsecConfig struct {
} }
func (w *AppsecRuntimeConfig) ClearResponse() { func (w *AppsecRuntimeConfig) ClearResponse() {
log.Debugf("#-> %p", w) w.Logger.Debugf("#-> %p", w)
w.Response = AppsecTempResponse{} w.Response = AppsecTempResponse{}
log.Debugf("-> %p", w.Config) w.Logger.Debugf("-> %p", w.Config)
w.Response.Action = w.Config.DefaultPassAction w.Response.Action = w.Config.DefaultPassAction
w.Response.HTTPResponseCode = w.Config.PassedHTTPCode w.Response.HTTPResponseCode = w.Config.PassedHTTPCode
w.Response.SendEvent = true w.Response.SendEvent = true
@ -290,20 +290,26 @@ func (w *AppsecRuntimeConfig) ProcessOnLoadRules() error {
switch t := output.(type) { switch t := output.(type) {
case bool: case bool:
if !t { if !t {
log.Debugf("filter didnt match") w.Logger.Debugf("filter didnt match")
continue continue
} }
default: default:
log.Errorf("Filter must return a boolean, can't filter") w.Logger.Errorf("Filter must return a boolean, can't filter")
continue continue
} }
} }
for _, applyExpr := range rule.ApplyExpr { for _, applyExpr := range rule.ApplyExpr {
_, err := exprhelpers.Run(applyExpr, GetOnLoadEnv(w), w.Logger, w.Logger.Level >= log.DebugLevel) o, err := exprhelpers.Run(applyExpr, GetOnLoadEnv(w), w.Logger, w.Logger.Level >= log.DebugLevel)
if err != nil { if err != nil {
log.Errorf("unable to apply appsec on_load expr: %s", err) w.Logger.Errorf("unable to apply appsec on_load expr: %s", err)
continue continue
} }
switch t := o.(type) {
case error:
w.Logger.Errorf("unable to apply appsec on_load expr: %s", t)
continue
default:
}
} }
} }
return nil return nil
@ -320,27 +326,33 @@ func (w *AppsecRuntimeConfig) ProcessOnMatchRules(request *ParsedRequest, evt ty
switch t := output.(type) { switch t := output.(type) {
case bool: case bool:
if !t { if !t {
log.Debugf("filter didnt match") w.Logger.Debugf("filter didnt match")
continue continue
} }
default: default:
log.Errorf("Filter must return a boolean, can't filter") w.Logger.Errorf("Filter must return a boolean, can't filter")
continue continue
} }
} }
for _, applyExpr := range rule.ApplyExpr { for _, applyExpr := range rule.ApplyExpr {
_, err := exprhelpers.Run(applyExpr, GetOnMatchEnv(w, request, evt), w.Logger, w.Logger.Level >= log.DebugLevel) o, err := exprhelpers.Run(applyExpr, GetOnMatchEnv(w, request, evt), w.Logger, w.Logger.Level >= log.DebugLevel)
if err != nil { if err != nil {
log.Errorf("unable to apply appsec on_match expr: %s", err) w.Logger.Errorf("unable to apply appsec on_match expr: %s", err)
continue continue
} }
switch t := o.(type) {
case error:
w.Logger.Errorf("unable to apply appsec on_match expr: %s", t)
continue
default:
}
} }
} }
return nil return nil
} }
func (w *AppsecRuntimeConfig) ProcessPreEvalRules(request *ParsedRequest) error { func (w *AppsecRuntimeConfig) ProcessPreEvalRules(request *ParsedRequest) error {
log.Debugf("processing %d pre_eval rules", len(w.CompiledPreEval)) w.Logger.Debugf("processing %d pre_eval rules", len(w.CompiledPreEval))
for _, rule := range w.CompiledPreEval { for _, rule := range w.CompiledPreEval {
if rule.FilterExpr != nil { if rule.FilterExpr != nil {
output, err := exprhelpers.Run(rule.FilterExpr, GetPreEvalEnv(w, request), w.Logger, w.Logger.Level >= log.DebugLevel) output, err := exprhelpers.Run(rule.FilterExpr, GetPreEvalEnv(w, request), w.Logger, w.Logger.Level >= log.DebugLevel)
@ -350,21 +362,27 @@ func (w *AppsecRuntimeConfig) ProcessPreEvalRules(request *ParsedRequest) error
switch t := output.(type) { switch t := output.(type) {
case bool: case bool:
if !t { if !t {
log.Debugf("filter didnt match") w.Logger.Debugf("filter didnt match")
continue continue
} }
default: default:
log.Errorf("Filter must return a boolean, can't filter") w.Logger.Errorf("Filter must return a boolean, can't filter")
continue continue
} }
} }
// here means there is no filter or the filter matched // here means there is no filter or the filter matched
for _, applyExpr := range rule.ApplyExpr { for _, applyExpr := range rule.ApplyExpr {
_, err := exprhelpers.Run(applyExpr, GetPreEvalEnv(w, request), w.Logger, w.Logger.Level >= log.DebugLevel) o, err := exprhelpers.Run(applyExpr, GetPreEvalEnv(w, request), w.Logger, w.Logger.Level >= log.DebugLevel)
if err != nil { if err != nil {
log.Errorf("unable to apply appsec pre_eval expr: %s", err) w.Logger.Errorf("unable to apply appsec pre_eval expr: %s", err)
continue continue
} }
switch t := o.(type) {
case error:
w.Logger.Errorf("unable to apply appsec pre_eval expr: %s", t)
continue
default:
}
} }
} }
@ -381,21 +399,29 @@ func (w *AppsecRuntimeConfig) ProcessPostEvalRules(request *ParsedRequest) error
switch t := output.(type) { switch t := output.(type) {
case bool: case bool:
if !t { if !t {
log.Debugf("filter didnt match") w.Logger.Debugf("filter didnt match")
continue continue
} }
default: default:
log.Errorf("Filter must return a boolean, can't filter") w.Logger.Errorf("Filter must return a boolean, can't filter")
continue continue
} }
} }
// here means there is no filter or the filter matched // here means there is no filter or the filter matched
for _, applyExpr := range rule.ApplyExpr { for _, applyExpr := range rule.ApplyExpr {
_, err := exprhelpers.Run(applyExpr, GetPostEvalEnv(w, request), w.Logger, w.Logger.Level >= log.DebugLevel) o, err := exprhelpers.Run(applyExpr, GetPostEvalEnv(w, request), w.Logger, w.Logger.Level >= log.DebugLevel)
if err != nil { if err != nil {
log.Errorf("unable to apply appsec post_eval expr: %s", err) w.Logger.Errorf("unable to apply appsec post_eval expr: %s", err)
continue continue
} }
switch t := o.(type) {
case error:
w.Logger.Errorf("unable to apply appsec post_eval expr: %s", t)
continue
default:
}
} }
} }

View file

@ -38,7 +38,7 @@ type ParsedRequest struct {
Body []byte `json:"body,omitempty"` Body []byte `json:"body,omitempty"`
TransferEncoding []string `json:"transfer_encoding,omitempty"` TransferEncoding []string `json:"transfer_encoding,omitempty"`
UUID string `json:"uuid,omitempty"` UUID string `json:"uuid,omitempty"`
Tx ExtendedTransaction `json:"transaction,omitempty"` Tx ExtendedTransaction `json:"-"`
ResponseChannel chan AppsecTempResponse `json:"-"` ResponseChannel chan AppsecTempResponse `json:"-"`
IsInBand bool `json:"-"` IsInBand bool `json:"-"`
IsOutBand bool `json:"-"` IsOutBand bool `json:"-"`
@ -260,12 +260,17 @@ func (r *ReqDumpFilter) ToJSON() error {
req := r.GetFilteredRequest() req := r.GetFilteredRequest()
log.Warningf("dumping : %+v", req) log.Tracef("dumping : %+v", req)
if err := enc.Encode(req); err != nil { if err := enc.Encode(req); err != nil {
//Don't clobber the temp directory with empty files
err2 := os.Remove(fd.Name())
if err2 != nil {
log.Errorf("while removing temp file %s: %s", fd.Name(), err)
}
return fmt.Errorf("while encoding request: %w", err) return fmt.Errorf("while encoding request: %w", err)
} }
log.Warningf("request dumped to %s", fd.Name()) log.Infof("request dumped to %s", fd.Name())
return nil return nil
} }