First release of open-appsec source code

components/security_apps/waap/waap_clib/TrustedSources.h

@@ -0,0 +1,111 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#pragma once
+#include <vector>
+#include <map>
+#include <cereal/types/vector.hpp>
+#include <cereal/types/map.hpp>
+#include "debug.h"
+
+USE_DEBUG_FLAG(D_WAAP);
+
+// used to load trusted sources policy
+namespace Waap {
+    namespace TrustedSources {
+
+        enum TrustedSourceType {
+            UNKNOWN,
+            SOURCE_IP,
+            X_FORWARDED_FOR,
+            COOKIE_OAUTH2_PROXY,
+            SM_USER
+        };
+
+        class Identifer
+        {
+        public:
+            Identifer();
+
+            template <typename _A>
+            void serialize(_A& ar) {
+                std::string temp;
+                ar(cereal::make_nvp("sourceIdentifier", temp),
+                    cereal::make_nvp("value", value));
+                identitySource = convertSourceIdentifierToEnum(temp);
+                if (identitySource == UNKNOWN)
+                {
+                    dbgDebug(D_WAAP) << "loaded " << temp << " from policy is not a recognized source identifier";
+                }
+            }
+
+            static TrustedSourceType convertSourceIdentifierToEnum(std::string identifierType);
+
+            TrustedSourceType identitySource;
+            std::string value;
+        };
+
+        class SourcesIdentifers
+        {
+        public:
+            template <typename _A>
+            void serialize(_A& ar) {
+                std::vector<Identifer> identifiers;
+                ar(cereal::make_nvp("sourcesIdentifiers", identifiers),
+                    cereal::make_nvp("numOfSources", m_minSources));
+                for (auto identifier : identifiers)
+                {
+                    if (identifier.identitySource != UNKNOWN)
+                    {
+                        m_identifiersMap[identifier.identitySource].push_back(identifier.value);
+                        m_trustedTypes.insert(identifier.identitySource);
+                    }
+                }
+            }
+
+            bool isCidrMatch(const std::string &source, const TrustedSourceType &type) const;
+            bool isRegexMatch(const std::string &source, const TrustedSourceType& type) const;
+            size_t getNumOfSources() const;
+            const std::set<TrustedSourceType>& getTrustedTypes();
+
+            inline bool operator!=(const SourcesIdentifers& other) const;
+        private:
+            std::map<TrustedSourceType, std::vector<std::string>> m_identifiersMap;
+            std::set<TrustedSourceType> m_trustedTypes;
+            size_t m_minSources;
+        };
+
+        class TrustedSourcesParameter
+        {
+        public:
+            template <typename _A>
+            TrustedSourcesParameter(_A& ar) {
+                ar(cereal::make_nvp("trustedSources", m_identifiers));
+            }
+
+            TrustedSourcesParameter();
+
+            template <class Archive>
+            void serialize(Archive& ar) {
+                ar(cereal::make_nvp("trustedSources", m_identifiers));
+            }
+            bool isSourceTrusted(std::string source, TrustedSourceType srcType);
+            size_t getNumOfSources();
+            std::set<TrustedSourceType> getTrustedTypes();
+            bool operator==(const TrustedSourcesParameter &other) const;
+            bool operator!=(const TrustedSourcesParameter& other) const;
+        private:
+            std::vector<SourcesIdentifers> m_identifiers;
+        };
+    }
+}