Mar 21st 2024 update

components/utils/generic_rulebase/CMakeLists.txt

@@ -0,0 +1,4 @@
+add_definitions(-DUSERSPACE)
+
+add_subdirectory(evaluators)
+add_library(generic_rulebase generic_rulebase.cc rulebase_config.cc triggers_config.cc parameters_config.cc generic_rulebase_context.cc zones_config.cc zone.cc assets_config.cc match_query.cc)

components/utils/generic_rulebase/assets_config.cc

@@ -0,0 +1,137 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/assets_config.h"
+
+#include <string>
+#include <algorithm>
+#include <unordered_map>
+
+#include "generic_rulebase/generic_rulebase_utils.h"
+#include "config.h"
+#include "debug.h"
+#include "ip_utilities.h"
+
+USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
+
+using namespace std;
+
+void
+RuleAsset::load(cereal::JSONInputArchive &archive_in)
+{
+    archive_in(cereal::make_nvp("assetId", asset_id));
+    archive_in(cereal::make_nvp("assetName", asset_name));
+    archive_in(cereal::make_nvp("assetUrls", asset_urls));
+
+    dbgWarning(D_RULEBASE_CONFIG) << "Adding asset with UID: " << asset_id;
+}
+
+void
+RuleAsset::AssetUrl::load(cereal::JSONInputArchive &archive_in)
+{
+    archive_in(cereal::make_nvp("protocol", protocol));
+    transform(protocol.begin(), protocol.end(), protocol.begin(), [](unsigned char c) { return tolower(c); });
+
+    archive_in(cereal::make_nvp("ip", ip));
+    archive_in(cereal::make_nvp("port", port));
+
+    int value;
+    if (protocol == "*") {
+        is_any_proto = true;
+    } else {
+        is_any_proto = false;
+        try {
+            value = 0;
+            if(protocol == "udp") value = IPPROTO_UDP;
+            if(protocol == "tcp") value = IPPROTO_TCP;
+            if(protocol == "dccp") value = IPPROTO_DCCP;
+            if(protocol == "sctp") value = IPPROTO_SCTP;
+            if(protocol == "icmp") value = IPPROTO_ICMP;
+            if(protocol == "icmpv6") value = IPPROTO_ICMP;
+
+            if (value > static_cast<int>(UINT8_MAX) || value < 0) {
+                dbgWarning(D_RULEBASE_CONFIG)
+                    << "provided value is not a legal IP protocol number. Value: "
+                    << protocol;
+            } else {
+                parsed_proto = value;
+            }
+        } catch (...) {
+            dbgWarning(D_RULEBASE_CONFIG) << "provided value is not a legal IP protocol. Value: " << protocol;
+        }
+    }
+
+    if (port == "*") {
+        is_any_port = true;
+    } else {
+        is_any_port = false;
+        try {
+            value = stoi(port);
+            if (value > static_cast<int>(UINT16_MAX) || value < 0) {
+                dbgWarning(D_RULEBASE_CONFIG) << "provided value is not a legal port number. Value: " << port;
+            } else {
+                parsed_port = value;
+            }
+        } catch (...) {
+            dbgWarning(D_RULEBASE_CONFIG) << "provided value is not a legal port. Value: " << port;
+        }
+    }
+
+    if (ip == "*") {
+        is_any_ip = true;
+    } else {
+        is_any_ip = false;
+        auto ip_addr = IPAddr::createIPAddr(ip);
+        if (!ip_addr.ok()) {
+            dbgWarning(D_RULEBASE_CONFIG) << "Could not create IP address. Error: " << ip_addr.getErr();
+        } else {
+            parsed_ip = ConvertToIpAddress(ip_addr.unpackMove());
+        }
+    }
+}
+
+IpAddress
+RuleAsset::AssetUrl::ConvertToIpAddress(const IPAddr &addr)
+{
+    IpAddress address;
+    switch (addr.getType()) {
+        case IPType::UNINITIALIZED: {
+            address.addr4_t = {0};
+            address.ip_type = IP_VERSION_ANY;
+            break;
+        }
+        case IPType::V4: {
+            address.addr4_t = addr.getIPv4();
+            address.ip_type = IP_VERSION_4;
+            break;
+        }
+        case IPType::V6: {
+            address.addr6_t = addr.getIPv6();
+            address.ip_type = IP_VERSION_6;
+            break;
+        }
+        default:
+            address.addr4_t = {0};
+            address.ip_type = IP_VERSION_ANY;
+            dbgWarning(D_RULEBASE_CONFIG) << "Unsupported IP type: " << static_cast<int>(addr.getType());
+    }
+    return address;
+}
+
+const Assets Assets::empty_assets_config = Assets();
+
+void
+Assets::preload()
+{
+    registerExpectedSetting<Assets>("rulebase", "usedAssets");
+}

components/utils/generic_rulebase/evaluators/CMakeLists.txt

@@ -0,0 +1 @@
+add_library(generic_rulebase_evaluators asset_eval.cc parameter_eval.cc practice_eval.cc query_eval.cc trigger_eval.cc zone_eval.cc connection_eval.cc http_transaction_data_eval.cc)

components/utils/generic_rulebase/evaluators/asset_eval.cc

@@ -0,0 +1,52 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/evaluators/asset_eval.h"
+
+#include <vector>
+#include <string>
+
+#include "generic_rulebase/assets_config.h"
+#include "config.h"
+#include "debug.h"
+
+using namespace std;
+
+USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
+
+string AssetMatcher::ctx_key = "asset_id";
+
+AssetMatcher::AssetMatcher(const vector<string> &params)
+{
+    if (params.size() != 1) reportWrongNumberOfParams(AssetMatcher::getName(), params.size(), 1, 1);
+    asset_id = params[0];
+}
+
+Maybe<bool, Context::Error>
+AssetMatcher::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<AssetMatcher>();
+    auto bc_asset_id_ctx = env->get<GenericConfigId>(AssetMatcher::ctx_key);
+
+    if (bc_asset_id_ctx.ok()) {
+        dbgTrace(D_RULEBASE_CONFIG)
+            << "Asset ID: "
+            << asset_id
+            << "; Current set assetId context: "
+            << *bc_asset_id_ctx;
+    } else {
+        dbgTrace(D_RULEBASE_CONFIG) << "Asset ID: " << asset_id << ". Empty context";
+    }
+
+    return bc_asset_id_ctx.ok() && *bc_asset_id_ctx == asset_id;
+}

components/utils/generic_rulebase/evaluators/connection_eval.cc

@@ -0,0 +1,299 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/evaluators/connection_eval.h"
+
+#include <vector>
+#include <string>
+
+#include "generic_rulebase/rulebase_config.h"
+#include "config.h"
+#include "debug.h"
+#include "ip_utilities.h"
+
+using namespace std;
+USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
+
+string IpAddressMatcher::ctx_key = "ipAddress";
+string SourceIpMatcher::ctx_key = "sourceIP";
+string DestinationIpMatcher::ctx_key = "destinationIP";
+string SourcePortMatcher::ctx_key = "sourcePort";
+string ListeningPortMatcher::ctx_key = "listeningPort";
+string IpProtocolMatcher::ctx_key = "ipProtocol";
+string UrlMatcher::ctx_key = "url";
+
+Maybe<IPAddr>
+getIpAddrFromEnviroment(I_Environment *env, Context::MetaDataType enum_data_type, const string &str_data_type)
+{
+    auto ip_str = env->get<string>(enum_data_type);
+    if (!ip_str.ok()) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get " << str_data_type << " from the enviroment.";
+        return genError("Failed to get " + str_data_type + " from the enviroment.");
+    }
+    return IPAddr::createIPAddr(ip_str.unpack());
+}
+
+bool
+checkIfIpInRangesVec(const vector<CustomRange<IPAddr>> &values, const IPAddr &ip_to_check)
+{
+    if (values.size() == 0) {
+        dbgTrace(D_RULEBASE_CONFIG) << "Ip addersses vector empty. Match is true.";
+        return true;
+    }
+    for (const CustomRange<IPAddr> &range : values) {
+        if (range.contains(ip_to_check)) {
+            dbgTrace(D_RULEBASE_CONFIG) << "Ip adderss matched: " << ip_to_check;
+            return true;
+        }
+    }
+    dbgTrace(D_RULEBASE_CONFIG) << "Ip adderss not match: " << ip_to_check;
+    return false;
+}
+
+
+IpAddressMatcher::IpAddressMatcher(const vector<string> &params)
+{
+    for (const string &param : params) {
+        Maybe<CustomRange<IPAddr>> ip_range = CustomRange<IPAddr>::createRange(param);
+        if (!ip_range.ok()) {
+            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create ip. Error: " + ip_range.getErr();
+            continue;
+        }
+        values.push_back(ip_range.unpack());
+    }
+}
+
+Maybe<bool, Context::Error>
+IpAddressMatcher::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<IpAddressMatcher>();
+    Maybe<IPAddr> subject_ip = getIpAddrFromEnviroment(
+        env,
+        Context::MetaDataType::SubjectIpAddr,
+        "subject ip address"
+    );
+    if (subject_ip.ok() && checkIfIpInRangesVec(values, subject_ip.unpack())) return true;
+
+    Maybe<IPAddr> other_ip = getIpAddrFromEnviroment(
+        env,
+        Context::MetaDataType::OtherIpAddr,
+        "other ip address"
+    );
+    if (other_ip.ok() && checkIfIpInRangesVec(values, other_ip.unpack())) return true;
+    if (!subject_ip.ok() && !other_ip.ok()) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Error in getting subject ip and other ip from the enviroment";
+        return false;
+    }
+    dbgTrace(D_RULEBASE_CONFIG) << "Ip adderss didn't match";
+    return false;
+}
+
+SourceIpMatcher::SourceIpMatcher(const vector<string> &params)
+{
+    for (const string &param : params) {
+        Maybe<CustomRange<IPAddr>> ip_range = CustomRange<IPAddr>::createRange(param);
+        if (!ip_range.ok()) {
+            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create source ip. Error: " + ip_range.getErr();
+            continue;
+        }
+        values.push_back(ip_range.unpack());
+    }
+}
+
+Maybe<bool, Context::Error>
+SourceIpMatcher::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<SourceIpMatcher>();
+    auto direction_maybe = env->get<string>(Context::MetaDataType::Direction);
+    if (!direction_maybe.ok()) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get direction from the enviroment.";
+        return false;
+    }
+    string direction = direction_maybe.unpack();
+    if (direction == "incoming") {
+        Maybe<IPAddr> other_ip = getIpAddrFromEnviroment(
+            env,
+            Context::MetaDataType::OtherIpAddr,
+            "other ip address"
+        );
+        return other_ip.ok() && checkIfIpInRangesVec(values, other_ip.unpack());
+    } else if (direction == "outgoing") {
+        Maybe<IPAddr> subject_ip = getIpAddrFromEnviroment(
+            env,
+            Context::MetaDataType::SubjectIpAddr,
+            "subject ip address"
+        );
+        return subject_ip.ok() && checkIfIpInRangesVec(values, subject_ip.unpack());
+    }
+    dbgTrace(D_RULEBASE_CONFIG) << "Source ip adderss didn't match";
+    return false;
+}
+
+DestinationIpMatcher::DestinationIpMatcher(const vector<string> &params)
+{
+    for (const string &param : params) {
+        Maybe<CustomRange<IPAddr>> ip_range = CustomRange<IPAddr>::createRange(param);
+        if (!ip_range.ok()) {
+            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create destination ip. Error: " + ip_range.getErr();
+            continue;
+        }
+        values.push_back(ip_range.unpack());
+    }
+}
+
+Maybe<bool, Context::Error>
+DestinationIpMatcher::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<DestinationIpMatcher>();
+    auto direction_maybe = env->get<string>(Context::MetaDataType::Direction);
+    if (!direction_maybe.ok()) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get direction.";
+        return false;
+    }
+    string direction = direction_maybe.unpack();
+    if (direction == "outgoing") {
+        Maybe<IPAddr> other_ip = getIpAddrFromEnviroment(
+            env,
+            Context::MetaDataType::OtherIpAddr,
+            "other ip address"
+        );
+        return other_ip.ok() && checkIfIpInRangesVec(values, other_ip.unpack());
+    } else if (direction == "incoming") {
+        Maybe<IPAddr> subject_ip = getIpAddrFromEnviroment(
+            env,
+            Context::MetaDataType::SubjectIpAddr,
+            "subject ip address"
+        );
+        return subject_ip.ok() && checkIfIpInRangesVec(values, subject_ip.unpack());
+    }
+    dbgTrace(D_RULEBASE_CONFIG) << "Destination ip adderss didn't match";
+    return false;
+}
+
+SourcePortMatcher::SourcePortMatcher(const vector<string> &params)
+{
+    for (const string &param : params) {
+        Maybe<CustomRange<PortNumber>> port_range = CustomRange<PortNumber>::createRange(param);
+        if (!port_range.ok()) {
+            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create source port.";
+            continue;
+        }
+        values.push_back(port_range.unpack());
+    }
+}
+
+Maybe<bool, Context::Error>
+SourcePortMatcher::evalVariable() const
+{
+    dbgTrace(D_RULEBASE_CONFIG) << "Source is not a match";
+    return false;
+}
+
+
+ListeningPortMatcher::ListeningPortMatcher(const vector<string> &params)
+{
+    for (const string &param : params) {
+        Maybe<CustomRange<PortNumber>> port_range = CustomRange<PortNumber>::createRange(param);
+        if (!port_range.ok()) {
+            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create listening port range.";
+            continue;
+        }
+        values.push_back(port_range.unpack());
+    }
+}
+
+Maybe<bool, Context::Error>
+ListeningPortMatcher::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<ListeningPortMatcher>();
+    auto port_str = env->get<string>(Context::MetaDataType::Port);
+    if (!port_str.ok()) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get port from the enviroment.";
+        return false;
+    }
+    PortNumber port;
+    if (ConnKeyUtil::fromString(port_str.unpack(), port)) {
+        if (values.size() == 0) return true;
+        for (const CustomRange<PortNumber> &port_range : values) {
+            if (port_range.contains(port)) {
+                dbgTrace(D_RULEBASE_CONFIG) << "Listening port is a match. Value: " << port_str.unpack();
+                return true;
+            }
+        }
+    }
+    dbgTrace(D_RULEBASE_CONFIG) << "Listening port is not a match. Value: " << port_str.unpack();
+    return false;
+}
+
+IpProtocolMatcher::IpProtocolMatcher(const vector<string> &params)
+{
+    for (const string &param : params) {
+        Maybe<CustomRange<IPProto>> proto_range = CustomRange<IPProto>::createRange(param);
+        if (!proto_range.ok()) {
+            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create ip protocol.";
+            continue;
+        }
+        values.push_back(proto_range.unpack());
+    }
+}
+
+Maybe<bool, Context::Error>
+IpProtocolMatcher::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<IpProtocolMatcher>();
+    auto proto_str = env->get<string>(Context::MetaDataType::Protocol);
+    if (!proto_str.ok()) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get ip protocol from the enviroment.";
+        return false;
+    }
+    IPProto protocol;
+    if (ConnKeyUtil::fromString(proto_str.unpack(), protocol)) {
+        if (values.size() == 0) return true;
+        for (const CustomRange<IPProto> &proto_range : values) {
+            if (proto_range.contains(protocol)) {
+                dbgTrace(D_RULEBASE_CONFIG) << "Ip protocol is a match. Value: " << proto_str.unpack();
+                return true;
+            }
+        }
+    }
+    dbgTrace(D_RULEBASE_CONFIG) << "Source port is not a match. Value: " << proto_str.unpack();
+    return false;
+}
+
+UrlMatcher::UrlMatcher(const vector<string> &params) : values(params) {}
+
+Maybe<bool, Context::Error>
+UrlMatcher::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<UrlMatcher>();
+    auto curr_url_ctx = env->get<string>(Context::MetaDataType::Url);
+    if (!curr_url_ctx.ok()) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get URL from the enviroment.";
+        return false;
+    }
+    
+    if (values.size() == 0) {
+        dbgTrace(D_RULEBASE_CONFIG) << "Matched URL on \"any\". Url: " << *curr_url_ctx;
+        return true;
+    }
+
+    for (const string &url : values) {
+        if (*curr_url_ctx == url) {
+            dbgTrace(D_RULEBASE_CONFIG) << "Matched URL. Value: " << *curr_url_ctx;
+            return true;
+        }
+    }
+
+    dbgTrace(D_RULEBASE_CONFIG) << "URL is not a match. Value: " << *curr_url_ctx;
+    return false;
+}

components/utils/generic_rulebase/evaluators/http_transaction_data_eval.cc

@@ -0,0 +1,168 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/evaluators/http_transaction_data_eval.h"
+
+#include <boost/lexical_cast.hpp>
+#include <algorithm>
+
+#include "http_transaction_data.h"
+#include "environment/evaluator_templates.h"
+#include "i_environment.h"
+#include "singleton.h"
+#include "debug.h"
+
+USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
+
+using namespace std;
+using namespace EnvironmentHelper;
+
+EqualHost::EqualHost(const vector<string> &params)
+{
+    if (params.size() != 1) reportWrongNumberOfParams("EqualHost", params.size(), 1, 1);
+    host = params[0];
+}
+
+Maybe<bool, Context::Error>
+EqualHost::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<EqualHost>();
+    auto host_ctx = env->get<string>(HttpTransactionData::host_name_ctx);
+
+    if (!host_ctx.ok())
+    {
+        return false;
+    }
+
+    std::string lower_host_ctx = host_ctx.unpack();
+    std::transform(lower_host_ctx.begin(), lower_host_ctx.end(), lower_host_ctx.begin(), ::tolower);
+
+    std::string lower_host = host;
+    std::transform(lower_host.begin(), lower_host.end(), lower_host.begin(), ::tolower);
+
+
+    if (lower_host_ctx == lower_host) return true;
+    size_t pos = lower_host_ctx.find_last_of(':');
+    if (pos == string::npos) return false;
+    lower_host_ctx = string(lower_host_ctx.data(), pos);
+    return lower_host_ctx == lower_host;
+}
+
+WildcardHost::WildcardHost(const vector<string> &params)
+{
+    if (params.size() != 1) reportWrongNumberOfParams("WildcardHost", params.size(), 1, 1);
+    host = params[0];
+}
+
+Maybe<bool, Context::Error>
+WildcardHost::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<WildcardHost>();
+    auto host_ctx = env->get<string>(HttpTransactionData::host_name_ctx);
+
+    if (!host_ctx.ok())
+    {
+        return false;
+    }
+
+    string lower_host_ctx = host_ctx.unpack();
+    transform(lower_host_ctx.begin(), lower_host_ctx.end(), lower_host_ctx.begin(), ::tolower);
+
+    dbgTrace(D_RULEBASE_CONFIG) << "found host in current context: " << lower_host_ctx;
+
+    size_t pos = lower_host_ctx.find_first_of(".");
+    if (pos == string::npos) {
+        return false;
+    }
+
+    lower_host_ctx = "*" + lower_host_ctx.substr(pos, lower_host_ctx.length());
+
+    string lower_host = host;
+    transform(lower_host.begin(), lower_host.end(), lower_host.begin(), ::tolower);
+
+    dbgTrace(D_RULEBASE_CONFIG)
+        << "trying to match host context with its corresponding wildcard address: "
+        << lower_host_ctx
+        << ". Matcher host: "
+        << lower_host;
+
+    if (lower_host_ctx == lower_host) return true;
+    pos = lower_host_ctx.find_last_of(':');
+    if (pos == string::npos) return false;
+    lower_host_ctx = string(lower_host_ctx.data(), pos);
+    return lower_host_ctx == lower_host;
+}
+
+EqualListeningIP::EqualListeningIP(const vector<string> &params)
+{
+    if (params.size() != 1) reportWrongNumberOfParams("EqualListeningIP", params.size(), 1, 1);
+
+    auto maybe_ip = IPAddr::createIPAddr(params[0]);
+    if (!maybe_ip.ok()) reportWrongParamType(getName(), params[0], "Not a valid IP Address");
+
+    listening_ip = maybe_ip.unpack();
+}
+
+Maybe<bool, Context::Error>
+EqualListeningIP::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<EqualListeningIP>();
+    auto listening_ip_ctx = env->get<IPAddr>(HttpTransactionData::listening_ip_ctx);
+    return listening_ip_ctx.ok() &&  listening_ip_ctx.unpack() == listening_ip;
+}
+
+EqualListeningPort::EqualListeningPort(const vector<string> &params)
+{
+    if (params.size() != 1) reportWrongNumberOfParams("EqualListeningPort", params.size(), 1, 1);
+
+    try {
+        listening_port = boost::lexical_cast<PortNumber>(params[0]);
+    } catch (boost::bad_lexical_cast const&) {
+        reportWrongParamType(getName(), params[0], "Not a valid port number");
+    }
+}
+
+Maybe<bool, Context::Error>
+EqualListeningPort::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<EqualListeningPort>();
+    auto port_ctx = env->get<PortNumber>(HttpTransactionData::listening_port_ctx);
+
+    return port_ctx.ok() && port_ctx.unpack() == listening_port;
+}
+
+BeginWithUri::BeginWithUri(const vector<string> &params)
+{
+    if (params.size() != 1) reportWrongNumberOfParams("BeginWithUri", params.size(), 1, 1);
+    uri_prefix = params[0];
+}
+
+Maybe<bool, Context::Error>
+BeginWithUri::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<BeginWithUri>();
+    auto uri_ctx = env->get<string>(HttpTransactionData::uri_ctx);
+
+    if (!uri_ctx.ok())
+    {
+        return false;
+    }
+
+    std::string lower_uri_ctx = uri_ctx.unpack();
+    std::transform(lower_uri_ctx.begin(), lower_uri_ctx.end(), lower_uri_ctx.begin(), ::tolower);
+
+    std::string lower_uri_prefix = uri_prefix;
+    std::transform(lower_uri_prefix.begin(), lower_uri_prefix.end(), lower_uri_prefix.begin(), ::tolower);
+
+    return lower_uri_ctx.find(lower_uri_prefix) == 0;
+}

components/utils/generic_rulebase/evaluators/parameter_eval.cc

@@ -0,0 +1,38 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/evaluators/parameter_eval.h"
+
+#include <vector>
+#include <string>
+
+#include "generic_rulebase/rulebase_config.h"
+#include "config.h"
+#include "debug.h"
+
+using namespace std;
+
+string ParameterMatcher::ctx_key = "parameters";
+
+ParameterMatcher::ParameterMatcher(const vector<string> &params)
+{
+    if (params.size() != 1) reportWrongNumberOfParams(ParameterMatcher::getName(), params.size(), 1, 1);
+    parameter_id = params[0];
+}
+
+Maybe<bool, Context::Error>
+ParameterMatcher::evalVariable() const
+{
+    auto rule = getConfiguration<BasicRuleConfig>("rulebase", "rulesConfig");
+    return rule.ok() && rule.unpack().isParameterActive(parameter_id);
+}

components/utils/generic_rulebase/evaluators/practice_eval.cc

@@ -0,0 +1,50 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/evaluators/practice_eval.h"
+
+#include <vector>
+#include <string>
+
+#include "generic_rulebase/rulebase_config.h"
+#include "config.h"
+#include "debug.h"
+
+USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
+
+using namespace std;
+
+string PracticeMatcher::ctx_key = "practices";
+
+PracticeMatcher::PracticeMatcher(const vector<string> &params)
+{
+    if (params.size() != 1) reportWrongNumberOfParams(PracticeMatcher::getName(), params.size(), 1, 1);
+    practice_id = params[0];
+}
+
+Maybe<bool, Context::Error>
+PracticeMatcher::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<PracticeMatcher>();
+    auto bc_practice_id_ctx = env->get<set<GenericConfigId>>(PracticeMatcher::ctx_key);
+    dbgTrace(D_RULEBASE_CONFIG)
+        << "Trying to match practice. ID: "
+        << practice_id << ", Current set IDs: "
+        << makeSeparatedStr(bc_practice_id_ctx.ok() ? *bc_practice_id_ctx : set<GenericConfigId>(), ", ");
+    if (bc_practice_id_ctx.ok()) {
+        return bc_practice_id_ctx.unpack().count(practice_id) > 0;
+    }
+
+    auto rule = getConfiguration<BasicRuleConfig>("rulebase", "rulesConfig");
+    return rule.ok() && rule.unpack().isPracticeActive(practice_id);
+}

components/utils/generic_rulebase/evaluators/query_eval.cc

@@ -0,0 +1,136 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/evaluators/query_eval.h"
+
+#include <vector>
+#include <string>
+#include <map>
+
+#include "generic_rulebase/rulebase_config.h"
+#include "generic_rulebase/zones_config.h"
+#include "i_environment.h"
+#include "singleton.h"
+#include "config.h"
+#include "debug.h"
+#include "enum_range.h"
+
+using namespace std;
+
+USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
+
+QueryMatcher::QueryMatcher(const vector<string> &params)
+{
+    if (params.size() < 1) reportWrongNumberOfParams(QueryMatcher::getName(), params.size(), 1);
+
+    key = params.front();
+    if (key == "any") {
+        is_any = true;
+    } else {
+        values.reserve(params.size() - 1);
+        for (uint i = 1; i < params.size() ; i++) {
+            if (params[i] == "any") {
+                values.clear();
+                break;
+            }
+            values.insert(params[i]);
+        }
+    }
+}
+
+const string
+QueryMatcher::contextKeyToString(Context::MetaDataType type)
+{
+    if (type == Context::MetaDataType::SubjectIpAddr || type == Context::MetaDataType::OtherIpAddr) return "ip";
+    return Context::convertToString(type);
+}
+
+class QueryMatchSerializer
+{
+public:
+    static const string req_attr_ctx_key;
+
+    template <typename Archive>
+    void
+    serialize(Archive &ar)
+    {
+        I_Environment *env = Singleton::Consume<I_Environment>::by<QueryMatcher>();
+        auto req_attr = env->get<string>(req_attr_ctx_key);
+        if (!req_attr.ok()) return;
+
+        try {
+            ar(cereal::make_nvp(*req_attr, value));
+            dbgDebug(D_RULEBASE_CONFIG)
+                << "Found value for requested attribute. Tag: "
+                << *req_attr
+                << ", Value: "
+                << value;
+        } catch (exception &e) {
+            dbgDebug(D_RULEBASE_CONFIG) << "Could not find values for requested attribute. Tag: " << *req_attr;
+            ar.finishNode();
+        }
+    }
+
+    template <typename Values>
+    bool
+    matchValues(const Values &requested_vals) const
+    {
+        return value != "" && (requested_vals.empty() || requested_vals.count(value) > 0);
+    }
+
+private:
+    string value;
+};
+
+const string QueryMatchSerializer::req_attr_ctx_key = "requested attribute key";
+
+Maybe<bool, Context::Error>
+QueryMatcher::evalVariable() const
+{
+    if (is_any) return true;
+
+    I_Environment *env = Singleton::Consume<I_Environment>::by<QueryMatcher>();
+    auto local_asset_ctx = env->get<bool>("is local asset");
+    bool is_remote_asset = local_asset_ctx.ok() && !(*local_asset_ctx);
+
+    QueryRequest request;
+    for (Context::MetaDataType name : makeRange<Context::MetaDataType>()) {
+        auto val = env->get<string>(name);
+        if (val.ok()) {
+            if ((name == Context::MetaDataType::SubjectIpAddr && is_remote_asset) ||
+                (name == Context::MetaDataType::OtherIpAddr && !is_remote_asset)) {
+                continue;
+            }
+
+            request.addCondition(Condition::EQUALS, contextKeyToString(name), *val);
+        }
+    }
+    if (request.empty()) return false;
+
+    request.setRequestedAttr(key);
+    ScopedContext req_attr_key;
+    req_attr_key.registerValue<string>(QueryMatchSerializer::req_attr_ctx_key, key);
+
+    I_Intelligence_IS_V2 *intelligence = Singleton::Consume<I_Intelligence_IS_V2>::by<Zone>();
+    auto query_res = intelligence->queryIntelligence<QueryMatchSerializer>(request);
+    if (!query_res.ok()) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Failed to perform intelligence query. Error: " << query_res.getErr();
+        return false;
+    }
+
+    for (const AssetReply<QueryMatchSerializer> &asset : query_res.unpack()) {
+        if (asset.matchValues<unordered_set<string>>(values)) return true;
+    }
+
+    return false;
+}

components/utils/generic_rulebase/evaluators/trigger_eval.cc

@@ -0,0 +1,57 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/evaluators/trigger_eval.h"
+
+#include <vector>
+#include <string>
+
+#include "generic_rulebase/rulebase_config.h"
+#include "config.h"
+#include "debug.h"
+
+using namespace std;
+
+USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
+
+string TriggerMatcher::ctx_key = "triggers";
+
+TriggerMatcher::TriggerMatcher(const vector<string> &params)
+{
+    if (params.size() != 1) reportWrongNumberOfParams(TriggerMatcher::getName(), params.size(), 1, 1);
+    trigger_id = params[0];
+}
+
+Maybe<bool, Context::Error>
+TriggerMatcher::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<TriggerMatcher>();
+    auto ac_bc_trigger_id_ctx = env->get<set<GenericConfigId>>("ac_trigger_id");
+    dbgTrace(D_RULEBASE_CONFIG)
+        << "Trying to match trigger for access control rule. ID: "
+        << trigger_id << ", Current set IDs: "
+        << makeSeparatedStr(ac_bc_trigger_id_ctx.ok() ? *ac_bc_trigger_id_ctx : set<GenericConfigId>(), ", ");
+    if (ac_bc_trigger_id_ctx.ok()) {
+        return ac_bc_trigger_id_ctx.unpack().count(trigger_id) > 0;
+    }
+
+    auto bc_trigger_id_ctx = env->get<set<GenericConfigId>>(TriggerMatcher::ctx_key);
+    dbgTrace(D_RULEBASE_CONFIG)
+        << "Trying to match trigger. ID: "
+        << trigger_id << ", Current set IDs: "
+        << makeSeparatedStr(bc_trigger_id_ctx.ok() ? *bc_trigger_id_ctx : set<GenericConfigId>(), ", ");
+    if (bc_trigger_id_ctx.ok() && bc_trigger_id_ctx.unpack().count(trigger_id) > 0 ) return true;
+
+    auto rule = getConfiguration<BasicRuleConfig>("rulebase", "rulesConfig");
+    return rule.ok() && rule.unpack().isTriggerActive(trigger_id);
+}

components/utils/generic_rulebase/evaluators/zone_eval.cc

@@ -0,0 +1,44 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/evaluators/zone_eval.h"
+
+#include <vector>
+#include <string>
+
+#include "generic_rulebase/zone.h"
+#include "generic_rulebase/rulebase_config.h"
+#include "config.h"
+
+using namespace std;
+
+string ZoneMatcher::ctx_key = "zone_id";
+
+ZoneMatcher::ZoneMatcher(const vector<string> &params)
+{
+    if (params.size() != 1) reportWrongNumberOfParams(ZoneMatcher::getName(), params.size(), 1, 1);
+    zone_id = params[0];
+}
+
+Maybe<bool, Context::Error>
+ZoneMatcher::evalVariable() const
+{
+    I_Environment *env = Singleton::Consume<I_Environment>::by<ZoneMatcher>();
+    auto bc_zone_id_ctx = env->get<GenericConfigId>(ZoneMatcher::ctx_key);
+    if (bc_zone_id_ctx.ok() && *bc_zone_id_ctx == zone_id) return true;
+
+    if (!getProfileAgentSettingWithDefault<bool>(false, "rulebase.enableQueryBasedMatch")) return false;
+
+    auto zone = getConfiguration<Zone>("rulebase", "zones");
+    return zone.ok() && zone.unpack().getId() == zone_id;
+}

components/utils/generic_rulebase/generic_rulebase.cc

@@ -0,0 +1,149 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/generic_rulebase.h"
+
+#include <unordered_set>
+
+#include "generic_rulebase/evaluators/trigger_eval.h"
+#include "generic_rulebase/evaluators/practice_eval.h"
+#include "generic_rulebase/evaluators/parameter_eval.h"
+#include "generic_rulebase/evaluators/zone_eval.h"
+#include "generic_rulebase/evaluators/asset_eval.h"
+#include "generic_rulebase/evaluators/query_eval.h"
+#include "generic_rulebase/evaluators/connection_eval.h"
+#include "generic_rulebase/evaluators/http_transaction_data_eval.h"
+#include "generic_rulebase/zone.h"
+#include "generic_rulebase/triggers_config.h"
+#include "generic_rulebase/parameters_config.h"
+#include "singleton.h"
+#include "common.h"
+#include "debug.h"
+#include "cache.h"
+#include "config.h"
+#include "i_environment.h"
+
+
+using namespace std;
+
+USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
+
+class GenericRulebase::Impl : Singleton::Provide<I_GenericRulebase>::From<GenericRulebase>
+{
+public:
+    void init() {}
+    void fini() {}
+
+    void preload();
+
+    Maybe<Zone, Config::Errors> getLocalZone() const override { return getZoneConfig(true); }
+    Maybe<Zone, Config::Errors> getOtherZone() const override { return getZoneConfig(false); }
+
+    LogTriggerConf getLogTriggerConf(const string &trigger_Id) const override;
+    ParameterException getParameterException(const string &parameter_Id) const override;
+    set<ParameterBehavior> getBehavior(const ParameterKeyValues &key_value_pairs) const override;
+
+private:
+    Maybe<Zone, Config::Errors>
+    getZoneConfig(bool is_local_zone) const
+    {
+        ScopedContext asset_location_ctx;
+        asset_location_ctx.registerValue<bool>("is local asset", is_local_zone);
+        return getConfiguration<Zone>("rulebase", "zones");
+    }
+};
+
+void
+GenericRulebase::Impl::preload()
+{
+    addMatcher<TriggerMatcher>();
+    addMatcher<PracticeMatcher>();
+    addMatcher<ParameterMatcher>();
+    addMatcher<ZoneMatcher>();
+    addMatcher<AssetMatcher>();
+    addMatcher<QueryMatcher>();
+    addMatcher<IpAddressMatcher>();
+    addMatcher<SourceIpMatcher>();
+    addMatcher<DestinationIpMatcher>();
+    addMatcher<SourcePortMatcher>();
+    addMatcher<ListeningPortMatcher>();
+    addMatcher<IpProtocolMatcher>();
+    addMatcher<UrlMatcher>();
+    addMatcher<EqualHost>();
+    addMatcher<WildcardHost>();
+    addMatcher<EqualListeningIP>();
+    addMatcher<EqualListeningPort>();
+    addMatcher<BeginWithUri>();
+    BasicRuleConfig::preload();
+    LogTriggerConf::preload();
+    ParameterException::preload();
+    registerExpectedConfiguration<Zone>("rulebase", "zones");
+    registerExpectedConfigFile("zones", Config::ConfigFileType::Policy);
+    registerExpectedConfigFile("triggers", Config::ConfigFileType::Policy);
+    registerExpectedConfigFile("rules", Config::ConfigFileType::Policy);
+    registerExpectedConfigFile("parameters", Config::ConfigFileType::Policy);
+    registerExpectedConfigFile("exceptions", Config::ConfigFileType::Policy);
+
+}
+
+LogTriggerConf
+GenericRulebase::Impl::getLogTriggerConf(const string& trigger_Id) const
+{
+    ScopedContext ctx;
+    set<string> triggers = {trigger_Id};
+    ctx.registerValue<set<GenericConfigId>>(TriggerMatcher::ctx_key, triggers);
+    return getConfigurationWithDefault(LogTriggerConf(), "rulebase", "log");
+}
+
+ParameterException
+GenericRulebase::Impl::getParameterException(const string& parameter_Id) const
+{
+    ScopedContext ctx;
+    set<string> exceptions = {parameter_Id};
+    ctx.registerValue<set<GenericConfigId>>(ParameterMatcher::ctx_key, exceptions);
+    return getConfigurationWithDefault(ParameterException(), "rulebase", "exception");
+}
+
+set<ParameterBehavior>
+GenericRulebase::Impl::getBehavior(const ParameterKeyValues &key_value_pairs) const
+{
+    auto &exceptions = getConfiguration<ParameterException>("rulebase", "exception");
+
+    if (!exceptions.ok()) {
+        dbgTrace(D_RULEBASE_CONFIG) << "Could not find any exception with the current rule's context";
+        return {};
+    }
+    return (*exceptions).getBehavior(key_value_pairs);
+}
+
+GenericRulebase::GenericRulebase() : Component("GenericRulebase"), pimpl(make_unique<Impl>()) {}
+
+GenericRulebase::~GenericRulebase() {}
+
+void
+GenericRulebase::init()
+{
+    pimpl->init();
+}
+
+void
+GenericRulebase::fini()
+{
+    pimpl->fini();
+}
+
+void
+GenericRulebase::preload()
+{
+    pimpl->preload();
+}

components/utils/generic_rulebase/generic_rulebase_context.cc

@@ -0,0 +1,109 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/generic_rulebase_context.h"
+
+#include <vector>
+
+#include "context.h"
+#include "config.h"
+#include "generic_rulebase/evaluators/trigger_eval.h"
+#include "generic_rulebase/evaluators/parameter_eval.h"
+#include "generic_rulebase/evaluators/practice_eval.h"
+#include "generic_rulebase/evaluators/zone_eval.h"
+#include "generic_rulebase/evaluators/asset_eval.h"
+
+USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
+
+using namespace std;
+
+template<typename Configs>
+set<GenericConfigId>
+extractIds(const vector<Configs> &configurations)
+{
+    set<GenericConfigId> ids;
+    for (const Configs &conf : configurations) {
+        ids.insert(conf.getId());
+    }
+    return ids;
+}
+
+void
+GenericRulebaseContext::activate(const BasicRuleConfig &rule)
+{
+    switch(registration_state) {
+        case RuleRegistrationState::UNINITIALIZED: {
+            registration_state = RuleRegistrationState::REGISTERED;
+            ctx.registerValue<set<GenericConfigId>>(
+                TriggerMatcher::ctx_key,
+                extractIds<RuleTrigger>(rule.getTriggers())
+            );
+            ctx.registerValue<set<GenericConfigId>>(
+                PracticeMatcher::ctx_key,
+                extractIds<RulePractice>(rule.getPractices())
+            );
+            dbgTrace(D_RULEBASE_CONFIG)
+                << "Activating current practices. Current practice IDs: "
+                << makeSeparatedStr(extractIds<RulePractice>(rule.getPractices()), ", ");
+
+            ctx.registerValue<set<GenericConfigId>>(
+                ParameterMatcher::ctx_key,
+                extractIds<RuleParameter>(rule.getParameters())
+            );
+            ctx.registerValue<GenericConfigId>(
+                ZoneMatcher::ctx_key,
+                rule.getZoneId()
+            );
+            ctx.registerValue<GenericConfigId>(
+                AssetMatcher::ctx_key,
+                rule.getAssetId()
+            );
+            ctx.activate();
+            break;
+        }
+        case RuleRegistrationState::REGISTERED: {
+            dbgTrace(D_RULEBASE_CONFIG) << "Activating registered rule values";
+            ctx.activate();
+            break;
+        }
+        case RuleRegistrationState::UNREGISTERED: {
+            dbgTrace(D_RULEBASE_CONFIG) << "Failed to register rule values";
+        }
+    }
+}
+
+void
+GenericRulebaseContext::activate()
+{
+    switch(registration_state) {
+        case RuleRegistrationState::UNINITIALIZED: {
+            auto maybe_rule = getConfiguration<BasicRuleConfig>("rulebase", "rulesConfig");
+            if (!maybe_rule.ok()) {
+                registration_state = RuleRegistrationState::UNREGISTERED;
+                return;
+            }
+            dbgTrace(D_RULEBASE_CONFIG) << "Registering new rule values";
+            activate(maybe_rule.unpack());
+            registration_state = RuleRegistrationState::REGISTERED;
+            break;
+        }
+        case RuleRegistrationState::REGISTERED: {
+            dbgTrace(D_RULEBASE_CONFIG) << "Activating registered rule values";
+            ctx.activate();
+            break;
+        }
+        case RuleRegistrationState::UNREGISTERED: {
+            dbgTrace(D_RULEBASE_CONFIG) << "Failed to register rule values";
+        }
+    }
+}

components/utils/generic_rulebase/match_query.cc

@@ -0,0 +1,347 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/match_query.h"
+
+#include "cereal/types/set.hpp"
+
+#include "generic_rulebase/generic_rulebase_utils.h"
+#include "config.h"
+#include "ip_utilities.h"
+#include "agent_core_utilities.h"
+
+USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
+
+using namespace std;
+
+static const unordered_map<string, MatchQuery::MatchType> string_to_match_type = {
+    { "condition", MatchQuery::MatchType::Condition },
+    { "operator", MatchQuery::MatchType::Operator }
+};
+
+static const unordered_map<string, MatchQuery::Operators> string_to_operator = {
+    { "and", MatchQuery::Operators::And },
+    { "or", MatchQuery::Operators::Or }
+};
+
+static const unordered_map<string, MatchQuery::Conditions> string_to_condition = {
+    { "equals", MatchQuery::Conditions::Equals },
+    { "not-equals", MatchQuery::Conditions::NotEquals },
+    { "not equals", MatchQuery::Conditions::NotEquals },
+    { "in", MatchQuery::Conditions::In },
+    { "not-in", MatchQuery::Conditions::NotIn },
+    { "not in", MatchQuery::Conditions::NotIn },
+    { "exist", MatchQuery::Conditions::Exist }
+};
+
+static const string ip_addr_type_name = "IP address";
+static const string port_type_name = "port";
+static const string ip_proto_type_name = "IP protocol";
+
+static const unordered_map<string, MatchQuery::StaticKeys> string_to_key = {
+    { "sourceIP", MatchQuery::StaticKeys::SrcIpAddress },
+    { "sourceIpAddr", MatchQuery::StaticKeys::SrcIpAddress },
+    { "destinationIP", MatchQuery::StaticKeys::DstIpAddress },
+    { "destinationIpAddr", MatchQuery::StaticKeys::DstIpAddress },
+    { "ipAddress", MatchQuery::StaticKeys::IpAddress },
+    { "sourcePort", MatchQuery::StaticKeys::SrcPort },
+    { "listeningPort", MatchQuery::StaticKeys::ListeningPort },
+    { "ipProtocol", MatchQuery::StaticKeys::IpProtocol },
+    { "domain", MatchQuery::StaticKeys::Domain }
+};
+
+MatchQuery::MatchQuery(const string &match) : is_specific_label(false), is_ignore_keyword(false)
+{
+    try {
+        stringstream ss;
+        ss.str(match);
+        cereal::JSONInputArchive archive_in(ss);
+        load(archive_in);
+    } catch (const exception &e) {
+        dbgWarning(D_RULEBASE_CONFIG)
+            << "Unable to load match query JSON. JSON content: "
+            << match
+            << ", Error: "
+            << e.what();
+    }
+}
+
+void
+MatchQuery::load(cereal::JSONInputArchive &archive_in)
+{
+    string type_as_string;
+    archive_in(cereal::make_nvp("type", type_as_string));
+
+    string op_as_string;
+    archive_in(cereal::make_nvp("op", op_as_string));
+
+    auto maybe_type = string_to_match_type.find(type_as_string);
+    if (maybe_type == string_to_match_type.end()) {
+        reportConfigurationError("Illegal Zone match query type. Provided type in configuration: " + type_as_string);
+    }
+
+    type = maybe_type->second;
+    switch (type) {
+        case (MatchType::Condition): {
+            auto maybe_condition = string_to_condition.find(op_as_string);
+            if (maybe_condition == string_to_condition.end()) {
+                reportConfigurationError(
+                    "Illegal op provided for condition. Provided op in configuration: " +
+                    op_as_string
+                );
+            }
+            condition_type = maybe_condition->second;
+            operator_type = Operators::None;
+            archive_in(cereal::make_nvp("key", key));
+            key_type = getKeyByName(key);
+            if (key_type == StaticKeys::NotStatic) {
+                if (key.rfind("containerLabels.", 0) == 0)  {
+                    is_specific_label = true;
+                } else {
+                    is_specific_label = false;
+                }
+            }
+            is_ignore_keyword = (key == "indicator");
+
+            if (condition_type != Conditions::Exist) {
+                archive_in(cereal::make_nvp("value", value));
+                for(const auto &val: value) {
+                    if (isKeyTypeIp()) {
+                        auto ip_range = IPUtilities::createRangeFromString<IPRange, IpAddress>(val, ip_addr_type_name);
+                        if (ip_range.ok()) {
+                            ip_addr_value.push_back(ip_range.unpack());
+                        } else {
+                            dbgWarning(D_RULEBASE_CONFIG)
+                                << "Failed to parse IP address range. Error: "
+                                << ip_range.getErr();
+                        }
+                    } else if (isKeyTypePort()) {
+                        auto port_range = IPUtilities::createRangeFromString<PortsRange, uint16_t>(
+                            val,
+                            port_type_name
+                        );
+                        if (port_range.ok()) {
+                            port_value.push_back(port_range.unpack());
+                        } else {
+                            dbgWarning(D_RULEBASE_CONFIG)
+                                << "Failed to parse port range. Error: "
+                                << port_range.getErr();
+                        }
+                    } else if (isKeyTypeProtocol()) {
+                        auto proto_range = IPUtilities::createRangeFromString<IpProtoRange, uint8_t>(
+                            val,
+                            ip_proto_type_name
+                        );
+                        if (proto_range.ok()) {
+                            ip_proto_value.push_back(proto_range.unpack());
+                        } else {
+                            dbgWarning(D_RULEBASE_CONFIG)
+                                << "Failed to parse IP protocol range. Error: "
+                                << proto_range.getErr();
+                        }
+                    }
+
+                    try {
+                        regex_values.insert(boost::regex(val));
+                    } catch (const exception &e) {
+                        dbgDebug(D_RULEBASE_CONFIG) << "Failed to compile regex. Error: " << e.what();
+                    }
+                }
+                first_value = *(value.begin());
+            }
+            break;
+        }
+        case (MatchType::Operator): {
+            auto maybe_operator = string_to_operator.find(op_as_string);
+            if (maybe_operator == string_to_operator.end()) {
+                reportConfigurationError(
+                    "Illegal op provided for operator. Provided op in configuration: " +
+                    op_as_string
+                );
+            }
+            operator_type = maybe_operator->second;
+            condition_type = Conditions::None;
+            archive_in(cereal::make_nvp("items", items));
+            break;
+        }
+    }
+}
+
+MatchQuery::StaticKeys
+MatchQuery::getKeyByName(const string &key_type_name)
+{
+    auto key = string_to_key.find(key_type_name);
+    if (key == string_to_key.end()) return StaticKeys::NotStatic;
+    return key->second;
+}
+
+bool
+MatchQuery::isKeyTypeIp() const
+{
+    return (key_type >= StaticKeys::IpAddress && key_type <= StaticKeys::DstIpAddress);
+}
+
+bool
+MatchQuery::isKeyTypePort() const
+{
+    return (key_type == StaticKeys::SrcPort || key_type == StaticKeys::ListeningPort);
+}
+
+bool
+MatchQuery::isKeyTypeProtocol() const
+{
+    return (key_type == StaticKeys::IpProtocol);
+}
+
+bool
+MatchQuery::isKeyTypeDomain() const
+{
+    return (key_type == StaticKeys::Domain);
+}
+
+bool
+MatchQuery::isKeyTypeSpecificLabel() const
+{
+    return is_specific_label;
+}
+
+bool
+MatchQuery::isKeyTypeStatic() const
+{
+    return (key_type != StaticKeys::NotStatic);
+}
+
+set<string>
+MatchQuery::getAllKeys() const
+{
+    set<string> keys;
+    if (type == MatchType::Condition) {
+        if (!key.empty()) keys.insert(key);
+        return keys;
+    }
+
+    for (const MatchQuery &inner_match: items) {
+        set<string> iner_keys = inner_match.getAllKeys();
+        keys.insert(iner_keys.begin(), iner_keys.end());
+    }
+
+    return keys;
+}
+
+bool
+MatchQuery::matchAttributes(
+        const unordered_map<string, set<string>> &key_value_pairs,
+        set<string> &matched_override_keywords ) const
+{
+
+    if (type == MatchType::Condition) {
+        auto key_value_pair = key_value_pairs.find(key);
+        if (key_value_pair == key_value_pairs.end()) {
+            dbgTrace(D_RULEBASE_CONFIG) << "Ignoring irrelevant key: " << key;
+            return false;
+        }
+        return matchAttributes(key_value_pair->second, matched_override_keywords);
+    } else if (type == MatchType::Operator && operator_type == Operators::And) {
+        for (const MatchQuery &inner_match: items) {
+            if (!inner_match.matchAttributes(key_value_pairs, matched_override_keywords)) {
+                return false;
+            }
+        }
+        return true;
+    } else if (type == MatchType::Operator && operator_type == Operators::Or) {
+        // With 'or' condition, evaluate matched override keywords first and add the ones that were fully matched
+        set<string> inner_override_keywords;
+        bool res = false;
+        for (const MatchQuery &inner_match: items) {
+            inner_override_keywords.clear();
+            if (inner_match.matchAttributes(key_value_pairs, inner_override_keywords)) {
+                matched_override_keywords.insert(inner_override_keywords.begin(), inner_override_keywords.end());
+                res = true;
+            }
+        }
+        return res;
+    } else {
+        dbgWarning(D_RULEBASE_CONFIG) << "Unsupported match query type";
+    }
+    return false;
+}
+
+MatchQuery::MatchResult
+MatchQuery::getMatch( const unordered_map<string, set<string>> &key_value_pairs) const
+{
+    MatchQuery::MatchResult matches;
+    matches.matched_keywords = make_shared<set<string>>();
+    matches.is_match = matchAttributes(key_value_pairs, *matches.matched_keywords);
+    return matches;
+}
+
+bool
+MatchQuery::matchAttributes(
+        const unordered_map<string, set<string>> &key_value_pairs) const
+{
+    return getMatch(key_value_pairs).is_match;
+}
+
+bool
+MatchQuery::matchAttributes(
+        const set<string> &values,
+        set<string> &matched_override_keywords) const
+{
+    auto &type = condition_type;
+    bool negate = type == MatchQuery::Conditions::NotEquals || type == MatchQuery::Conditions::NotIn;
+    bool match = isRegEx() ? matchAttributesRegEx(values, matched_override_keywords) : matchAttributesString(values);
+    return negate ? !match : match;
+}
+
+bool
+MatchQuery::matchAttributesRegEx(
+        const set<string> &values,
+        set<string> &matched_override_keywords) const
+{
+    bool res = false;
+    boost::cmatch value_matcher;
+    for (const boost::regex &val_regex : regex_values) {
+        for (const string &requested_match_value : values) {
+            if (NGEN::Regex::regexMatch(
+                __FILE__,
+                __LINE__,
+                requested_match_value.c_str(),
+                value_matcher,
+                val_regex))
+            {
+                res = true;
+                if (is_ignore_keyword) {
+                    matched_override_keywords.insert(requested_match_value);
+                } else {
+                    return res;
+                }
+            }
+        }
+    }
+    return res;
+}
+
+bool
+MatchQuery::matchAttributesString(const set<string> &values) const
+{
+    for (const string &requested_value : values) {
+        if (value.find(requested_value) != value.end()) return true;
+    }
+    return false;
+}
+
+bool
+MatchQuery::isRegEx() const
+{
+    return key != "protectionName";
+}

components/utils/generic_rulebase/parameters_config.cc

@@ -0,0 +1,157 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/parameters_config.h"
+
+USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
+
+using namespace std;
+
+bool ParameterException::is_geo_location_exception_exists(false);
+bool ParameterException::is_geo_location_exception_being_loaded(false);
+
+void
+ParameterOverrides::load(cereal::JSONInputArchive &archive_in)
+{
+    parseJSONKey<vector<ParsedBehavior>>("parsedBehavior", parsed_behaviors, archive_in);
+}
+
+void
+ParameterTrustedSources::load(cereal::JSONInputArchive &archive_in)
+{
+    parseJSONKey<uint>("numOfSources", num_of_sources, archive_in);
+    parseJSONKey<vector<SourcesIdentifier>>("sourcesIdentifiers", sources_identidiers, archive_in);
+}
+
+void
+ParameterBehavior::load(cereal::JSONInputArchive &archive_in)
+{
+    string key_string;
+    string val_string;
+    parseJSONKey<string>("id", id, archive_in);
+    parseJSONKey<string>("key", key_string, archive_in);
+    parseJSONKey<string>("value", val_string, archive_in);
+    if (string_to_behavior_key.find(key_string) == string_to_behavior_key.end()) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Unsupported behavior key: " << key_string;
+        return;
+    }
+    key = string_to_behavior_key.at(key_string);
+
+    if (string_to_behavior_val.find(val_string) == string_to_behavior_val.end()) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Unsupported behavior value: " << val_string;
+        return;
+    }
+    value = string_to_behavior_val.at(val_string);
+}
+
+void
+ParameterAntiBot::load(cereal::JSONInputArchive &archive_in)
+{
+    parseJSONKey<vector<string>>("injected", injected, archive_in);
+    parseJSONKey<vector<string>>("validated", validated, archive_in);
+}
+
+void
+ParameterOAS::load(cereal::JSONInputArchive &archive_in)
+{
+    parseJSONKey<string>("value", value, archive_in);
+}
+
+void
+ParameterException::MatchBehaviorPair::load(cereal::JSONInputArchive &archive_in)
+{
+    parseJSONKey<MatchQuery>("match", match, archive_in);
+    parseJSONKey<ParameterBehavior>("behavior", behavior, archive_in);
+}
+
+void
+ParameterException::load(cereal::JSONInputArchive &archive_in)
+{
+    try {
+        archive_in(
+            cereal::make_nvp("match", match),
+            cereal::make_nvp("behavior", behavior)
+        );
+    } catch (...) {
+        parseJSONKey<vector<MatchBehaviorPair>>("exceptions", match_queries, archive_in);
+    }
+
+    function<bool(const MatchQuery &)> isGeoLocationExists =
+        [&](const MatchQuery &query)
+        {
+            if (query.getKey() == "countryCode" || query.getKey() == "countryName") {
+                is_geo_location_exception_being_loaded = true;
+                return true;
+            }
+
+            for (const MatchQuery &query_item : query.getItems()) {
+                if (isGeoLocationExists(query_item)) return true;
+            }
+
+            return false;
+        };
+
+    if (isGeoLocationExists(match)) return;
+    for (const MatchBehaviorPair &match_query : match_queries) {
+        if (isGeoLocationExists(match_query.match)) return;
+    }
+}
+
+set<ParameterBehavior>
+ParameterException::getBehavior(
+        const unordered_map<string, set<string>> &key_value_pairs,
+        set<string> &matched_override_keywords) const
+{
+    set<ParameterBehavior> matched_behaviors;
+
+    matched_override_keywords.clear();
+    dbgTrace(D_RULEBASE_CONFIG) << "Matching exception";
+    for (const MatchBehaviorPair &match_behavior_pair: match_queries) {
+        MatchQuery::MatchResult match_res = match_behavior_pair.match.getMatch(key_value_pairs);
+        if (match_res.is_match) {
+            dbgTrace(D_RULEBASE_CONFIG) << "Successfully matched an exception from a list of matches.";
+            // When matching indicators with action=ignore, we expect no behavior override.
+            // Instead, a matched keywords list should be returned which will be later removed from score calculation
+            if (match_res.matched_keywords->size() > 0 && match_behavior_pair.behavior == action_ignore) {
+                matched_override_keywords.insert(match_res.matched_keywords->begin(),
+                        match_res.matched_keywords->end());
+            } else {
+                matched_behaviors.insert(match_behavior_pair.behavior);
+            }
+        }
+    }
+
+    if (match_queries.empty()) {
+        MatchQuery::MatchResult match_res = match.getMatch(key_value_pairs);
+        if (match_res.is_match) {
+            dbgTrace(D_RULEBASE_CONFIG) << "Successfully matched an exception.";
+            // When matching indicators with action=ignore, we expect no behavior override.
+            // Instead, a matched keywords list should be returned which will be later removed from score calculation
+            if (match_res.matched_keywords->size() > 0 && behavior == action_ignore) {
+                matched_override_keywords.insert(match_res.matched_keywords->begin(),
+                        match_res.matched_keywords->end());
+            } else {
+                matched_behaviors.insert(behavior);
+            }
+        }
+    }
+
+    return matched_behaviors;
+}
+
+set<ParameterBehavior>
+ParameterException::getBehavior(const unordered_map<string, set<string>> &key_value_pairs) const
+{
+    set<string> keywords;
+    return getBehavior(key_value_pairs, keywords);
+}

components/utils/generic_rulebase/rulebase_config.cc

@@ -0,0 +1,79 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/rulebase_config.h"
+
+#include "telemetry.h"
+#include "config.h"
+
+USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
+
+using namespace std;
+
+set<string> BasicRuleConfig::assets_ids{};
+set<string> BasicRuleConfig::assets_ids_aggregation{};
+
+void
+BasicRuleConfig::load(cereal::JSONInputArchive &ar)
+{
+    parseJSONKey<vector<RulePractice>>("practices", practices, ar);
+    parseJSONKey<vector<RuleTrigger>>("triggers", triggers, ar);
+    parseJSONKey<vector<RuleParameter>>("parameters", parameters, ar);
+    parseJSONKey<uint8_t>("priority", priority, ar);
+    parseJSONKey<string>("ruleId", rule_id, ar);
+    parseJSONKey<string>("ruleName", rule_name, ar);
+    parseJSONKey<string>("assetId", asset_id, ar);
+    parseJSONKey<string>("assetName", asset_name, ar);
+    parseJSONKey<string>("zoneId", zone_id, ar);
+    parseJSONKey<string>("zoneName", zone_name, ar);
+
+    assets_ids_aggregation.insert(asset_id);
+}
+
+void
+BasicRuleConfig::updateCountMetric()
+{
+    BasicRuleConfig::assets_ids = BasicRuleConfig::assets_ids_aggregation;
+    AssetCountEvent(AssetType::ALL, BasicRuleConfig::assets_ids.size()).notify();
+}
+
+bool
+BasicRuleConfig::isPracticeActive(const string &practice_id) const
+{
+    for (auto practice: practices) {
+        if (practice.getId() == practice_id) return true;
+    }
+    return false;
+}
+
+bool
+BasicRuleConfig::isTriggerActive(const string &trigger_id) const
+{
+    for (auto trigger: triggers) {
+        if (trigger.getId() == trigger_id) {
+            return true;
+        }
+    }
+    return false;
+}
+
+bool
+BasicRuleConfig::isParameterActive(const string &parameter_id) const
+{
+    for (auto param: parameters) {
+        if (param.getId() == parameter_id) {
+            return true;
+        }
+    }
+    return false;
+}

components/utils/generic_rulebase/triggers_config.cc

@@ -0,0 +1,243 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <string>
+#include <map>
+
+#include "generic_rulebase/triggers_config.h"
+#include "generic_rulebase/generic_rulebase_utils.h"
+
+USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
+
+using namespace std;
+
+WebTriggerConf::WebTriggerConf() :  response_title(""), response_body(""), response_code(0) {}
+WebTriggerConf::WebTriggerConf(const string &title, const string &body, uint code)
+        :
+    response_title(title),
+    response_body(body),
+    response_code(code)
+{}
+
+WebTriggerConf WebTriggerConf::default_trigger_conf = WebTriggerConf(
+    "Attack blocked by web application protection",                                     // title
+    "Check Point's <b>Application Security</b> has detected an attack and blocked it.", // body
+    403
+);
+
+void
+WebTriggerConf::load(cereal::JSONInputArchive &archive_in)
+{
+    try {
+        parseJSONKey<string>("details level", details_level, archive_in);
+        if (details_level == "Redirect") {
+            parseJSONKey<string>("redirect URL", redirect_url, archive_in);
+            parseJSONKey<bool>("xEventId", add_event_id_to_header, archive_in);
+            parseJSONKey<bool>("eventIdInHeader", add_event_id_to_header, archive_in);
+            return;
+        }
+        parseJSONKey<uint>("response code", response_code, archive_in);
+        if (response_code < 100 || response_code > 599) {
+            throw cereal::Exception(
+                "illegal web trigger response code: " +
+                to_string(response_code) +
+                " is out of range (100-599)"
+            );
+        }
+
+        if (details_level == "Response Code") return;
+
+        parseJSONKey<string>("response body", response_body, archive_in);
+        parseJSONKey<string>("response title", response_title, archive_in);
+    } catch (const exception &e) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Failed to parse the web trigger configuration: '" << e.what() << "'";
+        archive_in.setNextName(nullptr);
+    }
+}
+
+bool
+WebTriggerConf::operator==(const WebTriggerConf &other) const
+{
+    return
+        response_code == other.response_code &&
+        response_title == other.response_title &&
+        response_body == other.response_body;
+}
+
+LogTriggerConf::LogTriggerConf(string trigger_name, bool log_detect, bool log_prevent) : name(trigger_name)
+{
+    if (log_detect) should_log_on_detect.setAll();
+    if (log_prevent) should_log_on_prevent.setAll();
+    active_streams.setFlag(ReportIS::StreamType::JSON_FOG);
+    active_streams.setFlag(ReportIS::StreamType::JSON_LOG_FILE);
+}
+
+ReportIS::Severity
+LogTriggerConf::getSeverity(bool is_action_drop_or_prevent) const
+{
+    return is_action_drop_or_prevent ? ReportIS::Severity::MEDIUM : ReportIS::Severity::LOW;
+}
+
+ReportIS::Priority
+LogTriggerConf::getPriority(bool is_action_drop_or_prevent) const
+{
+    return is_action_drop_or_prevent ? ReportIS::Priority::HIGH : ReportIS::Priority::MEDIUM;
+}
+
+Flags<ReportIS::StreamType>
+LogTriggerConf::getStreams(SecurityType security_type, bool is_action_drop_or_prevent) const
+{
+    if (is_action_drop_or_prevent && should_log_on_prevent.isSet(security_type)) return active_streams;
+    if (!is_action_drop_or_prevent && should_log_on_detect.isSet(security_type)) return active_streams;
+
+    return Flags<ReportIS::StreamType>();
+}
+
+Flags<ReportIS::Enreachments>
+LogTriggerConf::getEnrechments(SecurityType security_type) const
+{
+    Flags<ReportIS::Enreachments> enreachments;
+
+    if (log_geo_location.isSet(security_type)) enreachments.setFlag(ReportIS::Enreachments::GEOLOCATION);
+    if (should_format_output) enreachments.setFlag(ReportIS::Enreachments::BEAUTIFY_OUTPUT);
+
+    return enreachments;
+}
+
+template <typename EnumClass>
+static void
+setTriggersFlag(const string &key, cereal::JSONInputArchive &ar, EnumClass flag, Flags<EnumClass> &flags)
+{
+    bool value = false;
+    parseJSONKey<bool>(key, value, ar);
+    if (value) flags.setFlag(flag);
+}
+
+static void
+setLogConfiguration(
+    const ReportIS::StreamType &log_type,
+    const string &log_server_url = "",
+    const string &protocol = ""
+)
+{
+    dbgTrace(D_RULEBASE_CONFIG) << "log server url:" << log_server_url;
+    if (log_server_url != "" && protocol != "") {
+        Singleton::Consume<I_Logging>::by<LogTriggerConf>()->addStream(log_type, log_server_url, protocol);
+    } else {
+        Singleton::Consume<I_Logging>::by<LogTriggerConf>()->addStream(log_type);
+    }
+}
+
+static string
+parseProtocolWithDefault(
+    const std::string &default_value,
+    const std::string &key_name,
+    cereal::JSONInputArchive &archive_in
+)
+{
+    string value;
+    try {
+        archive_in(cereal::make_nvp(key_name, value));
+    } catch (const cereal::Exception &e) {
+        return default_value;
+    }
+    return value;
+}
+
+void
+LogTriggerConf::load(cereal::JSONInputArchive& archive_in)
+{
+    try {
+        parseJSONKey<string>("triggerName", name, archive_in);
+        parseJSONKey<string>("verbosity", verbosity, archive_in);
+        parseJSONKey<string>("urlForSyslog", url_for_syslog, archive_in);
+        parseJSONKey<string>("urlForCef", url_for_cef, archive_in);
+        parseJSONKey<string>("syslogProtocol", syslog_protocol, archive_in);
+        syslog_protocol = parseProtocolWithDefault("UDP", "syslogProtocol", archive_in);
+        cef_protocol = parseProtocolWithDefault("UDP", "cefProtocol", archive_in);
+
+        setTriggersFlag("webBody",  archive_in, WebLogFields::webBody, log_web_fields);
+        setTriggersFlag("webHeaders", archive_in, WebLogFields::webHeaders, log_web_fields);
+        setTriggersFlag("webRequests", archive_in, WebLogFields::webRequests, log_web_fields);
+        setTriggersFlag("webUrlPath", archive_in, WebLogFields::webUrlPath, log_web_fields);
+        setTriggersFlag("webUrlQuery", archive_in, WebLogFields::webUrlQuery, log_web_fields);
+        setTriggersFlag("logToAgent", archive_in, ReportIS::StreamType::JSON_LOG_FILE, active_streams);
+        setTriggersFlag("logToCloud", archive_in, ReportIS::StreamType::JSON_FOG, active_streams);
+        setTriggersFlag("logToK8sService", archive_in, ReportIS::StreamType::JSON_K8S_SVC, active_streams);
+        setTriggersFlag("logToSyslog", archive_in, ReportIS::StreamType::SYSLOG, active_streams);
+        setTriggersFlag("logToCef", archive_in, ReportIS::StreamType::CEF, active_streams);
+        setTriggersFlag("acAllow", archive_in, SecurityType::AccessControl, should_log_on_detect);
+        setTriggersFlag("acDrop", archive_in, SecurityType::AccessControl, should_log_on_prevent);
+        setTriggersFlag("tpDetect", archive_in, SecurityType::ThreatPrevention, should_log_on_detect);
+        setTriggersFlag("tpPrevent", archive_in, SecurityType::ThreatPrevention, should_log_on_prevent);
+        setTriggersFlag("complianceWarnings", archive_in, SecurityType::Compliance, should_log_on_detect);
+        setTriggersFlag("complianceViolations", archive_in, SecurityType::Compliance, should_log_on_prevent);
+        setTriggersFlag("acLogGeoLocation", archive_in, SecurityType::AccessControl, log_geo_location);
+        setTriggersFlag("tpLogGeoLocation", archive_in, SecurityType::ThreatPrevention, log_geo_location);
+        setTriggersFlag("complianceLogGeoLocation", archive_in, SecurityType::Compliance, log_geo_location);
+
+        bool extend_logging = false;
+        parseJSONKey<bool>("extendLogging", extend_logging, archive_in);
+        if (extend_logging) {
+            setTriggersFlag("responseCode", archive_in, WebLogFields::responseCode, log_web_fields);
+            setTriggersFlag("responseBody", archive_in, WebLogFields::responseBody, log_web_fields);
+
+            string severity;
+            static const map<string, extendLoggingSeverity> extend_logging_severity_strings = {
+                {"High", extendLoggingSeverity::High},
+                {"Critical", extendLoggingSeverity::Critical}
+            };
+            parseJSONKey<string>("extendLoggingMinSeverity", severity, archive_in);
+            auto extended_severity = extend_logging_severity_strings.find(severity);
+            if (extended_severity != extend_logging_severity_strings.end()) {
+                extend_logging_severity = extended_severity->second;
+            } else {
+                dbgWarning(D_RULEBASE_CONFIG)
+                    << "Failed to parse the extendLoggingMinSeverityfield: '"
+                    << severity
+                    << "'";
+            }
+        }
+
+        for (ReportIS::StreamType log_stream : makeRange<ReportIS::StreamType>()) {
+            if (!active_streams.isSet(log_stream)) continue;
+            switch (log_stream) {
+                case ReportIS::StreamType::JSON_DEBUG:
+                    setLogConfiguration(ReportIS::StreamType::JSON_DEBUG);
+                    break;
+                case ReportIS::StreamType::JSON_FOG:
+                    setLogConfiguration(ReportIS::StreamType::JSON_FOG);
+                    break;
+                case ReportIS::StreamType::JSON_LOG_FILE:
+                    setLogConfiguration(ReportIS::StreamType::JSON_LOG_FILE);
+                    break;
+                case ReportIS::StreamType::JSON_K8S_SVC:
+                    setLogConfiguration(ReportIS::StreamType::JSON_K8S_SVC);
+                    break;
+                case ReportIS::StreamType::SYSLOG:
+                    setLogConfiguration(ReportIS::StreamType::SYSLOG, getUrlForSyslog(), syslog_protocol);
+                    break;
+                case ReportIS::StreamType::CEF:
+                    setLogConfiguration(ReportIS::StreamType::CEF, getUrlForCef(), cef_protocol);
+                    break;
+                case ReportIS::StreamType::NONE: break;
+                case ReportIS::StreamType::COUNT: break;
+            }
+        }
+
+        parseJSONKey<bool>("formatLoggingOutput", should_format_output, archive_in);
+    } catch (const exception &e) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Failed to parse the log trigger configuration: '" << e.what() << "'";
+        archive_in.setNextName(nullptr);
+    }
+}

components/utils/generic_rulebase/zone.cc

@@ -0,0 +1,179 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/zone.h"
+
+#include <set>
+#include <vector>
+#include <string>
+
+using namespace std;
+
+static const unordered_map<string, Zone::Direction> string_to_direction = {
+    { "to", Zone::Direction::To },
+    { "from", Zone::Direction::From },
+    { "bidirectional", Zone::Direction::Bidirectional }
+};
+
+class AdjacentZone
+{
+public:
+    void
+    load(cereal::JSONInputArchive &archive_in)
+    {
+        string direction_as_string;
+        archive_in(cereal::make_nvp("direction", direction_as_string));
+        archive_in(cereal::make_nvp("zoneId", id));
+        auto maybe_direction = string_to_direction.find(direction_as_string);
+        if (maybe_direction == string_to_direction.end()) {
+            reportConfigurationError(
+                "Illegal direction provided for adjacency. Provided direction in configuration: " +
+                direction_as_string
+            );
+        }
+        dir = maybe_direction->second;
+    }
+
+    pair<Zone::Direction, GenericConfigId> getValue() const { return make_pair(dir, id); }
+
+private:
+    Zone::Direction dir;
+    GenericConfigId id;
+};
+
+class TagsValues
+{
+public:
+    static const string req_attrs_ctx_key;
+
+    TagsValues() {}
+
+    template <typename Archive>
+    void
+    serialize(Archive &ar)
+    {
+        I_Environment *env = Singleton::Consume<I_Environment>::by<Zone>();
+        auto req_attrs = env->get<set<string>>(req_attrs_ctx_key);
+        if (!req_attrs.ok()) return;
+
+        for (const string &req_attr : *req_attrs) {
+            try {
+                string data;
+                ar(cereal::make_nvp(req_attr, data));
+                dbgDebug(D_RULEBASE_CONFIG)
+                    << "Found value for requested attribute. Tag: "
+                    << req_attr
+                    << ", Value: "
+                    << data;
+
+                tags_set[req_attr].insert(data);
+            } catch (const exception &e) {
+                dbgDebug(D_RULEBASE_CONFIG) << "Could not find values for requested attribute. Tag: " << req_attr;
+                ar.setNextName(nullptr);
+            }
+        }
+    }
+
+    bool
+    matchValueByKey(const string &requested_key, const unordered_set<string> &possible_values) const
+    {
+        auto values = tags_set.find(requested_key);
+        if (values == tags_set.end()) return false;
+
+        for (const string &val : possible_values) {
+            if (values->second.count(val)) return true;
+        }
+        return false;
+    }
+
+    void
+    insert(const TagsValues &other)
+    {
+        for (auto &single_tags_value : other.getData()) {
+            tags_set[single_tags_value.first].insert(single_tags_value.second.begin(), single_tags_value.second.end());
+        }
+    }
+
+    const unordered_map<string, set<string>> & getData() const { return tags_set; }
+
+private:
+    unordered_map<string, set<string>> tags_set;
+};
+
+const string TagsValues::req_attrs_ctx_key = "requested attributes key";
+
+void
+Zone::load(cereal::JSONInputArchive &archive_in)
+{
+    archive_in(cereal::make_nvp("id", zone_id));
+    archive_in(cereal::make_nvp("name", zone_name));
+    vector<AdjacentZone> adjacency;
+    try {
+        archive_in(cereal::make_nvp("adjacentZones", adjacency));
+    } catch (const cereal::Exception &) {
+        dbgTrace(D_RULEBASE_CONFIG)
+            << "List of adjacentZones does not exist for current object. Zone id: "
+            << zone_id
+            << ", Zone name: "
+            << zone_name;
+
+        archive_in.setNextName(nullptr);
+    }
+
+    for (const AdjacentZone &zone : adjacency) {
+        adjacent_zones.push_back(zone.getValue());
+    }
+
+    archive_in(cereal::make_nvp("match", match_query));
+
+    is_any =
+        match_query.getType() == MatchQuery::MatchType::Condition &&
+        match_query.getKey() == "any" &&
+        match_query.getValue().count("any") > 0;
+
+    set<string> keys = match_query.getAllKeys();
+}
+
+const string
+contextKeyToString(Context::MetaDataType type)
+{
+    if (type == Context::MetaDataType::SubjectIpAddr || type == Context::MetaDataType::OtherIpAddr) return "ip";
+    return Context::convertToString(type);
+}
+
+bool
+Zone::contains(const Asset &asset)
+{
+    QueryRequest request;
+
+    for (const auto &main_attr : asset.getAttrs()) {
+        request.addCondition(Condition::EQUALS, contextKeyToString(main_attr.first), main_attr.second);
+    }
+
+    ScopedContext req_attrs_key;
+    req_attrs_key.registerValue<set<string>>(TagsValues::req_attrs_ctx_key, match_query.getAllKeys());
+
+    I_Intelligence_IS_V2 *intelligence = Singleton::Consume<I_Intelligence_IS_V2>::by<Zone>();
+    auto query_res = intelligence->queryIntelligence<TagsValues>(request);
+    if (!query_res.ok()) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Failed to perform intelligence query. Error: " << query_res.getErr();
+        return false;
+    }
+
+    for (const AssetReply<TagsValues> &asset : query_res.unpack()) {
+        TagsValues tag_values = asset.mergeReplyData();
+
+        if (match_query.matchAttributes(tag_values.getData())) return true;
+    }
+    return false;
+}

components/utils/generic_rulebase/zones_config.cc

@@ -0,0 +1,114 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "generic_rulebase/zones_config.h"
+
+#include <string>
+#include <unordered_map>
+
+#include "generic_rulebase/generic_rulebase_utils.h"
+#include "config.h"
+#include "ip_utilities.h"
+#include "connkey.h"
+#include "i_generic_rulebase.h"
+
+USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
+
+using namespace std;
+
+void
+ZonesConfig::load(cereal::JSONInputArchive &archive_in)
+{
+    dbgFlow(D_RULEBASE_CONFIG) << "Saving active zones";
+    set<string> used_zones;
+    cereal::load(archive_in, used_zones);
+
+    dbgTrace(D_RULEBASE_CONFIG) << "Loading all zones";
+    auto all_zones_maybe = getSetting<Zones>("rulebase", "zones");
+    if (!all_zones_maybe.ok()) {
+        dbgWarning(D_RULEBASE_CONFIG) << "Failed to load zones";
+        return;
+    }
+
+    dbgTrace(D_RULEBASE_CONFIG) << "Creating cache of all zones by ID";
+    map<GenericConfigId, Zone> all_zones;
+    for (const auto &single_zone : all_zones_maybe.unpack().zones) {
+        if (used_zones.count(single_zone.getId()) > 0 && single_zone.isAnyZone()) {
+            dbgTrace(D_RULEBASE_CONFIG) << "Found used zone of type \"Any\": saving all zones as active zones";
+            zones = all_zones_maybe.unpack().zones;
+            return;
+        }
+
+        dbgDebug(D_RULEBASE_CONFIG)
+            << "Adding specific zone to cache. Zone ID: "
+            << single_zone.getId()
+            << ", name: "
+            << single_zone.getName();
+        all_zones.emplace(single_zone.getId(), single_zone);
+    }
+
+    dbgTrace(D_RULEBASE_CONFIG) << "Creating list of active zones";
+    map<GenericConfigId, Zone> active_zones_set;
+    for (const auto &single_used_zone_id : used_zones) {
+        const auto &found_zone = all_zones[single_used_zone_id];
+        dbgTrace(D_RULEBASE_CONFIG)
+            << "Adding zone to list of active zones. Zone ID: "
+            << single_used_zone_id
+            << ", zone name: "
+            << found_zone.getName();
+        active_zones_set.emplace(found_zone.getId(), found_zone);
+
+        for (const auto &adjacent_zone : found_zone.getAdjacentZones()) {
+            const auto &adjacent_zone_obj = all_zones[adjacent_zone.second];
+            dbgTrace(D_RULEBASE_CONFIG)
+                << "Adding adjacent zone to list of active zones. Zone ID: "
+                << adjacent_zone_obj.getId()
+                << ", zone name: "
+                << adjacent_zone_obj.getName();
+            active_zones_set.emplace(adjacent_zone_obj.getId(), adjacent_zone_obj);
+        }
+    }
+
+    vector<GenericConfigId> implied_zones = {
+        "impliedAzure",
+        "impliedDNS",
+        "impliedSSH",
+        "impliedProxy",
+        "impliedFog"
+    };
+
+    GenericConfigId any_zone_id = "";
+    for (const auto &single_zone : all_zones_maybe.unpack().zones) {
+        if (single_zone.isAnyZone()) any_zone_id = single_zone.getId();
+    }
+    for (GenericConfigId &implied_id: implied_zones) {
+        if (all_zones.find(implied_id) != all_zones.end()) {
+            dbgDebug(D_RULEBASE_CONFIG) << "Adding implied zone to cache. Zone ID: " << implied_id;
+            active_zones_set.emplace(implied_id, all_zones[implied_id]);
+            if (any_zone_id != "" && active_zones_set.count(any_zone_id) == 0) {
+                active_zones_set.emplace(any_zone_id, all_zones[any_zone_id]);
+            }
+        }
+    }
+
+    for (const auto &single_id_zone_pair : active_zones_set) {
+        zones.push_back(single_id_zone_pair.second);
+    }
+}
+
+void
+ZonesConfig::preload()
+{
+    registerExpectedSetting<Zones>("rulebase", "zones");
+    registerExpectedSetting<ZonesConfig>("rulebase", "usedZones");
+}