First release of open-appsec source code

components/security_apps/waap/waap_clib/UserLimitsPolicy.h

@@ -0,0 +1,183 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#pragma once
+#include "debug.h"
+#include <cereal/types/string.hpp>
+#include <string>
+#include <sstream>
+#include <iostream>
+
+USE_DEBUG_FLAG(D_WAAP_ULIMITS);
+
+namespace Waap {
+namespace UserLimits {
+
+typedef unsigned long long ull;
+#define DEFAULT_URL_MAX_SIZE 32*1024
+#define DEFAULT_HEADER_MAX_SIZE 100*1024
+#define DEFAULT_BODY_MAX_SIZE_KB 1000000
+#define DEFAULT_BODY_MAX_SIZE 1000000*1024
+#define DEFAULT_OBJECT_MAX_DEPTH 40
+
+// @file Feature behaviour description:
+// Phase 1:
+// 1. No enforcement. No logs to mgmt.
+// 2. Only logs to automation and dev Kibana.
+// 3. Logs should represent the state as if the limits are enforced as described in phase 2.
+// Phase 2:
+// 1. DISABLE mode: no enforcement and no logs.
+// 2. LEARNING mode: requests that violated a limit will be accepted, and won't be scanned any further.
+//    Illegal methods won't be automatically accepted, and will be further scanned.
+// 3. PREVENT mode: requests that violated a limit will be dropped, and won't be scanned any further.
+class Policy {
+    struct Config {
+        Config() :
+        urlMaxSize(DEFAULT_URL_MAX_SIZE),
+        httpHeaderMaxSize(DEFAULT_HEADER_MAX_SIZE),
+        httpBodyMaxSizeKb(DEFAULT_BODY_MAX_SIZE_KB),
+        httpBodyMaxSize(DEFAULT_BODY_MAX_SIZE),
+        maxObjectDepth(DEFAULT_OBJECT_MAX_DEPTH),
+        httpIllegalMethodsAllowed(false) {}
+        ~Config() {}
+
+        template <typename _A>
+        void serialize(_A& ar) {
+            ar(cereal::make_nvp("urlMaxSize", urlMaxSize));
+            ar(cereal::make_nvp("httpHeaderMaxSize", httpHeaderMaxSize));
+            httpBodyMaxSizeKb = 0;
+            ar(cereal::make_nvp("httpRequestBodyMaxSize", httpBodyMaxSizeKb));
+            // Kilobytes to bytes conversion
+            httpBodyMaxSize = httpBodyMaxSizeKb * 1024;
+            ar(cereal::make_nvp("jsonMaxObjectDepth", maxObjectDepth));
+            int intToBool = 0;
+            ar(cereal::make_nvp("httpIllegalMethodsAllowed", intToBool));
+            httpIllegalMethodsAllowed = (intToBool == 1);
+        }
+
+        bool operator==(const Policy::Config& other) const;
+
+        size_t urlMaxSize;  // URL max size in bytes
+        size_t httpHeaderMaxSize;  // Header Size in Bytes
+        size_t httpBodyMaxSizeKb;  // Body Size in Kilobytes
+        ull httpBodyMaxSize;  // Body Size in Bytes
+        size_t maxObjectDepth;  // Can range from 0 to 1024
+        // List of legal methods can be viewed in isLegalHttpMethod function
+        bool httpIllegalMethodsAllowed;
+    };
+public:
+    template <typename _A>
+    explicit Policy(_A& ar)
+    {
+        ar(cereal::make_nvp("practiceAdvancedConfig", m_config));
+    }
+    Policy() : m_config() {}
+    ~Policy() {}
+
+    bool operator==(const Policy& other) const;
+    size_t getUrlMaxSize() const { return m_config.urlMaxSize; }
+    size_t getMaxObjectDepth() const { return m_config.maxObjectDepth; }
+    size_t getHttpHeaderMaxSize() const { return m_config.httpHeaderMaxSize; }
+    size_t getHttpBodyMaxSizeKb() const { return m_config.httpBodyMaxSizeKb; }
+    ull getHttpBodyMaxSize() const { return m_config.httpBodyMaxSize; }
+    bool isHttpIllegalMethodAllowed() const { return m_config.httpIllegalMethodsAllowed; }
+    const Config& getConfig() const { return m_config; }
+
+private:
+    Config m_config;
+
+    friend std::ostream& operator<<(std::ostream& os, const Policy& policy);
+};
+
+struct ViolatedStrData
+{
+    std::string type;
+    std::string policy;
+    std::string assetId;
+};
+
+class State {
+public:
+    enum class StateType
+    {
+        NO_STATE,
+        URL,
+        METHOD,
+        HEADER,
+        BODY,
+        DEPTH
+    };
+
+    enum class ViolationType
+    {
+        NO_LIMIT,
+        ILLEGAL_METHOD,
+        URL_LIMIT,
+        URL_OVERFLOW,
+        HEADER_LIMIT,
+        HEADER_OVERFLOW,
+        BODY_LIMIT,
+        BODY_OVERFLOW,
+        OBJECT_DEPTH_LIMIT
+    };
+public:
+    explicit State(const Policy& policy) :
+        m_policy(policy),
+        m_urlSize(0),
+        m_httpHeaderSize(0),
+        m_httpBodySize(0),
+        m_objectDepth(0),
+        m_currState(StateType::NO_STATE),
+        m_type(ViolationType::NO_LIMIT),
+        m_strData()
+        {
+            m_strData.type = "no violation";
+        }
+    ~State() {}
+
+    void setAssetId(const std::string& assetId) { m_strData.assetId = assetId; }
+    // @return true if limit is reached or overflows
+    bool addUrlBytes(size_t size);
+    bool addHeaderBytes(const std::string& name, const std::string& value);
+    bool addBodyBytes(size_t chunkSize);
+    // @return true if limit is reached
+    bool setObjectDepth(size_t depth);
+    bool isValidHttpMethod(const std::string& method);
+    bool isLimitReached() const;
+    bool isIllegalMethodViolation() const;
+    const std::string getViolatedTypeStr() const { return m_strData.type; }
+    const ViolatedStrData& getViolatedStrData() const { return m_strData; }
+    size_t getViolatingSize() const;
+
+private:
+    bool isLegalHttpMethod(const std::string& method) const;
+    void setCurrStateType(StateType type) { m_currState = type; }
+    StateType getCurrStateType() { return m_currState; }
+    void setViolationType(ViolationType type);
+    void setViolatedTypeStr();
+    void setViolatedPolicyStr();
+    const std::string& getAssetId() const { return m_strData.assetId; }
+
+private:
+    const Policy& m_policy;
+    size_t m_urlSize;
+    size_t m_httpHeaderSize;
+    ull m_httpBodySize;
+    size_t m_objectDepth;
+    StateType m_currState;  // State that is currently being enforced
+    ViolationType m_type;  // Type of violation reached
+    ViolatedStrData m_strData;  // Holds the string info of the violated data
+};
+
+}
+}