From 03949a3cb7ec1e785c77bd7c23ce655b3289f293 Mon Sep 17 00:00:00 2001
From: davidga <davidga@checkpoint.com>
Date: Wed, 16 Nov 2022 10:34:13 +0200
Subject: [PATCH] update checkpoint to openappsec

---
 .../include/appsec_practice_section.h               | 13 ++++++++++---
 .../local_policy_mgmt_gen/local_policy_mgmt_gen.cc  |  4 ++--
 .../orchestration/package/local-default-policy.yaml |  9 +--------
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/components/security_apps/orchestration/local_policy_mgmt_gen/include/appsec_practice_section.h b/components/security_apps/orchestration/local_policy_mgmt_gen/include/appsec_practice_section.h
index cc0dfe2..39a429b 100644
--- a/components/security_apps/orchestration/local_policy_mgmt_gen/include/appsec_practice_section.h
+++ b/components/security_apps/orchestration/local_policy_mgmt_gen/include/appsec_practice_section.h
@@ -14,7 +14,10 @@
 #ifndef __APPSEC_PRACTICE_SECTION_H__
 #define __APPSEC_PRACTICE_SECTION_H__
 
+#include <list>
+
 #include <cereal/archives/json.hpp>
+#include <cereal/types/list.hpp>
 #include <boost/uuid/uuid.hpp>
 #include <boost/uuid/uuid_generators.hpp>
 #include <boost/uuid/uuid_io.hpp>
@@ -697,6 +700,8 @@ public:
 
     const std::string & getMode() const { return mode; }
 
+    void setHost(const std::string &_host) { host = _host; };
+
     void setMode(const std::string &_mode) { mode = _mode; };
 
     const std::string & getCustomResponse() const { return custom_response; }
@@ -749,16 +754,18 @@ public:
         if (default_mode_annot.ok() && !default_mode_annot.unpack().empty() && default_rule.getMode().empty()) {
             default_rule.setMode(default_mode_annot.unpack());
         }
-        parseAppsecJSONKey<std::vector<ParsedRule>>("specific-rules", specific_rules, archive_in);
+        default_rule.setHost("*");
+        parseAppsecJSONKey<std::list<ParsedRule>>("specific-rules", specific_rules, archive_in);
+        specific_rules.push_front(default_rule);
     }
 
     const ParsedRule & getDefaultRule() const { return default_rule; }
 
-    const std::vector<ParsedRule> & getSpecificRules() const { return specific_rules; }
+    const std::list<ParsedRule> & getSpecificRules() const { return specific_rules; }
 
 private:
     ParsedRule default_rule;
-    std::vector<ParsedRule> specific_rules;
+    std::list<ParsedRule> specific_rules;
 };
 
 class AppsecLinuxPolicy : Singleton::Consume<I_Environment>
diff --git a/components/security_apps/orchestration/local_policy_mgmt_gen/local_policy_mgmt_gen.cc b/components/security_apps/orchestration/local_policy_mgmt_gen/local_policy_mgmt_gen.cc
index 94f1288..fef5779 100644
--- a/components/security_apps/orchestration/local_policy_mgmt_gen/local_policy_mgmt_gen.cc
+++ b/components/security_apps/orchestration/local_policy_mgmt_gen/local_policy_mgmt_gen.cc
@@ -289,7 +289,7 @@ public:
             return appsec_policy;
         });
 
-        vector<ParsedRule> specific_rules = appsec_policy.getAppsecPolicySpec().getSpecificRules();
+        list<ParsedRule> specific_rules = appsec_policy.getAppsecPolicySpec().getSpecificRules();
         ParsedRule default_rule = appsec_policy.getAppsecPolicySpec().getDefaultRule();
 
         string asset;
@@ -672,7 +672,7 @@ public:
             AppsecSpecParser<AppsecPolicySpec> appsec_policy = maybe_appsec_policy.unpack();
             dbgTrace(D_K8S_POLICY) << "Succeessfully retrieved AppSec policy: " << appsec_policy.getSpec();
 
-            vector<ParsedRule> specific_rules = appsec_policy.getSpec().getSpecificRules();
+            list<ParsedRule> specific_rules = appsec_policy.getSpec().getSpecificRules();
             ParsedRule default_rule = appsec_policy.getSpec().getDefaultRule();
 
             for (const ParsedRule &parsed_rule : specific_rules) {
diff --git a/nodes/orchestration/package/local-default-policy.yaml b/nodes/orchestration/package/local-default-policy.yaml
index 1720ff0..e9845f6 100644
--- a/nodes/orchestration/package/local-default-policy.yaml
+++ b/nodes/orchestration/package/local-default-policy.yaml
@@ -7,13 +7,6 @@ policies:
     - webapp-default-practice
     custom-response: appsec-default-web-user-response
   specific-rules:
-  - host: "*"
-    triggers:
-    - appsec-default-log-trigger
-    mode: detect-learn
-    practices:
-    - webapp-default-practice
-    custom-response: appsec-default-web-user-response
 
 practices:
   - name: webapp-default-practice
@@ -62,7 +55,7 @@ logtriggers:
       cloud: false
       file:
       stdout:
-        format: json-formatted
+        format: json
       syslog-service:
       cef-service: