First release of open-appsec source code

components/generic_rulebase/evaluators/CMakeLists.txt

@@ -0,0 +1 @@
+add_library(generic_rulebase_evaluators asset_eval.cc parameter_eval.cc practice_eval.cc query_eval.cc trigger_eval.cc zone_eval.cc connection_eval.cc http_transaction_data_eval.cc)

components/generic_rulebase/evaluators/asset_eval.cc

@@ -0,0 +1,40 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/evaluators/asset_eval.h"
+
+#include <vector>
+#include <string>
+
+#include "generic_rulebase/assets_config.h"
+#include "config.h"
+#include "debug.h"
+
+using namespace std;
+
+string AssetMatcher::ctx_key = "asset_id";
+
+AssetMatcher::AssetMatcher(const vector<string> &params)
+{
+    if (params.size() != 1) reportWrongNumberOfParams(AssetMatcher::getName(), params.size(), 1, 1);
+    asset_id = params[0];
+}
+
+Maybe<bool, Context::Error>
+AssetMatcher::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<AssetMatcher>();
+    auto bc_asset_id_ctx = env->get<GenericConfigId>(AssetMatcher::ctx_key);
+
+    return bc_asset_id_ctx.ok() && *bc_asset_id_ctx == asset_id;
+}

components/generic_rulebase/evaluators/connection_eval.cc

@@ -0,0 +1,299 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/evaluators/connection_eval.h"
+
+#include <vector>
+#include <string>
+
+#include "generic_rulebase/rulebase_config.h"
+#include "config.h"
+#include "debug.h"
+#include "ip_utilities.h"
+
+using namespace std;
+USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
+
+string IpAddressMatcher::ctx_key = "ipAddress";
+string SourceIpMatcher::ctx_key = "sourceIP";
+string DestinationIpMatcher::ctx_key = "destinationIP";
+string SourcePortMatcher::ctx_key = "sourcePort";
+string ListeningPortMatcher::ctx_key = "listeningPort";
+string IpProtocolMatcher::ctx_key = "ipProtocol";
+string UrlMatcher::ctx_key = "url";
+
+Maybe<IPAddr>
+getIpAddrFromEnviroment(I_Environment *env, Context::MetaDataType enum_data_type, const string &str_data_type)
+{
+    auto ip_str = env->get<string>(enum_data_type);
+    if (!ip_str.ok()) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get " << str_data_type << " from the enviroment.";
+        return genError("Failed to get " + str_data_type + " from the enviroment.");
+    }
+    return IPAddr::createIPAddr(ip_str.unpack());
+}
+
+bool
+checkIfIpInRangesVec(const vector<CustomRange<IPAddr>> &values, const IPAddr &ip_to_check)
+{
+    if (values.size() == 0) {
+        dbgTrace(D_RULEBASE_CONFIG) << "Ip addersses vector empty. Match is true.";
+        return true;
+    }
+    for (const CustomRange<IPAddr> &range : values) {
+        if (range.contains(ip_to_check)) {
+            dbgTrace(D_RULEBASE_CONFIG) << "Ip adderss matched: " << ip_to_check;
+            return true;
+        }
+    }
+    dbgTrace(D_RULEBASE_CONFIG) << "Ip adderss not match: " << ip_to_check;
+    return false;
+}
+
+
+IpAddressMatcher::IpAddressMatcher(const vector<string> &params)
+{
+    for (const string &param : params) {
+        Maybe<CustomRange<IPAddr>> ip_range = CustomRange<IPAddr>::createRange(param);
+        if (!ip_range.ok()) {
+            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create ip. Error: " + ip_range.getErr();
+            continue;
+        }
+        values.push_back(ip_range.unpack());
+    }
+}
+
+Maybe<bool, Context::Error>
+IpAddressMatcher::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<IpAddressMatcher>();
+    Maybe<IPAddr> subject_ip = getIpAddrFromEnviroment(
+        env,
+        Context::MetaDataType::SubjectIpAddr,
+        "subject ip address"
+    );
+    if (subject_ip.ok() && checkIfIpInRangesVec(values, subject_ip.unpack())) return true;
+
+    Maybe<IPAddr> other_ip = getIpAddrFromEnviroment(
+        env,
+        Context::MetaDataType::OtherIpAddr,
+        "other ip address"
+    );
+    if (other_ip.ok() && checkIfIpInRangesVec(values, other_ip.unpack())) return true;
+    if (!subject_ip.ok() && !other_ip.ok()) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Error in getting subject ip and other ip from the enviroment";
+        return false;
+    }
+    dbgTrace(D_RULEBASE_CONFIG) << "Ip adderss didn't match";
+    return false;
+}
+
+SourceIpMatcher::SourceIpMatcher(const vector<string> &params)
+{
+    for (const string &param : params) {
+        Maybe<CustomRange<IPAddr>> ip_range = CustomRange<IPAddr>::createRange(param);
+        if (!ip_range.ok()) {
+            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create source ip. Error: " + ip_range.getErr();
+            continue;
+        }
+        values.push_back(ip_range.unpack());
+    }
+}
+
+Maybe<bool, Context::Error>
+SourceIpMatcher::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<SourceIpMatcher>();
+    auto direction_maybe = env->get<string>(Context::MetaDataType::Direction);
+    if (!direction_maybe.ok()) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get direction from the enviroment.";
+        return false;
+    }
+    string direction = direction_maybe.unpack();
+    if (direction == "incoming") {
+        Maybe<IPAddr> other_ip = getIpAddrFromEnviroment(
+            env,
+            Context::MetaDataType::OtherIpAddr,
+            "other ip address"
+        );
+        return other_ip.ok() && checkIfIpInRangesVec(values, other_ip.unpack());
+    } else if (direction == "outgoing") {
+        Maybe<IPAddr> subject_ip = getIpAddrFromEnviroment(
+            env,
+            Context::MetaDataType::SubjectIpAddr,
+            "subject ip address"
+        );
+        return subject_ip.ok() && checkIfIpInRangesVec(values, subject_ip.unpack());
+    }
+    dbgTrace(D_RULEBASE_CONFIG) << "Source ip adderss didn't match";
+    return false;
+}
+
+DestinationIpMatcher::DestinationIpMatcher(const vector<string> &params)
+{
+    for (const string &param : params) {
+        Maybe<CustomRange<IPAddr>> ip_range = CustomRange<IPAddr>::createRange(param);
+        if (!ip_range.ok()) {
+            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create destination ip. Error: " + ip_range.getErr();
+            continue;
+        }
+        values.push_back(ip_range.unpack());
+    }
+}
+
+Maybe<bool, Context::Error>
+DestinationIpMatcher::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<DestinationIpMatcher>();
+    auto direction_maybe = env->get<string>(Context::MetaDataType::Direction);
+    if (!direction_maybe.ok()) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get direction.";
+        return false;
+    }
+    string direction = direction_maybe.unpack();
+    if (direction == "outgoing") {
+        Maybe<IPAddr> other_ip = getIpAddrFromEnviroment(
+            env,
+            Context::MetaDataType::OtherIpAddr,
+            "other ip address"
+        );
+        return other_ip.ok() && checkIfIpInRangesVec(values, other_ip.unpack());
+    } else if (direction == "incoming") {
+        Maybe<IPAddr> subject_ip = getIpAddrFromEnviroment(
+            env,
+            Context::MetaDataType::SubjectIpAddr,
+            "subject ip address"
+        );
+        return subject_ip.ok() && checkIfIpInRangesVec(values, subject_ip.unpack());
+    }
+    dbgTrace(D_RULEBASE_CONFIG) << "Destination ip adderss didn't match";
+    return false;
+}
+
+SourcePortMatcher::SourcePortMatcher(const vector<string> &params)
+{
+    for (const string &param : params) {
+        Maybe<CustomRange<PortNumber>> port_range = CustomRange<PortNumber>::createRange(param);
+        if (!port_range.ok()) {
+            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create source port.";
+            continue;
+        }
+        values.push_back(port_range.unpack());
+    }
+}
+
+Maybe<bool, Context::Error>
+SourcePortMatcher::evalVariable() const
+{
+    dbgTrace(D_RULEBASE_CONFIG) << "Source is not a match";
+    return false;
+}
+
+
+ListeningPortMatcher::ListeningPortMatcher(const vector<string> &params)
+{
+    for (const string &param : params) {
+        Maybe<CustomRange<PortNumber>> port_range = CustomRange<PortNumber>::createRange(param);
+        if (!port_range.ok()) {
+            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create listening port range.";
+            continue;
+        }
+        values.push_back(port_range.unpack());
+    }
+}
+
+Maybe<bool, Context::Error>
+ListeningPortMatcher::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<ListeningPortMatcher>();
+    auto port_str = env->get<string>(Context::MetaDataType::Port);
+    if (!port_str.ok()) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get port from the enviroment.";
+        return false;
+    }
+    PortNumber port;
+    if (ConnKeyUtil::fromString(port_str.unpack(), port)) {
+        if (values.size() == 0) return true;
+        for (const CustomRange<PortNumber> &port_range : values) {
+            if (port_range.contains(port)) {
+                dbgTrace(D_RULEBASE_CONFIG) << "Listening port is a match. Value: " << port_str.unpack();
+                return true;
+            }
+        }
+    }
+    dbgTrace(D_RULEBASE_CONFIG) << "Listening port is not a match. Value: " << port_str.unpack();
+    return false;
+}
+
+IpProtocolMatcher::IpProtocolMatcher(const vector<string> &params)
+{
+    for (const string &param : params) {
+        Maybe<CustomRange<IPProto>> proto_range = CustomRange<IPProto>::createRange(param);
+        if (!proto_range.ok()) {
+            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create ip protocol.";
+            continue;
+        }
+        values.push_back(proto_range.unpack());
+    }
+}
+
+Maybe<bool, Context::Error>
+IpProtocolMatcher::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<IpProtocolMatcher>();
+    auto proto_str = env->get<string>(Context::MetaDataType::Protocol);
+    if (!proto_str.ok()) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get ip protocol from the enviroment.";
+        return false;
+    }
+    IPProto protocol;
+    if (ConnKeyUtil::fromString(proto_str.unpack(), protocol)) {
+        if (values.size() == 0) return true;
+        for (const CustomRange<IPProto> &proto_range : values) {
+            if (proto_range.contains(protocol)) {
+                dbgTrace(D_RULEBASE_CONFIG) << "Ip protocol is a match. Value: " << proto_str.unpack();
+                return true;
+            }
+        }
+    }
+    dbgTrace(D_RULEBASE_CONFIG) << "Source port is not a match. Value: " << proto_str.unpack();
+    return false;
+}
+
+UrlMatcher::UrlMatcher(const vector<string> &params) : values(params) {}
+
+Maybe<bool, Context::Error>
+UrlMatcher::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<UrlMatcher>();
+    auto curr_url_ctx = env->get<string>(Context::MetaDataType::Url);
+    if (!curr_url_ctx.ok()) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get URL from the enviroment.";
+        return false;
+    }
+    
+    if (values.size() == 0) {
+        dbgTrace(D_RULEBASE_CONFIG) << "Matched URL on \"any\". Url: " << *curr_url_ctx;
+        return true;
+    }
+
+    for (const string &url : values) {
+        if (*curr_url_ctx == url) {
+            dbgTrace(D_RULEBASE_CONFIG) << "Matched URL. Value: " << *curr_url_ctx;
+            return true;
+        }
+    }
+
+    dbgTrace(D_RULEBASE_CONFIG) << "URL is not a match. Value: " << *curr_url_ctx;
+    return false;
+}

components/generic_rulebase/evaluators/http_transaction_data_eval.cc

@@ -0,0 +1,125 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/evaluators/http_transaction_data_eval.h"
+
+#include <boost/lexical_cast.hpp>
+#include <algorithm>
+
+#include "http_transaction_data.h"
+#include "environment/evaluator_templates.h"
+#include "i_environment.h"
+#include "singleton.h"
+#include "sasal.h"
+
+SASAL_START // HTTP Manager - Transaction data
+
+using namespace std;
+using namespace EnvironmentHelper;
+
+EqualHost::EqualHost(const vector<string> &params)
+{
+    if (params.size() != 1) reportWrongNumberOfParams("EqualHost", params.size(), 1, 1);
+    host = params[0];
+}
+
+Maybe<bool, Context::Error>
+EqualHost::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<EqualHost>();
+    auto host_ctx = env->get<string>(HttpTransactionData::host_name_ctx);
+
+    if (!host_ctx.ok())
+    {
+        return false;
+    }
+
+    std::string lower_host_ctx = host_ctx.unpack();
+    std::transform(lower_host_ctx.begin(), lower_host_ctx.end(), lower_host_ctx.begin(), ::tolower);
+
+    std::string lower_host = host;
+    std::transform(lower_host.begin(), lower_host.end(), lower_host.begin(), ::tolower);
+
+
+    if (lower_host_ctx == lower_host) return true;
+    size_t pos = lower_host_ctx.find_last_of(':');
+    if (pos == string::npos) return false;
+    lower_host_ctx = string(lower_host_ctx.data(), pos);
+    return lower_host_ctx == lower_host;
+}
+
+EqualListeningIP::EqualListeningIP(const vector<string> &params)
+{
+    if (params.size() != 1) reportWrongNumberOfParams("EqualListeningIP", params.size(), 1, 1);
+
+    auto maybe_ip = IPAddr::createIPAddr(params[0]);
+    if (!maybe_ip.ok()) reportWrongParamType(getName(), params[0], "Not a valid IP Address");
+
+    listening_ip = maybe_ip.unpack();
+}
+
+Maybe<bool, Context::Error>
+EqualListeningIP::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<EqualListeningIP>();
+    auto listening_ip_ctx = env->get<IPAddr>(HttpTransactionData::listening_ip_ctx);
+    return listening_ip_ctx.ok() &&  listening_ip_ctx.unpack() == listening_ip;
+}
+
+EqualListeningPort::EqualListeningPort(const vector<string> &params)
+{
+    if (params.size() != 1) reportWrongNumberOfParams("EqualListeningPort", params.size(), 1, 1);
+
+    try {
+        listening_port = boost::lexical_cast<PortNumber>(params[0]);
+    } catch (boost::bad_lexical_cast const&) {
+        reportWrongParamType(getName(), params[0], "Not a valid port number");
+    }
+}
+
+Maybe<bool, Context::Error>
+EqualListeningPort::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<EqualListeningPort>();
+    auto port_ctx = env->get<PortNumber>(HttpTransactionData::listening_port_ctx);
+
+    return port_ctx.ok() && port_ctx.unpack() == listening_port;
+}
+
+BeginWithUri::BeginWithUri(const vector<string> &params)
+{
+    if (params.size() != 1) reportWrongNumberOfParams("BeginWithUri", params.size(), 1, 1);
+    uri_prefix = params[0];
+}
+
+Maybe<bool, Context::Error>
+BeginWithUri::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<BeginWithUri>();
+    auto uri_ctx = env->get<string>(HttpTransactionData::uri_ctx);
+
+    if (!uri_ctx.ok())
+    {
+        return false;
+    }
+
+    std::string lower_uri_ctx = uri_ctx.unpack();
+    std::transform(lower_uri_ctx.begin(), lower_uri_ctx.end(), lower_uri_ctx.begin(), ::tolower);
+
+    std::string lower_uri_prefix = uri_prefix;
+    std::transform(lower_uri_prefix.begin(), lower_uri_prefix.end(), lower_uri_prefix.begin(), ::tolower);
+
+    return lower_uri_ctx.find(lower_uri_prefix) == 0;
+}
+
+SASAL_END

components/generic_rulebase/evaluators/parameter_eval.cc

@@ -0,0 +1,38 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/evaluators/parameter_eval.h"
+
+#include <vector>
+#include <string>
+
+#include "generic_rulebase/rulebase_config.h"
+#include "config.h"
+#include "debug.h"
+
+using namespace std;
+
+string ParameterMatcher::ctx_key = "parameters";
+
+ParameterMatcher::ParameterMatcher(const vector<string> &params)
+{
+    if (params.size() != 1) reportWrongNumberOfParams(ParameterMatcher::getName(), params.size(), 1, 1);
+    parameter_id = params[0];
+}
+
+Maybe<bool, Context::Error>
+ParameterMatcher::evalVariable() const
+{
+    auto rule = getConfiguration<BasicRuleConfig>("rulebase", "rulesConfig");
+    return rule.ok() && rule.unpack().isParameterActive(parameter_id);
+}

components/generic_rulebase/evaluators/practice_eval.cc

@@ -0,0 +1,50 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/evaluators/practice_eval.h"
+
+#include <vector>
+#include <string>
+
+#include "generic_rulebase/rulebase_config.h"
+#include "config.h"
+#include "debug.h"
+
+USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
+
+using namespace std;
+
+string PracticeMatcher::ctx_key = "practices";
+
+PracticeMatcher::PracticeMatcher(const vector<string> &params)
+{
+    if (params.size() != 1) reportWrongNumberOfParams(PracticeMatcher::getName(), params.size(), 1, 1);
+    practice_id = params[0];
+}
+
+Maybe<bool, Context::Error>
+PracticeMatcher::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<PracticeMatcher>();
+    auto bc_practice_id_ctx = env->get<set<GenericConfigId>>(PracticeMatcher::ctx_key);
+    dbgTrace(D_RULEBASE_CONFIG)
+        << "Trying to match practice. ID: "
+        << practice_id << ", Current set IDs: "
+        << makeSeparatedStr(bc_practice_id_ctx.ok() ? *bc_practice_id_ctx : set<GenericConfigId>(), ", ");
+    if (bc_practice_id_ctx.ok()) {
+        return bc_practice_id_ctx.unpack().count(practice_id) > 0;
+    }
+
+    auto rule = getConfiguration<BasicRuleConfig>("rulebase", "rulesConfig");
+    return rule.ok() && rule.unpack().isPracticeActive(practice_id);
+}

components/generic_rulebase/evaluators/query_eval.cc

@@ -0,0 +1,136 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/evaluators/query_eval.h"
+
+#include <vector>
+#include <string>
+#include <map>
+
+#include "generic_rulebase/rulebase_config.h"
+#include "generic_rulebase/zones_config.h"
+#include "i_environment.h"
+#include "singleton.h"
+#include "config.h"
+#include "debug.h"
+#include "enum_range.h"
+
+using namespace std;
+
+USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
+
+QueryMatcher::QueryMatcher(const vector<string> &params)
+{
+    if (params.size() < 1) reportWrongNumberOfParams(QueryMatcher::getName(), params.size(), 1);
+
+    key = params.front();
+    if (key == "any") {
+        is_any = true;
+    } else {
+        values.reserve(params.size() - 1);
+        for (uint i = 1; i < params.size() ; i++) {
+            if (params[i] == "any") {
+                values.clear();
+                break;
+            }
+            values.insert(params[i]);
+        }
+    }
+}
+
+const string
+QueryMatcher::contextKeyToString(Context::MetaDataType type)
+{
+    if (type == Context::MetaDataType::SubjectIpAddr || type == Context::MetaDataType::OtherIpAddr) return "ip";
+    return Context::convertToString(type);
+}
+
+class QueryMatchSerializer
+{
+public:
+    static const string req_attr_ctx_key;
+
+    template <typename Archive>
+    void
+    serialize(Archive &ar)
+    {
+        I_Environment *env = Singleton::Consume<I_Environment>::by<QueryMatcher>();
+        auto req_attr = env->get<string>(req_attr_ctx_key);
+        if (!req_attr.ok()) return;
+
+        try {
+            ar(cereal::make_nvp(*req_attr, value));
+            dbgDebug(D_RULEBASE_CONFIG)
+                << "Found value for requested attribute. Tag: "
+                << *req_attr
+                << ", Value: "
+                << value;
+        } catch (exception &e) {
+            dbgDebug(D_RULEBASE_CONFIG) << "Could not find values for requested attribute. Tag: " << *req_attr;
+            ar.finishNode();
+        }
+    }
+
+    template <typename Values>
+    bool
+    matchValues(const Values &requested_vals) const
+    {
+        return value != "" && (requested_vals.empty() || requested_vals.count(value) > 0);
+    }
+
+private:
+    string value;
+};
+
+const string QueryMatchSerializer::req_attr_ctx_key = "requested attribute key";
+
+Maybe<bool, Context::Error>
+QueryMatcher::evalVariable() const
+{
+    if (is_any) return true;
+
+    I_Environment *env = Singleton::Consume<I_Environment>::by<QueryMatcher>();
+    auto local_asset_ctx = env->get<bool>("is local asset");
+    bool is_remote_asset = local_asset_ctx.ok() && !(*local_asset_ctx);
+
+    QueryRequest request;
+    for (Context::MetaDataType name : makeRange<Context::MetaDataType>()) {
+        auto val = env->get<string>(name);
+        if (val.ok()) {
+            if ((name == Context::MetaDataType::SubjectIpAddr && is_remote_asset) ||
+                (name == Context::MetaDataType::OtherIpAddr && !is_remote_asset)) {
+                continue;
+            }
+
+            request.addCondition(Condition::EQUALS, contextKeyToString(name), *val);
+        }
+    }
+    if (request.empty()) return false;
+
+    request.setRequestedAttr(key);
+    ScopedContext req_attr_key;
+    req_attr_key.registerValue<string>(QueryMatchSerializer::req_attr_ctx_key, key);
+
+    I_Intelligence_IS_V2 *intelligence = Singleton::Consume<I_Intelligence_IS_V2>::by<Zone>();
+    auto query_res = intelligence->queryIntelligence<QueryMatchSerializer>(request);
+    if (!query_res.ok()) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Failed to perform intelligence query. Error: " << query_res.getErr();
+        return false;
+    }
+
+    for (const AssetReply<QueryMatchSerializer> &asset : query_res.unpack()) {
+        if (asset.matchValues<unordered_set<string>>(values)) return true;
+    }
+
+    return false;
+}

components/generic_rulebase/evaluators/trigger_eval.cc

@@ -0,0 +1,57 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/evaluators/trigger_eval.h"
+
+#include <vector>
+#include <string>
+
+#include "generic_rulebase/rulebase_config.h"
+#include "config.h"
+#include "debug.h"
+
+using namespace std;
+
+USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
+
+string TriggerMatcher::ctx_key = "triggers";
+
+TriggerMatcher::TriggerMatcher(const vector<string> &params)
+{
+    if (params.size() != 1) reportWrongNumberOfParams(TriggerMatcher::getName(), params.size(), 1, 1);
+    trigger_id = params[0];
+}
+
+Maybe<bool, Context::Error>
+TriggerMatcher::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<TriggerMatcher>();
+    auto ac_bc_trigger_id_ctx = env->get<set<GenericConfigId>>("ac_trigger_id");
+    dbgTrace(D_RULEBASE_CONFIG)
+        << "Trying to match trigger for access control rule. ID: "
+        << trigger_id << ", Current set IDs: "
+        << makeSeparatedStr(ac_bc_trigger_id_ctx.ok() ? *ac_bc_trigger_id_ctx : set<GenericConfigId>(), ", ");
+    if (ac_bc_trigger_id_ctx.ok()) {
+        return ac_bc_trigger_id_ctx.unpack().count(trigger_id) > 0;
+    }
+
+    auto bc_trigger_id_ctx = env->get<set<GenericConfigId>>(TriggerMatcher::ctx_key);
+    dbgTrace(D_RULEBASE_CONFIG)
+        << "Trying to match trigger. ID: "
+        << trigger_id << ", Current set IDs: "
+        << makeSeparatedStr(bc_trigger_id_ctx.ok() ? *bc_trigger_id_ctx : set<GenericConfigId>(), ", ");
+    if (bc_trigger_id_ctx.ok() && bc_trigger_id_ctx.unpack().count(trigger_id) > 0 ) return true;
+
+    auto rule = getConfiguration<BasicRuleConfig>("rulebase", "rulesConfig");
+    return rule.ok() && rule.unpack().isTriggerActive(trigger_id);
+}

components/generic_rulebase/evaluators/zone_eval.cc

@@ -0,0 +1,44 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/evaluators/zone_eval.h"
+
+#include <vector>
+#include <string>
+
+#include "generic_rulebase/zone.h"
+#include "generic_rulebase/rulebase_config.h"
+#include "config.h"
+
+using namespace std;
+
+string ZoneMatcher::ctx_key = "zone_id";
+
+ZoneMatcher::ZoneMatcher(const vector<string> &params)
+{
+    if (params.size() != 1) reportWrongNumberOfParams(ZoneMatcher::getName(), params.size(), 1, 1);
+    zone_id = params[0];
+}
+
+Maybe<bool, Context::Error>
+ZoneMatcher::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<ZoneMatcher>();
+    auto bc_zone_id_ctx = env->get<GenericConfigId>(ZoneMatcher::ctx_key);
+    if (bc_zone_id_ctx.ok() && *bc_zone_id_ctx == zone_id) return true;
+
+    if (!getProfileAgentSettingWithDefault<bool>(false, "rulebase.enableQueryBasedMatch")) return false;
+
+    auto zone = getConfiguration<Zone>("rulebase", "zones");
+    return zone.ok() && zone.unpack().getId() == zone_id;
+}