fix watchdog restarts

Fix IPv6 masking

.github/ISSUE_TEMPLATE/bug_report.md

@@ -7,7 +7,9 @@ labels: [bug]
 **Checklist**
 - Have you checked the open-appsec troubleshooting guides - https://docs.openappsec.io/troubleshooting/troubleshooting
   - Yes / No
-- Have you checked the existing issues and discussions in github for the same issue.
+- Have you checked the existing issues and discussions in github for the same issue 
+  - Yes / No
+- Have you checked the knwon limitations same issue - https://docs.openappsec.io/release-notes#limitations
   - Yes / No
 
 **Describe the bug**

README.md

@@ -177,7 +177,7 @@ open-appsec code was audited by an independent third party in September-October
 See the [full report](https://github.com/openappsec/openappsec/blob/main/LEXFO-CHP20221014-Report-Code_audit-OPEN-APPSEC-v1.2.pdf).
 
 ### Reporting security vulnerabilities
-If you've found a vulnerability or a potential vulnerability in open-appsec please let us know at securityalert@openappsec.io. We'll send a confirmation email to acknowledge your report within 24 hours, and we'll send an additional email when we've identified the issue positively or negatively.
+If you've found a vulnerability or a potential vulnerability in open-appsec please let us know at security-alert@openappsec.io. We'll send a confirmation email to acknowledge your report within 24 hours, and we'll send an additional email when we've identified the issue positively or negatively.
 
 
 # License

build_system/docker/CMakeLists.txt

@@ -1,4 +1,4 @@
-install(FILES Dockerfile entry.sh install-cp-agent-intelligence-service.sh install-cp-crowdsec-aux.sh DESTINATION .)
+install(FILES Dockerfile entry.sh install-cp-agent-intelligence-service.sh install-cp-crowdsec-aux.sh self_managed_openappsec_manifest.json DESTINATION .)
 
 add_custom_command(
     OUTPUT ${CMAKE_INSTALL_PREFIX}/agent-docker.img

build_system/docker/Dockerfile

@@ -1,5 +1,7 @@
 FROM alpine
 
+ENV OPENAPPSEC_NANO_AGENT=TRUE
+
 RUN apk add --no-cache -u busybox
 RUN apk add --no-cache -u zlib
 RUN apk add --no-cache bash
@@ -13,6 +15,8 @@ RUN apk add --no-cache libxml2
 RUN apk add --no-cache pcre2
 RUN apk add --update coreutils
 
+COPY self_managed_openappsec_manifest.json /tmp/self_managed_openappsec_manifest.json
+
 COPY install*.sh /nano-service-installers/
 COPY entry.sh /entry.sh
 

build_system/docker/entry.sh

@@ -93,25 +93,16 @@ if [ -f "$FILE" ]; then
 fi
 
 touch /etc/cp/watchdog/wd.startup
+/etc/cp/watchdog/cp-nano-watchdog >/dev/null 2>&1 &
+active_watchdog_pid=$!
 while true; do
-    if [ -z "$init" ]; then
-        init=true
-        /etc/cp/watchdog/cp-nano-watchdog >/dev/null 2>&1 &
-        sleep 5
-        active_watchdog_pid=$(pgrep -f -x -o "/bin/(bash|sh) /etc/cp/watchdog/cp-nano-watchdog")
-    fi
-
-    current_watchdog_pid=$(pgrep -f -x -o "/bin/(bash|sh) /etc/cp/watchdog/cp-nano-watchdog")
-    if [ ! -f /tmp/restart_watchdog ] && [ "$current_watchdog_pid" != "$active_watchdog_pid" ]; then
-        echo "Error: Watchdog exited abnormally"
-        exit 1
-    elif [ -f /tmp/restart_watchdog ]; then
+    if [ -f /tmp/restart_watchdog ]; then
         rm -f /tmp/restart_watchdog
-        kill -9 "$(pgrep -f -x -o "/bin/(bash|sh) /etc/cp/watchdog/cp-nano-watchdog")"
-        /etc/cp/watchdog/cp-nano-watchdog >/dev/null 2>&1 &
-        sleep 5
-        active_watchdog_pid=$(pgrep -f -x -o "/bin/(bash|sh) /etc/cp/watchdog/cp-nano-watchdog")
+        kill -9 ${active_watchdog_pid}
+    fi
+    if [ ! "$(ps -f | grep cp-nano-watchdog | grep ${active_watchdog_pid})" ]; then
+        /etc/cp/watchdog/cp-nano-watchdog >/dev/null 2>&1 &
+        active_watchdog_pid=$!
     fi
-
     sleep 5
 done

components/security_apps/waap/waap_clib/CidrMatch.cc

@@ -41,6 +41,7 @@ static in6_addr applyMaskV6(const in6_addr& addr, uint8_t prefixLength) {
     in6_addr maskedAddr = addr;
     int fullBytes = prefixLength / 8;
     int remainingBits = prefixLength % 8;
+    uint8_t partialByte = maskedAddr.s6_addr[fullBytes];
 
     // Mask full bytes
     for (int i = fullBytes; i < 16; ++i) {
@@ -50,7 +51,7 @@ static in6_addr applyMaskV6(const in6_addr& addr, uint8_t prefixLength) {
     // Mask remaining bits
     if (remainingBits > 0) {
         uint8_t mask = ~((1 << (8 - remainingBits)) - 1);
-        maskedAddr.s6_addr[fullBytes] &= mask;
+        maskedAddr.s6_addr[fullBytes] = partialByte & mask;
     }
 
     return maskedAddr;

components/security_apps/waap/waap_clib/Waf2Engine.cc

@@ -1093,12 +1093,9 @@ void Waf2Transaction::add_request_hdr(const char* name, int name_len, const char
 void Waf2Transaction::end_request_hdrs() {
     dbgFlow(D_WAAP) << "[transaction:" << this << "] end_request_hdrs";
     m_isScanningRequired = setCurrentAssetContext();
-    if (m_siteConfig != NULL)
-    {
-        // getOverrideState also extracts the source identifier and populates m_source_identifier
-        // but the State itself is not needed now
-        Waap::Override::State overrideState = getOverrideState(m_siteConfig);
-    }
+
+    extractEnvSourceIdentifier();
+
     m_pWaapAssetState->m_requestsMonitor->logSourceHit(m_source_identifier);
     IdentifiersEvent ids(m_source_identifier, m_pWaapAssetState->m_assetId);
     ids.notify();

components/security_apps/waap/waap_clib/Waf2EngineGetters.cc

@@ -594,8 +594,6 @@ Waap::Override::State Waf2Transaction::getOverrideState(IWaapConfig* sitePolicy)
         overrideState.applyOverride(*overridePolicy, WaapOverrideFunctor(*this), m_matchedOverrideIds, true);
     }
 
-    extractEnvSourceIdentifier();
-
     if (overridePolicy) { // later we will run response overrides
         m_overrideState.applyOverride(*overridePolicy, WaapOverrideFunctor(*this), m_matchedOverrideIds, false);
     }

config/linux/v1beta1/schema/schema_v1beta1.yaml

@@ -0,0 +1,434 @@
+ype: object
+properties:
+  policies:
+    type: object
+    properties:
+      default:
+        type: object
+        properties:
+          custom-response:
+            type: string
+          exceptions:
+            items:
+              type: string
+            type: array
+          mode:
+            enum:
+              - prevent-learn
+              - detect-learn
+              - prevent
+              - detect
+              - inactive
+            type: string
+          practices:
+            items:
+              type: string
+            type: array
+          source-identifiers:
+            type: string
+          triggers:
+            items:
+              type: string
+            type: array
+          trusted-sources:
+            type: string
+        required:
+          - mode
+          - practices
+          - triggers
+      specific-rules:
+        type: array
+        items:
+          properties:
+            host:
+              type: string
+            custom-response:
+              type: string
+            exceptions:
+              items:
+                type: string
+              type: array
+            mode:
+              enum:
+                - prevent-learn
+                - detect-learn
+                - prevent
+                - detect
+                - inactive
+              type: string
+            practices:
+              items:
+                type: string
+              type: array
+            source-identifiers:
+              type: string
+            triggers:
+              items:
+                type: string
+              type: array
+            trusted-sources:
+              type: string
+          required:
+            - mode
+            - host
+            - practices
+            - triggers
+          type: object
+  practices:
+    type: array
+    items:
+      properties:
+        name:
+          type: string
+        anti-bot:
+          properties:
+            injected-URIs:
+              items:
+                properties:
+                  uri:
+                    type: string
+                type: object
+              type: array
+            override-mode:
+              enum:
+                - prevent-learn
+                - detect-learn
+                - prevent
+                - detect
+                - inactive
+                - as-top-level
+              type: string
+              default: "inactive"
+            validated-URIs:
+              items:
+                properties:
+                  uri:
+                    type: string
+                type: object
+              type: array
+          type: object
+        openapi-schema-validation:
+          properties:
+            files:
+              items:
+                type: string
+              type: array
+            override-mode:
+              enum:
+                - prevent-learn
+                - detect-learn
+                - prevent
+                - detect
+                - inactive
+                - as-top-level
+              type: string
+          type: object
+        snort-signatures:
+          properties:
+            files:
+              items:
+                type: string
+              type: array
+            override-mode:
+              enum:
+                - prevent-learn
+                - detect-learn
+                - prevent
+                - detect
+                - inactive
+                - as-top-level
+              type: string
+          type: object
+        web-attacks:
+          properties:
+            max-body-size-kb:
+              type: integer
+            max-header-size-bytes:
+              type: integer
+            max-object-depth:
+              type: integer
+            max-url-size-bytes:
+              type: integer
+            minimum-confidence:
+              enum:
+                - medium
+                - high
+                - critical
+              type: string
+            override-mode:
+              enum:
+                - prevent-learn
+                - detect-learn
+                - prevent
+                - detect
+                - inactive
+                - as-top-level
+              type: string
+            protections:
+              properties:
+                csrf-enabled:
+                  enum:
+                    - prevent-learn
+                    - detect-learn
+                    - prevent
+                    - detect
+                    - inactive
+                  type: string
+                error-disclosure-enabled:
+                  enum:
+                    - prevent-learn
+                    - detect-learn
+                    - prevent
+                    - detect
+                    - inactive
+                  type: string
+                non-valid-http-methods:
+                  type: boolean
+                open-redirect-enabled:
+                  enum:
+                    - prevent-learn
+                    - detect-learn
+                    - prevent
+                    - detect
+                    - inactive
+                  type: string
+              type: object
+          type: object
+      required:
+        - name
+  custom-responses:
+    type: array
+    minItems: 0
+    items:
+      type: object
+      properties:
+        name:
+          type: string
+        http-response-code:
+          maximum: 599
+          minimum: 100
+          default: 403
+          type: integer
+        message-body:
+          type: string
+          default: "Attack blocked by web application protection"
+        message-title:
+          type: string
+          default: "Openappsec's <b>Application Security</b> has detected an attack and blocked it."
+        mode:
+          enum:
+            - block-page
+            - response-code-only
+          type: string
+      required:
+        - name
+  log-triggers:
+    type: array
+    minItems: 0
+    items:
+      type: object
+      properties:
+        name:
+          type: string
+        access-control-logging:
+          properties:
+            allow-events:
+              type: boolean
+              default: false
+            drop-events:
+              type: boolean
+              default: false
+          type: object
+        additional-suspicious-events-logging:
+          properties:
+            enabled:
+              type: boolean
+              default true:
+            minimum-severity:
+              enum:
+                - high
+                - critical
+              type: string
+              default: "high"
+            response-body:
+              type: boolean
+              default: false
+            response-code:
+              type: boolean
+              default: true
+          type: object
+        appsec-logging:
+          properties:
+            all-web-requests:
+              type: boolean
+              default: false
+            detect-events:
+              type: boolean
+              default: false
+            prevent-events:
+              type: boolean
+              default: true
+          type: object
+        extended-logging:
+          properties:
+            http-headers:
+              type: boolean
+              default: false
+            request-body:
+              type: boolean
+              default: false
+            url-path:
+              type: boolean
+              default: false
+            url-query:
+              type: boolean
+              default: false
+          type: object
+        log-destination:
+          properties:
+            cef-service:
+              minItems: 0
+              items:
+                properties:
+                  address:
+                    type: string
+                  port:
+                    type: integer
+                  proto:
+                    enum:
+                      - tcp
+                      - udp
+                    type: string
+                type: object
+              type: array
+            cloud:
+              type: boolean
+              default: false
+            stdout:
+              properties:
+                format:
+                  enum:
+                    - json
+                    - json-formatted
+                  type: string
+                  default: json
+              type: object
+            syslog-service:
+              minItems: 0
+              items:
+                properties:
+                  address:
+                    type: string
+                  port:
+                    type: integer
+                type: object
+              type: array
+          type: object
+      required:
+        - name
+  exceptions:
+    type: array
+    minItems: 0
+    items:
+      type: object
+      properties:
+        name:
+          type: string
+        action:
+          enum:
+            - skip
+            - accept
+            - drop
+            - suppressLog
+          type: string
+        comment:
+          type: string
+        countryCode:
+          items:
+            type: string
+          type: array
+        countryName:
+          items:
+            type: string
+          type: array
+        hostName:
+          items:
+            type: string
+          type: array
+        paramName:
+          items:
+            type: string
+          type: array
+        paramValue:
+          items:
+            type: string
+          type: array
+        protectionName:
+          items:
+            type: string
+          type: array
+        sourceIdentifier:
+          items:
+            type: string
+          type: array
+        sourceIp:
+          items:
+            type: string
+          type: array
+        url:
+          items:
+            type: string
+          type: array
+      required:
+        - name
+        - action
+  trusted-sources:
+    type: array
+    minItems: 0
+    items:
+      type: object
+      properties:
+        name:
+          type: string
+        minNumOfSources:
+          type: integer
+          minimum: 1
+          default: 3
+        sources-identifiers:
+          items:
+            type: string
+          type: array
+      required:
+        - name
+        - sources-identifiers
+  source-identifiers:
+    type: array
+    minItems: 0
+    items:
+      type: object
+      properties:
+        name:
+          type: string
+        identifiers:
+          type: array
+          minItems: 1
+          items:
+            type: object
+            source-identifier:
+              enum:
+                - headerkey
+                - JWTKey
+                - cookie
+                - sourceip
+                - x-forwarded-for
+              type: string
+            value:
+              items:
+                type: string
+              type: array
+          required:
+            - source-identifier
+      required:
+        - name
+        - identifiers
+additionalProperties: false

config/linux/v1beta2/schema/schema_v1beta2.yaml

@@ -0,0 +1,752 @@
+type: object
+properties:
+  apiVersion:
+    type: string
+    enum:
+    - v1beta1
+    - v1beta2
+  policies:
+    type: object
+    properties:
+      appsecClassName:
+        type: string
+      default:
+        type: object
+        required:
+        - mode
+        - threatPreventionPractices
+        - accessControlPractices
+        properties:
+          mode:
+            type: string
+            enum:
+            - prevent-learn
+            - detect-learn
+            - prevent
+            - detect
+            - inactive
+            default: detect-learn
+          threatPreventionPractices:
+            type: array
+            items:
+              type: string
+          accessControlPractices:
+            type: array
+            items:
+              type: string
+          customResponse:
+            type: string
+            default: "403"
+          triggers:
+            type: array
+            items:
+              type: string
+          sourceIdentifiers:
+            type: string
+          trustedSources:
+            type: string
+          exceptions:
+            type: array
+            items:
+              type: string
+      specificRules:
+        type: array
+        items:
+          type: object
+          properties:
+            name:
+              type: string
+            host:
+              type: string
+            mode:
+              type: string
+              enum:
+              - prevent-learn
+              - detect-learn
+              - prevent
+              - detect
+              - inactive
+              default: detect-learn
+            threatPreventionPractices:
+              type: array
+              items:
+                type: string
+            accessControlPractices:
+              type: array
+              items:
+                type: string
+            triggers:
+              type: array
+              items:
+                type: string
+            customResponse:
+              type: string
+            sourceIdentifiers:
+              type: string
+            trustedSources:
+              type: string
+            exceptions:
+              type: array
+              items:
+                type: string
+  logTriggers:
+    type: array
+    items:
+      type: object
+      required:
+      - accessControlLogging
+      - appsecLogging
+      - additionalSuspiciousEventsLogging
+      - extendedLogging
+      - logDestination
+      properties:
+        appsecClassName:
+          type: string
+        name:
+          type: string
+        accessControlLogging:
+          type: object
+          properties:
+            allowEvents:
+              type: boolean
+              default: false
+            dropEvents:
+              type: boolean
+              default: true
+        appsecLogging:
+          type: object
+          properties:
+            detectEvents:
+              type: boolean
+              default: true
+            preventEvents:
+              type: boolean
+              default: true
+            allWebRequests:
+              type: boolean
+              default: false
+        additionalSuspiciousEventsLogging:
+          type: object
+          properties:
+            enabled:
+              type: boolean
+              default: true
+            minSeverity:
+              type: string
+              enum:
+              - high
+              - critical
+              default: high
+            responseBody:
+              type: boolean
+              default: false
+            responseCode:
+              type: boolean
+              default: true
+        extendedLogging:
+          type: object
+          properties:
+            urlPath:
+              type: boolean
+              default: false
+            urlQuery:
+              type: boolean
+              default: false
+            httpHeaders:
+              type: boolean
+              default: false
+            requestBody:
+              type: boolean
+              default: false
+        logDestination:
+          type: object
+          properties:
+            cloud:
+              type: boolean
+              default: false
+            local-tuning:
+              type: boolean
+              default: false
+            syslogService:
+              type: array
+              items:
+                type: object
+                properties:
+                  address:
+                    type: string
+                  port:
+                    type: integer
+            logToAgent:
+              type: boolean
+              default: true
+            stdout:
+              type: object
+              properties:
+                format:
+                  type: string
+                  enum:
+                  - json
+                  - json-formatted
+                  default: json
+            cefService:
+              type: array
+              items:
+                type: object
+                properties:
+                  address:
+                    type: string
+                  port:
+                    type: integer
+                  proto:
+                    type: string
+                    enum:
+                    - tcp
+                    - udp
+  threatPreventionPractices:
+    type: array
+    items:
+      type: object
+      required:
+      - webAttacks
+      - intrusionPrevention
+      - fileSecurity
+      - snortSignatures
+      properties:
+        appsecClassName:
+          type: string
+        name:
+          type: string
+        practiceMode:
+          type: string
+          enum:
+          - inherited
+          - prevent-learn
+          - detect-learn
+          - prevent
+          - detect
+          - inactive
+          default: inherited
+        webAttacks:
+          type: object
+          required:
+          - overrideMode
+          properties:
+            overrideMode:
+              type: string
+              enum:
+              - prevent-learn
+              - detect-learn
+              - prevent
+              - detect
+              - inactive
+              - inherited
+              default: inactive
+            minimumConfidence:
+              type: string
+              enum:
+              - medium
+              - high
+              - critical
+              default: high
+            maxUrlSizeBytes:
+              type: integer
+              default: 32768
+            maxObjectDepth:
+              type: integer
+              default: 40
+            maxBodySizeKb:
+              type: integer
+              default: 1000000
+            maxHeaderSizeBytes:
+              type: integer
+              default: 102400
+            protections:
+              type: object
+              properties:
+                csrfProtection:
+                  type: string
+                  enum:
+                  - prevent-learn
+                  - detect-learn
+                  - prevent
+                  - detect
+                  - inactive
+                  - inherited
+                  default: inactive
+                errorDisclosure:
+                  type: string
+                  enum:
+                  - prevent-learn
+                  - detect-learn
+                  - prevent
+                  - detect
+                  - inactive
+                  - inherited
+                  default: inactive
+                openRedirect:
+                  type: string
+                  enum:
+                  - prevent-learn
+                  - detect-learn
+                  - prevent
+                  - detect
+                  - inactive
+                  - inherited
+                  default: inactive
+                nonValidHttpMethods:
+                  type: boolean
+                  default: false
+        antiBot:
+          type: object
+          required:
+          - overrideMode
+          properties:
+            overrideMode:
+              type: string
+              enum:
+              - prevent-learn
+              - detect-learn
+              - prevent
+              - detect
+              - inactive
+              - inherited
+              default: inactive
+            injectedUris:
+              type: array
+              items:
+                type: object
+                properties:
+                  uri:
+                    type: string
+            validatedUris:
+              type: array
+              items:
+                type: object
+                properties:
+                  uri:
+                    type: string
+        snortSignatures:
+          type: object
+          required:
+          - overrideMode
+          properties:
+            overrideMode:
+              type: string
+              enum:
+              - prevent-learn
+              - detect-learn
+              - prevent
+              - detect
+              - inactive
+              - inherited
+              default: inactive
+            configmap:
+              type: array
+              items:
+                type: string
+            files:
+              type: array
+              items:
+                type: string
+        schemaValidation:
+          type: object
+          required:
+          - overrideMode
+          properties:
+            overrideMode:
+              type: string
+              enum:
+              - prevent-learn
+              - detect-learn
+              - prevent
+              - detect
+              - inactive
+              - inherited
+              default: inactive
+            enforcementLevel:
+              type: string
+            configmap:
+              type: array
+              items:
+                type: string
+            files:
+              type: array
+              items:
+                type: string
+        intrusionPrevention:
+          type: object
+          required:
+          - overrideMode
+          properties:
+            overrideMode:
+              type: string
+              enum:
+              - prevent-learn
+              - detect-learn
+              - prevent
+              - detect
+              - inactive
+              - inherited
+              default: inactive
+            maxPerformanceImpact:
+              type: string
+              enum:
+              - low
+              - medium
+              - high
+              default: medium
+            minSeverityLevel:
+              type: string
+              enum:
+              - low
+              - medium
+              - high
+              - critical
+              default: medium
+            minCveYear:
+              type: integer
+              default: 2016
+            highConfidenceEventAction:
+              type: string
+              enum:
+              - prevent
+              - detect
+              - inactive
+              - inherited
+              default: inherited
+            mediumConfidenceEventAction:
+              type: string
+              enum:
+              - prevent
+              - detect
+              - inactive
+              - inherited
+              default: inherited
+            lowConfidenceEventAction:
+              type: string
+              enum:
+              - prevent
+              - detect
+              - inactive
+              - inherited
+              default: detect
+        fileSecurity:
+          type: object
+          required:
+          - overrideMode
+          properties:
+            overrideMode:
+              type: string
+              enum:
+              - prevent-learn
+              - detect-learn
+              - prevent
+              - detect
+              - inactive
+              - inherited
+              default: inactive
+            minSeverityLevel:
+              type: string
+              enum:
+              - low
+              - medium
+              - high
+              - critical
+              default: medium
+            highConfidenceEventAction:
+              type: string
+              enum:
+              - prevent
+              - detect
+              - inactive
+              - inherited
+              default: inherited
+            mediumConfidenceEventAction:
+              type: string
+              enum:
+              - prevent
+              - detect
+              - inactive
+              - inherited
+              default: inherited
+            lowConfidenceEventAction:
+              type: string
+              enum:
+              - prevent
+              - detect
+              - inactive
+              - inherited
+              default: detect
+            archiveInspection:
+              type: object
+              properties:
+                extractArchiveFiles:
+                  type: boolean
+                  default: false
+                scanMaxFileSize:
+                  type: integer
+                  default: 10
+                scanMaxFileSizeUnit:
+                  type: string
+                  enum:
+                  - bytes
+                  - KB
+                  - MB
+                  - GB
+                  default: MB
+                archivedFilesWithinArchivedFiles:
+                  type: string
+                  enum:
+                  - prevent
+                  - detect
+                  - inactive
+                  - inherited #as set in overrideMode for fileSecurity
+                  default: inherited
+                archivedFilesWhereContentExtractionFailed:
+                  type: string
+                  enum:
+                  - prevent
+                  - detect
+                  - inactive
+                  - inherited #as set in overrideMode for fileSecurity
+                  default: inherited
+            largeFileInspection:
+              type: object
+              properties:
+                fileSizeLimit:
+                  type: integer
+                  default: 10
+                fileSizeLimitUnit:
+                  type: string
+                  enum:
+                  - bytes
+                  - KB
+                  - MB
+                  - GB
+                  default: MB
+                filesExceedingSizeLimitAction:
+                  type: string
+                  enum:
+                  - prevent
+                  - detect
+                  - inactive
+                  - inherited #as set in overrideMode for fileSecurity
+                  default: inherited
+            unnamedFilesAction:
+              type: string
+              enum:
+              - prevent
+              - detect
+              - inactive
+              - inherited #as set in overrideMode for fileSecurity
+              default: inherited
+            threatEmulationEnabled:
+              type: boolean
+              default: false
+  accessControlPractices:
+    type: array
+    items:
+      type: object
+      required:
+      - rateLimit
+      properties:
+        appsecClassName:
+          type: string
+        name:
+          type: string
+        practiceMode:
+          type: string
+          enum:
+          - inherited #inherited from mode set in policy
+          - prevent
+          - detect
+          - inactive
+          default: inherited
+        rateLimit:
+          type: object
+          required:
+          - overrideMode
+          properties:
+            overrideMode:
+              type: string
+              enum:
+              - prevent
+              - detect
+              - inactive
+              - inherited
+              default: inactive
+            rules:
+              type: array
+              items:
+                type: object
+                properties:
+                  action: # currently not supported
+                    type: string
+                    enum:
+                    - inherited
+                    - prevent
+                    - detect
+                    default: inherited
+                  condition: # currently not supported
+                    type: array
+                    items:
+                      type: object
+                      required:
+                      - key
+                      - value
+                      properties:
+                        key:
+                          type: string
+                        value:
+                          type: string
+                  uri:
+                    type: string
+                  limit:
+                    type: integer
+                  unit:
+                    type: string
+                    enum:
+                    - minute
+                    - second
+                    default: minute
+                  triggers:
+                    type: array
+                    items:
+                      type: string
+                  comment:
+                    type: string
+  customResponses:
+    type: array
+    items:
+      type: object
+      required:
+      - mode
+      properties:
+        appsecClassName:
+          type: string
+        name:
+          type: string
+        mode:
+          type: string
+          enum:
+          - block-page
+          - redirect
+          - response-code-only
+          default: response-code-only
+        messageTitle:
+          type: string
+        messageBody:
+          type: string
+        httpResponseCode:
+          type: integer
+          minimum: 100
+          maximum: 599
+          default: 403
+        redirectUrl:
+          type: string
+        redirectAddXEventId:
+          type: boolean
+          default: false
+  sourcesIdentifiers:
+    type: array
+    items:
+      type: object
+      required:
+      - sourcesIdentifiers
+      properties:
+        name:
+          type: string
+        sourcesIdentifiers:
+          type: array
+          items:
+            type: object
+            required:
+            - identifier
+            properties:
+              identifier:
+                type: string
+                enum:
+                - headerkey
+                - JWTKey
+                - cookie
+                - sourceip
+                - x-forwarded-for
+                default: sourceip
+              value:
+                type: array
+                items:
+                  type: string
+  exceptions:
+    type: array
+    items:
+      type: object
+      required:
+      - action
+      - condition
+      properties:
+        appsecClassName:
+          type: string
+        name:
+          type: string
+        action:
+          type: string
+          enum:
+          - skip
+          - accept
+          - drop
+          - suppressLog
+          default: accept
+        condition:
+          type: array
+          items:
+            type: object
+            required:
+            - key
+            - value
+            properties:
+              key:
+                type: string
+              value:
+                type: string
+  trustedSources:
+    type: array
+    items:
+      type: object
+      required:
+      - minNumOfSources
+      - sourcesIdentifiers
+      properties:
+        appsecClassName:
+          type: string
+        name:
+          type: string
+        minNumOfSources:
+          type: integer
+          default: 3
+        sourcesIdentifiers:
+          type: array
+          items:
+            type: string
+  policyActivations:
+    type: array
+    items:
+      type: object
+      properties:
+        appsecClassName:
+          type: string
+        enabledPolicies:
+          type: array
+          items:
+            type: object
+            properties:
+              name:
+                type: string
+              hosts:
+                type: array
+                items:
+                  type: string
+            required:
+            - hosts
+      required:
+      - enabledPolicies
+additionalProperties: false

deployment/docker-compose/envoy/.env

@@ -56,7 +56,7 @@ COMPOSE_PROFILES=
 ## Make sure to also adjust the envoy.yaml file in ENVOY_CONFIG path
 ## to add a routing configuration for forwarding external traffic on e.g. port 80 to the juiceshop-backend container
 ## you can use the example file available here:
-## https://raw.githubusercontent.com/openappsec/openappsec/main/examples/juiceshop/envoy/envoy.yamll
+## https://raw.githubusercontent.com/openappsec/openappsec/main/examples/juiceshop/envoy/envoy.yaml
 ## place the file above in ENVOY_CONFIG path
 ## note that juiceshop container listens on HTTP port 3000 by default
 

deployment/docker-compose/nginx/docker-compose.yaml

@@ -36,6 +36,7 @@ services:
       - ${APPSEC_DATA}:/etc/cp/data
       - ${APPSEC_LOGS}:/var/log/nano_agent
       - ${APPSEC_LOCALCONFIG}:/ext/appsec
+      - shm-volume:/dev/shm/check-point
     command: /cp-nano-agent
     
   appsec-nginx:
@@ -45,7 +46,7 @@ services:
     restart: unless-stopped
     volumes:
       - ${NGINX_CONFIG}:/etc/nginx/conf.d
-
+      - shm-volume:/dev/shm/check-point
 ## advanced configuration - volume mount for nginx.conf file:
 ## To change global instructions it's possible to also mount your own nginx.conf file by uncommenting the line below
 ## then specify a desired local folder for NGINX_CONF_FILE in the .env file.
@@ -123,6 +124,13 @@ services:
     profiles:
       - juiceshop
 
+volumes:
+  shm-volume:
+    driver: local
+    driver_opts:
+      type: tmpfs
+      device: tmpfs
+
 ## advanced configuration: learning_nfs volume for nfs storage in shared_storage container
 ##
 ## when configuring nfs storage in shared_storage container configuration above, make sure to also specify learning_nfs volume (see example below for using AWS EFS storage)

nodes/orchestration/package/orchestration_package.sh

@@ -359,7 +359,7 @@ done
 # VS ID argument is available only on install, for other actions, extract it from the package location
 if [ -z "$VS_ID" ]; then
     parent_pid=$PPID
-    parent_cmdline=$(ps -o cmd= -p "$parent_pid")
+    parent_cmdline=$(cat /proc/"$parent_pid"/cmdline | tr '\0' ' ')
     parent_dir=$(dirname "$parent_cmdline")
     packages_folder=$(dirname "$parent_dir")
     vs_folder=$(dirname "$packages_folder")
@@ -500,26 +500,26 @@ cp_copy() # Initials - cc
     cp_print "Destination md5, after the copy:\n$DEST_AFTER_COPY"
 }
 
-update_cloudguard_appsec_manifest()
+update_openappsec_manifest()
 {
-    if [ -z ${INFINITY_NEXT_NANO_AGENT} ] && { [ -z ${CLOUDGUARD_APPSEC_STANDALONE} ] || [ -z ${DOCKER_RPM_ENABLED} ]; }; then
+    if [ -z ${OPENAPPSEC_NANO_AGENT} ] && { [ -z ${CLOUDGUARD_APPSEC_STANDALONE} ] || [ -z ${DOCKER_RPM_ENABLED} ]; }; then
         return
     fi
 
-    selected_cloudguard_appsec_manifest_path="${TMP_FOLDER}/cloudguard_appsec_manifest.json"
-    if [ "${DOCKER_RPM_ENABLED}" = "false" ] || [ "${INFINITY_NEXT_NANO_AGENT}" = "TRUE" ]; then
-        selected_cloudguard_appsec_manifest_path="${TMP_FOLDER}/self_managed_cloudguard_appsec_manifest.json"
+    selected_openappsec_manifest_path="${TMP_FOLDER}/openappsec_manifest.json"
+    if [ "${DOCKER_RPM_ENABLED}" = "false" ] || [ "${OPENAPPSEC_NANO_AGENT}" = "TRUE" ]; then
+        selected_openappsec_manifest_path="${TMP_FOLDER}/self_managed_openappsec_manifest.json"
     fi
 
-    if [ ! -f "$selected_cloudguard_appsec_manifest_path" ]; then
+    if [ ! -f "$selected_openappsec_manifest_path" ]; then
         return
     fi
 
-    cloudguard_appsec_manifest_path="${selected_cloudguard_appsec_manifest_path}.used"
-    mv "$selected_cloudguard_appsec_manifest_path" "$cloudguard_appsec_manifest_path"
+    openappsec_manifest_path="${selected_openappsec_manifest_path}.used"
+    mv "$selected_openappsec_manifest_path" "$openappsec_manifest_path"
     fog_host=$(echo "$var_fog_address" | sed 's/https\?:\/\///')
     fog_host=${fog_host%/}
-    sed "s/namespace/${fog_host}/g" ${cloudguard_appsec_manifest_path} > "${FILESYSTEM_PATH}/${CONF_PATH}/manifest.json"
+    sed "s/namespace/${fog_host}/g" ${openappsec_manifest_path} > "${FILESYSTEM_PATH}/${CONF_PATH}/manifest.json"
 }
 
 set_cloud_storage()
@@ -785,6 +785,7 @@ upgrade_conf_if_needed()
 
         [ -f "${FILESYSTEM_PATH}/${SERVICE_PATH}/${ORCHESTRATION_FILE_NAME}.cfg" ] && . "${FILESYSTEM_PATH}/${SERVICE_PATH}/${ORCHESTRATION_FILE_NAME}.cfg"
 
+        [ -f "${FILESYSTEM_PATH}/${SERVICE_PATH}/${ORCHESTRATION_FILE_NAME}.cfg" ] && \
 	previous_mode=$(cat ${FILESYSTEM_PATH}/${SERVICE_PATH}/${ORCHESTRATION_FILE_NAME}.cfg | grep "orchestration-mode" | cut -d = -f 3 | sed 's/"//')
 	if ! [ -z "$previous_mode" ]; then
             var_orchestration_mode=${previous_mode}
@@ -1020,6 +1021,8 @@ install_orchestration()
         fi
 
         [ -f "${FILESYSTEM_PATH}/${SERVICE_PATH}/${ORCHESTRATION_FILE_NAME}.cfg" ] && . "${FILESYSTEM_PATH}/${SERVICE_PATH}/${ORCHESTRATION_FILE_NAME}.cfg"
+
+	[ -f "${FILESYSTEM_PATH}/${SERVICE_PATH}/${ORCHESTRATION_FILE_NAME}.cfg" ] && \
 	previous_mode=$(cat ${FILESYSTEM_PATH}/${SERVICE_PATH}/${ORCHESTRATION_FILE_NAME}.cfg | grep "orchestration-mode" | cut -d = -f 3 | sed 's/"//')
 
         if ! [ -z "$previous_mode" ]; then
@@ -1044,6 +1047,7 @@ install_orchestration()
             rm -f "${FILESYSTEM_PATH}/${CONF_PATH}/default_orchestration_flags"
         fi
 
+        update_openappsec_manifest
 	upgrade_conf_if_needed
 
         cp_exec "${FILESYSTEM_PATH}/${WATCHDOG_PATH}/cp-nano-watchdog --un-register ${FILESYSTEM_PATH}/${SERVICE_PATH}/cp-nano-orchestration $var_arch_flag"
@@ -1100,7 +1104,7 @@ install_orchestration()
     cp_exec "mkdir -p ${LOG_FILE_PATH}/${LOG_PATH}"
     cp_exec "mkdir -p ${FILESYSTEM_PATH}/${DATA_PATH}"
 
-    update_cloudguard_appsec_manifest
+    update_openappsec_manifest
 
     if [ ! -f ${FILESYSTEM_PATH}/${DEFAULT_SETTINGS_PATH} ]; then
         echo "{\"agentSettings\": []}" >  ${FILESYSTEM_PATH}/${DEFAULT_SETTINGS_PATH}

nodes/orchestration/package/watchdog/watchdog

@@ -53,7 +53,12 @@ var_upgarde=false
 get_profile_agent_setting_with_default() {
     key="$1"
     default_value="$2"
-    value=$(grep -oP "\"key\":\s*\"$key\".*?\"value\":\s*\"[^\"]+\"" $SETTINGS_FILE | sed -E 's/.*"value":\s*"([^"]+)".*/\1/')
+
+    value=$(grep -o "\"key\":\s*\"$key\".*?\"value\":\s*\"[^\"]*\"" $SETTINGS_FILE | sed -E 's/.*"value":\s*"([^"]*)".*/\1/')
+    if [ -z "$value" ]; then
+        value=$(grep -o "\"$key\":\s*\"[^\"]*\"" $SETTINGS_FILE | sed -E 's/.*"'"$key"'":\s*"([^"]*)".*/\1/')
+    fi
+
     if [ "$value" = "null" ] || [ -z "$value" ]; then
         echo "$default_value"
     else