prometheus support locally managed (#369)

Co-authored-by: Daniel Eisenberg <danielei@checkpoint.com>

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,36 @@
+---
+name: "Bug Report"
+about: "Report a bug with open-appsec"
+labels: [bug]
+---
+
+**Checklist**
+- Have you checked the open-appsec troubleshooting guides - https://docs.openappsec.io/troubleshooting/troubleshooting
+  - Yes / No
+- Have you checked the existing issues and discussions in github for the same issue 
+  - Yes / No
+- Have you checked the knwon limitations same issue - https://docs.openappsec.io/release-notes#limitations
+  - Yes / No
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Run '...'
+3. See error '...'
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots or Logs**
+If applicable, add screenshots or logs to help explain the issue.
+
+**Environment (please complete the following information):**
+- open-appsec version: 
+- Deployment type (Docker, Kubernetes, etc.): 
+- OS:
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: "Documentation & Troubleshooting"
+    url: "https://docs.openappsec.io/"
+    about: "Check the documentation before submitting an issue."
+  - name: "Feature Requests & Discussions"
+    url: "https://github.com/openappsec/openappsec/discussions"
+    about: "Please open a discussion for feature requests."

.github/ISSUE_TEMPLATE/nginx_version_support.md

@@ -0,0 +1,17 @@
+---
+name: "Nginx Version Support Request"
+about: "Request for a specific Nginx version to be supported"
+---
+
+**Nginx & OS Version:**
+Which Nginx and OS version are you using? 
+
+**Output of nginx -V**
+Share the output of nginx -v
+
+**Expected Behavior:**
+What do you expect to happen with this version?
+
+**Checklist**
+- Have you considered a docker based deployment - find more information here https://docs.openappsec.io/getting-started/start-with-docker?
+  - Yes / No

CMakeLists.txt

@@ -1,7 +1,7 @@
 cmake_minimum_required (VERSION 2.8.4)
 project (ngen)
 
-set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fPIC -Wall -Wno-terminate")
+set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -O2 -fPIC -Wall -Wno-terminate")
 
 execute_process(COMMAND grep -c "Alpine Linux" /etc/os-release OUTPUT_VARIABLE IS_ALPINE)
 if(NOT IS_ALPINE EQUAL "0")

README.md

@@ -6,7 +6,7 @@
 [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/6629/badge)](https://bestpractices.coreinfrastructure.org/projects/6629)
 
 # About
-[open-appsec](https://www.openappsec.io) (openappsec.io) builds on machine learning to provide preemptive web app & API threat protection against OWASP-Top-10 and zero-day attacks. It can be deployed as an add-on to Kubernetes Ingress, NGINX, Envoy (soon), and API Gateways.
+[open-appsec](https://www.openappsec.io) (openappsec.io) builds on machine learning to provide preemptive web app & API threat protection against OWASP-Top-10 and zero-day attacks. It can be deployed as an add-on to Linux, Docker or K8s deployments, on NGINX, Kong, APISIX, or Envoy.
 
 The open-appsec engine learns how users normally interact with your web application. It then uses this information to automatically detect requests that fall outside of normal operations, and conducts further analysis to decide whether the request is malicious or not.
 
@@ -39,13 +39,13 @@ open-appsec can be managed using multiple methods:
 * [Using SaaS Web Management](https://docs.openappsec.io/getting-started/using-the-web-ui-saas)
 
 open-appsec Web UI:
-![image](https://github.com/openappsec/openappsec/assets/114033741/22d99379-df52-45c8-984f-1b820635f3b9)
+<img width="1854" height="775" alt="image" src="https://github.com/user-attachments/assets/4c6f7b0a-14f3-4f02-9ab0-ddadc9979b8d" />
+
 
 
 ## Deployment Playgrounds (Virtual labs)
 You can experiment with open-appsec using [Playgrounds](https://www.openappsec.io/playground)
-
-![image](https://github.com/openappsec/openappsec/assets/114033741/14d35d69-4577-48fc-ae87-ea344888e94d)
+<img width="781" height="878" alt="image" src="https://github.com/user-attachments/assets/0ddee216-5cdf-4288-8c41-cc28cfbf3297" />
 
 # Resources
 * [Project Website](https://openappsec.io)
@@ -54,27 +54,21 @@ You can experiment with open-appsec using [Playgrounds](https://www.openappsec.i
 
 # Installation
 
-For Kubernetes (NGINX Ingress) using the installer:
+For Kubernetes (NGINX /Kong / APISIX / Istio) using Helm: follow [documentation](https://docs.openappsec.io/getting-started/start-with-kubernetes)
 
-```bash
-$ wget https://downloads.openappsec.io/open-appsec-k8s-install && chmod +x open-appsec-k8s-install
-$ ./open-appsec-k8s-install
-```
-
-For Kubernetes (NGINX or Kong) using Helm: follow [documentation](https://docs.openappsec.io/getting-started/start-with-kubernetes/install-using-helm-ingress-nginx-and-kong) – use this method if you’ve built your own containers. 
-
-For Linux (NGINX or Kong) using the installer (list of supported/pre-compiled NGINX attachments is available [here](https://downloads.openappsec.io/packages/supported-nginx.txt)):
+For Linux (NGINX / Kong / APISIX) using the installer (list of supported/pre-compiled NGINX attachments is available [here](https://downloads.openappsec.io/packages/supported-nginx.txt)):
 
 ```bash
 $ wget https://downloads.openappsec.io/open-appsec-install && chmod +x open-appsec-install
 $ ./open-appsec-install --auto
 ```
+For kong Lua Based plug in follow [documentation](https://docs.openappsec.io/getting-started/start-with-linux)
 
 For Linux, if you’ve built your own package use the following commands:
 
 ```bash
 $ install-cp-nano-agent.sh --install --hybrid_mode
-$ install-cp-nano-service-http-transaction-handler.sh –install
+$ install-cp-nano-service-http-transaction-handler.sh --install
 $ install-cp-nano-attachment-registration-manager.sh --install
 ```
 You can add the ```--token <token>``` and ```--email <email address>``` options to the first command, to get a token follow [documentation](https://docs.openappsec.io/getting-started/using-the-web-ui-saas/connect-deployed-agents-to-saas-management-k8s-and-linux). 
@@ -177,7 +171,7 @@ open-appsec code was audited by an independent third party in September-October
 See the [full report](https://github.com/openappsec/openappsec/blob/main/LEXFO-CHP20221014-Report-Code_audit-OPEN-APPSEC-v1.2.pdf).
 
 ### Reporting security vulnerabilities
-If you've found a vulnerability or a potential vulnerability in open-appsec please let us know at securityalert@openappsec.io. We'll send a confirmation email to acknowledge your report within 24 hours, and we'll send an additional email when we've identified the issue positively or negatively.
+If you've found a vulnerability or a potential vulnerability in open-appsec please let us know at security-alert@openappsec.io. We'll send a confirmation email to acknowledge your report within 24 hours, and we'll send an additional email when we've identified the issue positively or negatively.
 
 
 # License

attachments/nginx/nginx_attachment_util/nginx_attachment_util.cc

@@ -95,6 +95,18 @@ getFailOpenHoldTimeout()
     return conf_data.getNumericalValue("fail_open_hold_timeout");
 }
 
+unsigned int
+getHoldVerdictPollingTime()
+{
+    return conf_data.getNumericalValue("hold_verdict_polling_time");
+}
+
+unsigned int
+getHoldVerdictRetries()
+{
+    return conf_data.getNumericalValue("hold_verdict_retries");
+}
+
 unsigned int
 getMaxSessionsPerMinute()
 {
@@ -155,6 +167,30 @@ getWaitingForVerdictThreadTimeout()
     return conf_data.getNumericalValue("waiting_for_verdict_thread_timeout_msec");
 }
 
+unsigned int
+getMinRetriesForVerdict()
+{
+    return conf_data.getNumericalValue("min_retries_for_verdict");
+}
+
+unsigned int
+getMaxRetriesForVerdict()
+{
+    return conf_data.getNumericalValue("max_retries_for_verdict");
+}
+
+unsigned int
+getReqBodySizeTrigger()
+{
+    return conf_data.getNumericalValue("body_size_trigger");
+}
+
+unsigned int
+getRemoveResServerHeader()
+{
+    return conf_data.getNumericalValue("remove_server_header");
+}
+
 int
 isIPAddress(c_str ip_str)
 {

attachments/nginx/nginx_attachment_util/nginx_attachment_util_ut/nginx_attachment_util_ut.cc

@@ -63,32 +63,44 @@ TEST_F(HttpAttachmentUtilTest, GetValidAttachmentConfiguration)
             "\"waiting_for_verdict_thread_timeout_msec\": 75,\n"
             "\"req_header_thread_timeout_msec\": 10,\n"
             "\"ip_ranges\": " + createIPRangesString(ip_ranges) + ",\n"
-            "\"static_resources_path\": \"" + static_resources_path + "\""
+            "\"static_resources_path\": \"" + static_resources_path + "\",\n"
+            "\"min_retries_for_verdict\": 1,\n"
+            "\"max_retries_for_verdict\": 3,\n"
+            "\"hold_verdict_retries\": 3,\n"
+            "\"hold_verdict_polling_time\": 1,\n"
+            "\"body_size_trigger\": 777,\n"
+            "\"remove_server_header\": 1\n"
         "}\n";
     ofstream valid_configuration_file(attachment_configuration_file_name);
     valid_configuration_file << valid_configuration;
     valid_configuration_file.close();
 
     EXPECT_EQ(initAttachmentConfig(attachment_configuration_file_name.c_str()), 1);
-    EXPECT_EQ(getDbgLevel(), 2);
+    EXPECT_EQ(getDbgLevel(), 2u);
     EXPECT_EQ(getStaticResourcesPath(), static_resources_path);
     EXPECT_EQ(isFailOpenMode(), 0);
-    EXPECT_EQ(getFailOpenTimeout(), 1234);
+    EXPECT_EQ(getFailOpenTimeout(), 1234u);
     EXPECT_EQ(isFailOpenHoldMode(), 1);
-    EXPECT_EQ(getFailOpenHoldTimeout(), 4321);
+    EXPECT_EQ(getFailOpenHoldTimeout(), 4321u);
     EXPECT_EQ(isFailOpenOnSessionLimit(), 1);
-    EXPECT_EQ(getMaxSessionsPerMinute(), 0);
-    EXPECT_EQ(getNumOfNginxIpcElements(), 200);
-    EXPECT_EQ(getKeepAliveIntervalMsec(), 10000);
-    EXPECT_EQ(getResProccessingTimeout(), 420);
-    EXPECT_EQ(getReqProccessingTimeout(), 42);
-    EXPECT_EQ(getRegistrationThreadTimeout(), 101);
-    EXPECT_EQ(getReqHeaderThreadTimeout(), 10);
-    EXPECT_EQ(getReqBodyThreadTimeout(), 155);
-    EXPECT_EQ(getResHeaderThreadTimeout(), 1);
-    EXPECT_EQ(getResBodyThreadTimeout(), 0);
-    EXPECT_EQ(getWaitingForVerdictThreadTimeout(), 75);
+    EXPECT_EQ(getMaxSessionsPerMinute(), 0u);
+    EXPECT_EQ(getNumOfNginxIpcElements(), 200u);
+    EXPECT_EQ(getKeepAliveIntervalMsec(), 10000u);
+    EXPECT_EQ(getResProccessingTimeout(), 420u);
+    EXPECT_EQ(getReqProccessingTimeout(), 42u);
+    EXPECT_EQ(getRegistrationThreadTimeout(), 101u);
+    EXPECT_EQ(getReqHeaderThreadTimeout(), 10u);
+    EXPECT_EQ(getReqBodyThreadTimeout(), 155u);
+    EXPECT_EQ(getResHeaderThreadTimeout(), 1u);
+    EXPECT_EQ(getResBodyThreadTimeout(), 0u);
+    EXPECT_EQ(getMinRetriesForVerdict(), 1u);
+    EXPECT_EQ(getMaxRetriesForVerdict(), 3u);
+    EXPECT_EQ(getReqBodySizeTrigger(), 777u);
+    EXPECT_EQ(getWaitingForVerdictThreadTimeout(), 75u);
     EXPECT_EQ(getInspectionMode(), ngx_http_inspection_mode::BLOCKING_THREAD);
+    EXPECT_EQ(getRemoveResServerHeader(), 1u);
+    EXPECT_EQ(getHoldVerdictRetries(), 3u);
+    EXPECT_EQ(getHoldVerdictPollingTime(), 1u);
 
     EXPECT_EQ(isDebugContext("1.2.3.4", "5.6.7.8", 80, "GET", "test", "/abc"), 1);
     EXPECT_EQ(isDebugContext("1.2.3.9", "5.6.7.8", 80, "GET", "test", "/abc"), 0);

build_system/apisix/docker-compose.yaml

@@ -1,15 +1,15 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+# Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
 
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 version: "3"
 

build_system/charts/open-appsec-k8s-nginx-ingress/Chart.lock

@@ -3,4 +3,4 @@ dependencies:
   repository: https://charts.bitnami.com/bitnami
   version: 12.2.8
 digest: sha256:0d13b8b0c66b8e18781eac510ce58b069518ff14a6a15ad90375e7f0ffad71fe
-generated: "2024-02-18T16:45:15.395307713Z"
+generated: "2024-03-26T14:53:49.928153508Z"

build_system/charts/open-appsec-k8s-nginx-ingress/Chart.yaml

@@ -1,7 +1,5 @@
 annotations:
-  artifacthub.io/changes: |-
-    - "update web hook cert gen to latest release v20231226-1a7112e06"
-    - "Update Ingress-Nginx version controller-v1.9.6"
+  artifacthub.io/changes: '- "Update Ingress-Nginx version controller-v1.10.0"'
   artifacthub.io/prerelease: "false"
 apiVersion: v2
 appVersion: latest
@@ -17,4 +15,4 @@ kubeVersion: '>=1.20.0-0'
 name: open-appsec-k8s-nginx-ingress
 sources:
 - https://github.com/kubernetes/ingress-nginx
-version: 4.9.1
+version: 4.10.0

build_system/charts/open-appsec-k8s-nginx-ingress/README.md

@@ -2,7 +2,7 @@
 
 [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer
 
-![Version: 4.9.1](https://img.shields.io/badge/Version-4.9.1-informational?style=flat-square) ![AppVersion: 1.9.6](https://img.shields.io/badge/AppVersion-1.9.6-informational?style=flat-square)
+![Version: 4.10.0](https://img.shields.io/badge/Version-4.10.0-informational?style=flat-square) ![AppVersion: 1.10.0](https://img.shields.io/badge/AppVersion-1.10.0-informational?style=flat-square)
 
 To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources.
 
@@ -253,11 +253,11 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
 | controller.admissionWebhooks.namespaceSelector | object | `{}` |  |
 | controller.admissionWebhooks.objectSelector | object | `{}` |  |
 | controller.admissionWebhooks.patch.enabled | bool | `true` |  |
-| controller.admissionWebhooks.patch.image.digest | string | `"sha256:25d6a5f11211cc5c3f9f2bf552b585374af287b4debf693cacbe2da47daa5084"` |  |
+| controller.admissionWebhooks.patch.image.digest | string | `"sha256:44d1d0e9f19c63f58b380c5fddaca7cf22c7cee564adeff365225a5df5ef3334"` |  |
 | controller.admissionWebhooks.patch.image.image | string | `"ingress-nginx/kube-webhook-certgen"` |  |
 | controller.admissionWebhooks.patch.image.pullPolicy | string | `"IfNotPresent"` |  |
 | controller.admissionWebhooks.patch.image.registry | string | `"registry.k8s.io"` |  |
-| controller.admissionWebhooks.patch.image.tag | string | `"v20231226-1a7112e06"` |  |
+| controller.admissionWebhooks.patch.image.tag | string | `"v1.4.0"` |  |
 | controller.admissionWebhooks.patch.labels | object | `{}` | Labels to be added to patch job resources |
 | controller.admissionWebhooks.patch.networkPolicy.enabled | bool | `false` | Enable 'networkPolicy' or not |
 | controller.admissionWebhooks.patch.nodeSelector."kubernetes.io/os" | string | `"linux"` |  |
@@ -317,7 +317,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
 | controller.hostname | object | `{}` | Optionally customize the pod hostname. |
 | controller.image.allowPrivilegeEscalation | bool | `false` |  |
 | controller.image.chroot | bool | `false` |  |
-| controller.image.digest | string | `"sha256:1405cc613bd95b2c6edd8b2a152510ae91c7e62aea4698500d23b2145960ab9c"` |  |
+| controller.image.digest | string | `"sha256:42b3f0e5d0846876b1791cd3afeb5f1cbbe4259d6f35651dcc1b5c980925379c"` |  |
 | controller.image.digestChroot | string | `"sha256:7eb46ff733429e0e46892903c7394aff149ac6d284d92b3946f3baf7ff26a096"` |  |
 | controller.image.image | string | `"ingress-nginx/controller"` |  |
 | controller.image.pullPolicy | string | `"IfNotPresent"` |  |
@@ -326,7 +326,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
 | controller.image.runAsNonRoot | bool | `true` |  |
 | controller.image.runAsUser | int | `101` |  |
 | controller.image.seccompProfile.type | string | `"RuntimeDefault"` |  |
-| controller.image.tag | string | `"v1.9.6"` |  |
+| controller.image.tag | string | `"v1.10.0"` |  |
 | controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation |
 | controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). |
 | controller.ingressClassResource.controllerValue | string | `"k8s.io/ingress-nginx"` | Controller-value of the controller that is processing this ingressClass |

build_system/charts/open-appsec-k8s-nginx-ingress/changelog/helm-chart-4.10.0.md

@@ -0,0 +1,9 @@
+# Changelog
+
+This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
+
+### 4.10.0
+
+* - "Update Ingress-Nginx version controller-v1.10.0"
+
+**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.9.1...helm-chart-4.10.0

build_system/charts/open-appsec-k8s-nginx-ingress/templates/_params.tpl

@@ -29,7 +29,7 @@
 - --watch-namespace={{ default "$(POD_NAMESPACE)" .Values.controller.scope.namespace }}
 {{- end }}
 {{- if and (not .Values.controller.scope.enabled) .Values.controller.scope.namespaceSelector }}
-- --watch-namespace-selector={{ default "" .Values.controller.scope.namespaceSelector }}
+- --watch-namespace-selector={{ .Values.controller.scope.namespaceSelector }}
 {{- end }}
 {{- if and .Values.controller.reportNodeInternalIp .Values.controller.hostNetwork }}
 - --report-node-internal-ip-address={{ .Values.controller.reportNodeInternalIp }}
@@ -54,6 +54,9 @@
 {{- if .Values.controller.watchIngressWithoutClass }}
 - --watch-ingress-without-class=true
 {{- end }}
+{{- if not .Values.controller.metrics.enabled }}
+- --enable-metrics={{ .Values.controller.metrics.enabled }}
+{{- end }}
 {{- if .Values.controller.enableTopologyAwareRouting }}
 - --enable-topology-aware-routing=true
 {{- end }}

build_system/charts/open-appsec-k8s-nginx-ingress/templates/controller-prometheusrules.yaml

@@ -1,4 +1,4 @@
-{{- if and ( .Values.controller.metrics.enabled ) ( .Values.controller.metrics.prometheusRule.enabled ) ( .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" ) -}}
+{{- if and .Values.controller.metrics.enabled .Values.controller.metrics.prometheusRule.enabled -}}
 apiVersion: monitoring.coreos.com/v1
 kind: PrometheusRule
 metadata:

build_system/charts/open-appsec-k8s-nginx-ingress/templates/default-policy.yaml

@@ -34,7 +34,7 @@ spec:
     http-headers: false
     request-body: false
   log-destination:
-    cloud: false
+    cloud: true
     stdout:
       format: json-formatted
 ---

build_system/charts/open-appsec-k8s-nginx-ingress/tests/controller-daemonset_test.yaml

@@ -15,3 +15,37 @@ tests:
       - equal:
           path: metadata.name
           value: RELEASE-NAME-open-appsec-k8s-nginx-ingress-controller
+
+  - it: should create a DaemonSet with argument `--enable-metrics=false` if `controller.metrics.enabled` is false
+    set:
+      controller.kind: DaemonSet
+      kind: Vanilla
+      controller.metrics.enabled: false
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --enable-metrics=false
+
+  - it: should create a DaemonSet without argument `--enable-metrics=false` if `controller.metrics.enabled` is true
+    set:
+      controller.kind: DaemonSet
+      kind: Vanilla
+      controller.metrics.enabled: true
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].args
+          content: --enable-metrics=false
+
+  - it: should create a DaemonSet with resource limits if `controller.resources.limits` is set
+    set:
+      controller.kind: DaemonSet
+      kind: Vanilla
+      controller.resources.limits.cpu: 500m
+      controller.resources.limits.memory: 512Mi
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].resources.limits.cpu
+          value: 500m
+      - equal:
+          path: spec.template.spec.containers[0].resources.limits.memory
+          value: 512Mi

build_system/charts/open-appsec-k8s-nginx-ingress/tests/controller-deployment_test.yaml

@@ -4,8 +4,6 @@ templates:
 
 tests:
   - it: should create a Deployment
-    set:
-      kind: Vanilla
     asserts:
       - hasDocuments:
           count: 1
@@ -24,6 +22,22 @@ tests:
           path: spec.replicas
           value: 3
 
+  - it: should create a Deployment with argument `--enable-metrics=false` if `controller.metrics.enabled` is false
+    set:
+      controller.metrics.enabled: false
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: --enable-metrics=false
+
+  - it: should create a Deployment without argument `--enable-metrics=false` if `controller.metrics.enabled` is true
+    set:
+      controller.metrics.enabled: true
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].args
+          content: --enable-metrics=false
+
   - it: should create a Deployment with resource limits if `controller.resources.limits` is set
     set:
       controller.resources.limits.cpu: 500m

build_system/charts/open-appsec-k8s-nginx-ingress/values.yaml

@@ -26,8 +26,8 @@ controller:
     ## for backwards compatibility consider setting the full image url via the repository value below
     ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
     ## repository:
-    tag: "v1.9.6"
-    digest: sha256:1405cc613bd95b2c6edd8b2a152510ae91c7e62aea4698500d23b2145960ab9c
+    tag: "v1.10.0"
+    digest: sha256:42b3f0e5d0846876b1791cd3afeb5f1cbbe4259d6f35651dcc1b5c980925379c
     digestChroot: sha256:7eb46ff733429e0e46892903c7394aff149ac6d284d92b3946f3baf7ff26a096
     pullPolicy: IfNotPresent
     runAsNonRoot: true
@@ -781,8 +781,8 @@ controller:
         ## for backwards compatibility consider setting the full image url via the repository value below
         ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
         ## repository:
-        tag: v20231226-1a7112e06
-        digest: sha256:25d6a5f11211cc5c3f9f2bf552b585374af287b4debf693cacbe2da47daa5084
+        tag: v1.4.0
+        digest: sha256:44d1d0e9f19c63f58b380c5fddaca7cf22c7cee564adeff365225a5df5ef3334
         pullPolicy: IfNotPresent
       # -- Provide a priority class name to the webhook patching job
       ##
@@ -1198,7 +1198,7 @@ appsec:
     image:
       registry: ghcr.io/openappsec
       image: smartsync-tuning
-      tag: 1.1.3
+      tag: latest
     enabled: false
     replicaCount: 1
     securityContext:

build_system/charts/open-appsec-kong/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 2.38.0
+
+### Changes
+
+* Added support for setting `SVC.tls.appProtocol` and `SVC.http.appProtocol` values to configure the appProtocol fields
+  for Kubernetes Service HTTP and TLS ports. It might be useful for integration with external load balancers like GCP.
+  [#1018](https://github.com/Kong/charts/pull/1018)
+
+## 2.37.1
+
+* Rename the controller status port. This fixes a collision with the proxy status port in the Prometheus ServiceMonitor.
+  [#1008](https://github.com/Kong/charts/pull/1008)
+
+## 2.37.0
+
+### Changes
+
+* Bumped default `kong/kubernetes-ingress-controller` image tag and updated CRDs to 3.1.
+  [#1011](https://github.com/Kong/charts/pull/1011)
+* Bumped default `kong` image tag to 3.6.
+  [#1011](https://github.com/Kong/charts/pull/1011)
+
 ## 2.36.0
 
 ### Fixed

build_system/charts/open-appsec-kong/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: 1.1.6
+appVersion: 1.1.8
 dependencies:
 - condition: postgresql.enabled
   name: postgresql
@@ -14,4 +14,4 @@ maintainers:
 name: open-appsec-kong
 sources:
 - https://github.com/Kong/charts/tree/main/charts/kong
-version: 2.36.0
+version: 2.38.0

build_system/charts/open-appsec-kong/README.md

@@ -666,40 +666,42 @@ nodes.
 mixed TCP/UDP LoadBalancer Services). It _does not_ support the `http`, `tls`,
 or `ingress` sections, as it is used only for stream listens.
 
-| Parameter                          | Description                                                                           | Default                  |
-|------------------------------------|---------------------------------------------------------------------------------------|--------------------------|
-| SVC.enabled                        | Create Service resource for SVC (admin, proxy, manager, etc.)                         |                          |
-| SVC.http.enabled                   | Enables http on the service                                                           |                          |
-| SVC.http.servicePort               | Service port to use for http                                                          |                          |
-| SVC.http.containerPort             | Container port to use for http                                                        |                          |
-| SVC.http.nodePort                  | Node port to use for http                                                             |                          |
-| SVC.http.hostPort                  | Host port to use for http                                                             |                          |
-| SVC.http.parameters                | Array of additional listen parameters                                                 | `[]`                     |
-| SVC.tls.enabled                    | Enables TLS on the service                                                            |                          |
-| SVC.tls.containerPort              | Container port to use for TLS                                                         |                          |
-| SVC.tls.servicePort                | Service port to use for TLS                                                           |                          |
-| SVC.tls.nodePort                   | Node port to use for TLS                                                              |                          |
-| SVC.tls.hostPort                   | Host port to use for TLS                                                              |                          |
-| SVC.tls.overrideServiceTargetPort  | Override service port to use for TLS without touching Kong containerPort              |                          |
-| SVC.tls.parameters                 | Array of additional listen parameters                                                 | `["http2"]`              |
-| SVC.type                           | k8s service type. Options: NodePort, ClusterIP, LoadBalancer                          |                          |
-| SVC.clusterIP                      | k8s service clusterIP                                                                 |                          |
-| SVC.loadBalancerClass              | loadBalancerClass to use for LoadBalancer provisionning                               |                          |
-| SVC.loadBalancerSourceRanges       | Limit service access to CIDRs if set and service type is `LoadBalancer`               | `[]`                     |
-| SVC.loadBalancerIP                 | Reuse an existing ingress static IP for the service                                   |                          |
-| SVC.externalIPs                    | IPs for which nodes in the cluster will also accept traffic for the servic            | `[]`                     |
-| SVC.externalTrafficPolicy          | k8s service's externalTrafficPolicy. Options: Cluster, Local                          |                          |
-| SVC.ingress.enabled                | Enable ingress resource creation (works with SVC.type=ClusterIP)                      | `false`                  |
-| SVC.ingress.ingressClassName       | Set the ingressClassName to associate this Ingress with an IngressClass               |                          |
-| SVC.ingress.hostname               | Ingress hostname                                                                      | `""`                     |
-| SVC.ingress.path                   | Ingress path.                                                                         | `/`                      |
-| SVC.ingress.pathType               | Ingress pathType. One of `ImplementationSpecific`, `Exact` or `Prefix`                | `ImplementationSpecific` |
-| SVC.ingress.hosts                  | Slice of hosts configurations, including `hostname`, `path` and `pathType` keys       | `[]`                     |
-| SVC.ingress.tls                    | Name of secret resource or slice of `secretName` and `hosts` keys                     |                          |
-| SVC.ingress.annotations            | Ingress annotations. See documentation for your ingress controller for details        | `{}`                     |
-| SVC.ingress.labels                 | Ingress labels. Additional custom labels to add to the ingress.                       | `{}`                     |
-| SVC.annotations                    | Service annotations                                                                   | `{}`                     |
-| SVC.labels                         | Service labels                                                                        | `{}`                     |
+| Parameter                         | Description                                                                               | Default                  |
+|-----------------------------------|-------------------------------------------------------------------------------------------|--------------------------|
+| SVC.enabled                       | Create Service resource for SVC (admin, proxy, manager, etc.)                             |                          |
+| SVC.http.enabled                  | Enables http on the service                                                               |                          |
+| SVC.http.servicePort              | Service port to use for http                                                              |                          |
+| SVC.http.containerPort            | Container port to use for http                                                            |                          |
+| SVC.http.nodePort                 | Node port to use for http                                                                 |                          |
+| SVC.http.hostPort                 | Host port to use for http                                                                 |                          |
+| SVC.http.parameters               | Array of additional listen parameters                                                     | `[]`                     |
+| SVC.http.appProtocol              | `appProtocol` to be set in a Service's port. If left empty, no `appProtocol` will be set. |                          |
+| SVC.tls.enabled                   | Enables TLS on the service                                                                |                          |
+| SVC.tls.containerPort             | Container port to use for TLS                                                             |                          |
+| SVC.tls.servicePort               | Service port to use for TLS                                                               |                          |
+| SVC.tls.nodePort                  | Node port to use for TLS                                                                  |                          |
+| SVC.tls.hostPort                  | Host port to use for TLS                                                                  |                          |
+| SVC.tls.overrideServiceTargetPort | Override service port to use for TLS without touching Kong containerPort                  |                          |
+| SVC.tls.parameters                | Array of additional listen parameters                                                     | `["http2"]`              |
+| SVC.tls.appProtocol               | `appProtocol` to be set in a Service's port. If left empty, no `appProtocol` will be set. |                          |
+| SVC.type                          | k8s service type. Options: NodePort, ClusterIP, LoadBalancer                              |                          |
+| SVC.clusterIP                     | k8s service clusterIP                                                                     |                          |
+| SVC.loadBalancerClass             | loadBalancerClass to use for LoadBalancer provisionning                                   |                          |
+| SVC.loadBalancerSourceRanges      | Limit service access to CIDRs if set and service type is `LoadBalancer`                   | `[]`                     |
+| SVC.loadBalancerIP                | Reuse an existing ingress static IP for the service                                       |                          |
+| SVC.externalIPs                   | IPs for which nodes in the cluster will also accept traffic for the servic                | `[]`                     |
+| SVC.externalTrafficPolicy         | k8s service's externalTrafficPolicy. Options: Cluster, Local                              |                          |
+| SVC.ingress.enabled               | Enable ingress resource creation (works with SVC.type=ClusterIP)                          | `false`                  |
+| SVC.ingress.ingressClassName      | Set the ingressClassName to associate this Ingress with an IngressClass                   |                          |
+| SVC.ingress.hostname              | Ingress hostname                                                                          | `""`                     |
+| SVC.ingress.path                  | Ingress path.                                                                             | `/`                      |
+| SVC.ingress.pathType              | Ingress pathType. One of `ImplementationSpecific`, `Exact` or `Prefix`                    | `ImplementationSpecific` |
+| SVC.ingress.hosts                 | Slice of hosts configurations, including `hostname`, `path` and `pathType` keys           | `[]`                     |
+| SVC.ingress.tls                   | Name of secret resource or slice of `secretName` and `hosts` keys                         |                          |
+| SVC.ingress.annotations           | Ingress annotations. See documentation for your ingress controller for details            | `{}`                     |
+| SVC.ingress.labels                | Ingress labels. Additional custom labels to add to the ingress.                           | `{}`                     |
+| SVC.annotations                   | Service annotations                                                                       | `{}`                     |
+| SVC.labels                        | Service labels                                                                            | `{}`                     |
 
 #### Admin Service mTLS
 

build_system/charts/open-appsec-kong/ci/__snapshots__/admin-api-service-clusterip-values.snap

@@ -9,8 +9,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     spec:
@@ -33,9 +33,9 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
             spec:
                 automountServiceAccountToken: false
                 containers:
@@ -90,7 +90,7 @@ SnapShot = """
                           value: \"off\"
                         - name: KONG_NGINX_DAEMON
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       lifecycle:
                         preStop:
@@ -205,7 +205,7 @@ SnapShot = """
                           value: 0.0.0.0:8100, [::]:8100
                         - name: KONG_STREAM_LISTEN
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: clear-stale-pid
                       resources: {}
@@ -274,8 +274,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-custom-dbless-config
         namespace: default
 - object:
@@ -286,8 +286,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-admin
         namespace: default
     spec:
@@ -309,8 +309,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-manager
         namespace: default
     spec:
@@ -336,9 +336,9 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
             enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -364,8 +364,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
 """

build_system/charts/open-appsec-kong/ci/__snapshots__/custom-labels-values.snap

@@ -9,8 +9,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validations
         namespace: default
     webhooks:
@@ -84,8 +84,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     spec:
@@ -108,9 +108,9 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
             spec:
                 automountServiceAccountToken: false
                 containers:
@@ -138,7 +138,7 @@ SnapShot = """
                           value: https://localhost:8444
                         - name: CONTROLLER_PUBLISH_SERVICE
                           value: default/chartsnap-kong-proxy
-                      image: kong/kubernetes-ingress-controller:3.0
+                      image: kong/kubernetes-ingress-controller:3.1
                       imagePullPolicy: IfNotPresent
                       livenessProbe:
                         failureThreshold: 3
@@ -159,7 +159,7 @@ SnapShot = """
                           name: cmetrics
                           protocol: TCP
                         - containerPort: 10254
-                          name: status
+                          name: cstatus
                           protocol: TCP
                       readinessProbe:
                         failureThreshold: 3
@@ -240,7 +240,7 @@ SnapShot = """
                           value: \"off\"
                         - name: KONG_NGINX_DAEMON
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       lifecycle:
                         preStop:
@@ -350,7 +350,7 @@ SnapShot = """
                           value: 0.0.0.0:8100, [::]:8100
                         - name: KONG_STREAM_LISTEN
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: clear-stale-pid
                       resources: {}
@@ -408,8 +408,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     rules:
         - apiGroups:
@@ -617,6 +617,38 @@ SnapShot = """
             - get
             - list
             - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
         - apiGroups:
             - configuration.konghq.com
           resources:
@@ -657,8 +689,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     roleRef:
         apiGroup: rbac.authorization.k8s.io
@@ -677,8 +709,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     rules:
@@ -742,8 +774,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     roleRef:
@@ -766,8 +798,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-ca-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -783,8 +815,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -797,8 +829,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-manager
         namespace: default
     spec:
@@ -825,9 +857,9 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
             enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -854,8 +886,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook
         namespace: default
     spec:
@@ -870,8 +902,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
     apiVersion: v1
     kind: ServiceAccount
@@ -881,8 +913,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
 """

build_system/charts/open-appsec-kong/ci/__snapshots__/default-values.snap

@@ -8,8 +8,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validations
         namespace: default
     webhooks:
@@ -82,8 +82,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     spec:
@@ -105,9 +105,9 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
             spec:
                 automountServiceAccountToken: false
                 containers:
@@ -137,7 +137,7 @@ SnapShot = """
                           value: https://localhost:8444
                         - name: CONTROLLER_PUBLISH_SERVICE
                           value: default/chartsnap-kong-proxy
-                      image: kong/kubernetes-ingress-controller:3.0
+                      image: kong/kubernetes-ingress-controller:3.1
                       imagePullPolicy: IfNotPresent
                       livenessProbe:
                         failureThreshold: 3
@@ -158,7 +158,7 @@ SnapShot = """
                           name: cmetrics
                           protocol: TCP
                         - containerPort: 10254
-                          name: status
+                          name: cstatus
                           protocol: TCP
                       readinessProbe:
                         failureThreshold: 3
@@ -241,7 +241,7 @@ SnapShot = """
                           value: \"off\"
                         - name: KONG_NGINX_DAEMON
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       lifecycle:
                         preStop:
@@ -353,7 +353,7 @@ SnapShot = """
                           value: 0.0.0.0:8100, [::]:8100
                         - name: KONG_STREAM_LISTEN
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: clear-stale-pid
                       resources: {}
@@ -410,8 +410,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     rules:
         - apiGroups:
@@ -619,6 +619,38 @@ SnapShot = """
             - get
             - list
             - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
         - apiGroups:
             - configuration.konghq.com
           resources:
@@ -658,8 +690,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     roleRef:
         apiGroup: rbac.authorization.k8s.io
@@ -677,8 +709,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     rules:
@@ -741,8 +773,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     roleRef:
@@ -764,8 +796,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-ca-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -780,8 +812,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -793,8 +825,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-manager
         namespace: default
     spec:
@@ -820,9 +852,9 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
             enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -848,8 +880,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook
         namespace: default
     spec:
@@ -863,8 +895,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
     apiVersion: v1
     kind: ServiceAccount
@@ -873,8 +905,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
 """

build_system/charts/open-appsec-kong/ci/__snapshots__/kong-ingress-1-values.snap

@@ -8,8 +8,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validations
         namespace: default
     webhooks:
@@ -82,8 +82,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     spec:
@@ -105,9 +105,9 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
             spec:
                 automountServiceAccountToken: false
                 containers:
@@ -135,7 +135,7 @@ SnapShot = """
                           value: https://localhost:8444
                         - name: CONTROLLER_PUBLISH_SERVICE
                           value: default/chartsnap-kong-proxy
-                      image: kong/kubernetes-ingress-controller:3.0
+                      image: kong/kubernetes-ingress-controller:3.1
                       imagePullPolicy: IfNotPresent
                       livenessProbe:
                         failureThreshold: 3
@@ -156,7 +156,7 @@ SnapShot = """
                           name: cmetrics
                           protocol: TCP
                         - containerPort: 10254
-                          name: status
+                          name: cstatus
                           protocol: TCP
                       readinessProbe:
                         failureThreshold: 3
@@ -237,7 +237,7 @@ SnapShot = """
                           value: \"off\"
                         - name: KONG_NGINX_DAEMON
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       lifecycle:
                         preStop:
@@ -347,7 +347,7 @@ SnapShot = """
                           value: 0.0.0.0:8100, [::]:8100
                         - name: KONG_STREAM_LISTEN
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: clear-stale-pid
                       resources: {}
@@ -404,8 +404,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -430,8 +430,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     rules:
         - apiGroups:
@@ -639,6 +639,38 @@ SnapShot = """
             - get
             - list
             - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
         - apiGroups:
             - configuration.konghq.com
           resources:
@@ -678,8 +710,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     roleRef:
         apiGroup: rbac.authorization.k8s.io
@@ -697,8 +729,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     rules:
@@ -761,8 +793,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     roleRef:
@@ -784,8 +816,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-ca-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -800,8 +832,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -822,8 +854,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-manager
         namespace: default
     spec:
@@ -849,9 +881,9 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
             enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -877,8 +909,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook
         namespace: default
     spec:
@@ -892,8 +924,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
     apiVersion: v1
     kind: ServiceAccount
@@ -902,8 +934,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
 """

build_system/charts/open-appsec-kong/ci/__snapshots__/kong-ingress-2-values.snap

@@ -8,8 +8,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validations
         namespace: default
     webhooks:
@@ -82,8 +82,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     spec:
@@ -105,9 +105,9 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
             spec:
                 automountServiceAccountToken: false
                 containers:
@@ -135,7 +135,7 @@ SnapShot = """
                           value: https://localhost:8444
                         - name: CONTROLLER_PUBLISH_SERVICE
                           value: default/chartsnap-kong-proxy
-                      image: kong/kubernetes-ingress-controller:3.0
+                      image: kong/kubernetes-ingress-controller:3.1
                       imagePullPolicy: IfNotPresent
                       livenessProbe:
                         failureThreshold: 3
@@ -156,7 +156,7 @@ SnapShot = """
                           name: cmetrics
                           protocol: TCP
                         - containerPort: 10254
-                          name: status
+                          name: cstatus
                           protocol: TCP
                       readinessProbe:
                         failureThreshold: 3
@@ -237,7 +237,7 @@ SnapShot = """
                           value: \"off\"
                         - name: KONG_NGINX_DAEMON
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       lifecycle:
                         preStop:
@@ -347,7 +347,7 @@ SnapShot = """
                           value: 0.0.0.0:8100, [::]:8100
                         - name: KONG_STREAM_LISTEN
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: clear-stale-pid
                       resources: {}
@@ -404,8 +404,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -432,8 +432,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     rules:
         - apiGroups:
@@ -641,6 +641,38 @@ SnapShot = """
             - get
             - list
             - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
         - apiGroups:
             - configuration.konghq.com
           resources:
@@ -680,8 +712,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     roleRef:
         apiGroup: rbac.authorization.k8s.io
@@ -699,8 +731,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     rules:
@@ -763,8 +795,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     roleRef:
@@ -786,8 +818,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-ca-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -802,8 +834,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -824,8 +856,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-manager
         namespace: default
     spec:
@@ -851,9 +883,9 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
             enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -879,8 +911,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook
         namespace: default
     spec:
@@ -894,8 +926,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
     apiVersion: v1
     kind: ServiceAccount
@@ -904,8 +936,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
 """

build_system/charts/open-appsec-kong/ci/__snapshots__/kong-ingress-3-values.snap

@@ -8,8 +8,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validations
         namespace: default
     webhooks:
@@ -82,8 +82,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     spec:
@@ -105,9 +105,9 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
             spec:
                 automountServiceAccountToken: false
                 containers:
@@ -135,7 +135,7 @@ SnapShot = """
                           value: https://localhost:8444
                         - name: CONTROLLER_PUBLISH_SERVICE
                           value: default/chartsnap-kong-proxy
-                      image: kong/kubernetes-ingress-controller:3.0
+                      image: kong/kubernetes-ingress-controller:3.1
                       imagePullPolicy: IfNotPresent
                       livenessProbe:
                         failureThreshold: 3
@@ -156,7 +156,7 @@ SnapShot = """
                           name: cmetrics
                           protocol: TCP
                         - containerPort: 10254
-                          name: status
+                          name: cstatus
                           protocol: TCP
                       readinessProbe:
                         failureThreshold: 3
@@ -237,7 +237,7 @@ SnapShot = """
                           value: \"off\"
                         - name: KONG_NGINX_DAEMON
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       lifecycle:
                         preStop:
@@ -347,7 +347,7 @@ SnapShot = """
                           value: 0.0.0.0:8100, [::]:8100
                         - name: KONG_STREAM_LISTEN
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: clear-stale-pid
                       resources: {}
@@ -404,8 +404,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -428,8 +428,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     rules:
         - apiGroups:
@@ -637,6 +637,38 @@ SnapShot = """
             - get
             - list
             - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
         - apiGroups:
             - configuration.konghq.com
           resources:
@@ -676,8 +708,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     roleRef:
         apiGroup: rbac.authorization.k8s.io
@@ -695,8 +727,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     rules:
@@ -759,8 +791,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     roleRef:
@@ -782,8 +814,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-ca-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -798,8 +830,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -811,8 +843,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-manager
         namespace: default
     spec:
@@ -838,9 +870,9 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
             enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -866,8 +898,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook
         namespace: default
     spec:
@@ -881,8 +913,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
     apiVersion: v1
     kind: ServiceAccount
@@ -891,8 +923,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
 """

build_system/charts/open-appsec-kong/ci/__snapshots__/kong-ingress-4-values.snap

@@ -8,8 +8,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validations
         namespace: default
     webhooks:
@@ -82,8 +82,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     spec:
@@ -105,9 +105,9 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
             spec:
                 automountServiceAccountToken: false
                 containers:
@@ -135,7 +135,7 @@ SnapShot = """
                           value: https://localhost:8444
                         - name: CONTROLLER_PUBLISH_SERVICE
                           value: default/chartsnap-kong-proxy
-                      image: kong/kubernetes-ingress-controller:3.0
+                      image: kong/kubernetes-ingress-controller:3.1
                       imagePullPolicy: IfNotPresent
                       livenessProbe:
                         failureThreshold: 3
@@ -156,7 +156,7 @@ SnapShot = """
                           name: cmetrics
                           protocol: TCP
                         - containerPort: 10254
-                          name: status
+                          name: cstatus
                           protocol: TCP
                       readinessProbe:
                         failureThreshold: 3
@@ -237,7 +237,7 @@ SnapShot = """
                           value: \"off\"
                         - name: KONG_NGINX_DAEMON
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       lifecycle:
                         preStop:
@@ -347,7 +347,7 @@ SnapShot = """
                           value: 0.0.0.0:8100, [::]:8100
                         - name: KONG_STREAM_LISTEN
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: clear-stale-pid
                       resources: {}
@@ -404,8 +404,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -463,8 +463,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     rules:
         - apiGroups:
@@ -672,6 +672,38 @@ SnapShot = """
             - get
             - list
             - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
         - apiGroups:
             - configuration.konghq.com
           resources:
@@ -711,8 +743,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     roleRef:
         apiGroup: rbac.authorization.k8s.io
@@ -730,8 +762,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     rules:
@@ -794,8 +826,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     roleRef:
@@ -817,8 +849,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-ca-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -833,8 +865,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -864,8 +896,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-manager
         namespace: default
     spec:
@@ -891,9 +923,9 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
             enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -919,8 +951,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook
         namespace: default
     spec:
@@ -934,8 +966,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
     apiVersion: v1
     kind: ServiceAccount
@@ -944,8 +976,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
 """

build_system/charts/open-appsec-kong/ci/__snapshots__/kong-ingress-5-3.1-rbac-values.snap

@@ -8,8 +8,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validations
         namespace: default
     webhooks:
@@ -82,8 +82,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     spec:
@@ -105,9 +105,9 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
             spec:
                 automountServiceAccountToken: false
                 containers:
@@ -158,7 +158,7 @@ SnapShot = """
                           name: cmetrics
                           protocol: TCP
                         - containerPort: 10254
-                          name: status
+                          name: cstatus
                           protocol: TCP
                       readinessProbe:
                         failureThreshold: 3
@@ -241,7 +241,7 @@ SnapShot = """
                           value: \"off\"
                         - name: KONG_NGINX_DAEMON
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       lifecycle:
                         preStop:
@@ -353,7 +353,7 @@ SnapShot = """
                           value: 0.0.0.0:8100, [::]:8100
                         - name: KONG_STREAM_LISTEN
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: clear-stale-pid
                       resources: {}
@@ -410,8 +410,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     rules:
         - apiGroups:
@@ -690,8 +690,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     roleRef:
         apiGroup: rbac.authorization.k8s.io
@@ -709,8 +709,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     rules:
@@ -773,8 +773,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     roleRef:
@@ -796,8 +796,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-ca-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -812,8 +812,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -825,8 +825,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-manager
         namespace: default
     spec:
@@ -852,9 +852,9 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
             enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -880,8 +880,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook
         namespace: default
     spec:
@@ -895,8 +895,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
     apiVersion: v1
     kind: ServiceAccount
@@ -905,8 +905,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
 """

build_system/charts/open-appsec-kong/ci/__snapshots__/proxy-appprotocol-values.snap

@@ -0,0 +1,908 @@
+[proxy-appprotocol-values]
+SnapShot = """
+- object:
+    apiVersion: admissionregistration.k8s.io/v1
+    kind: ValidatingWebhookConfiguration
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong-validations
+        namespace: default
+    webhooks:
+        - admissionReviewVersions:
+            - v1beta1
+          clientConfig:
+            caBundle: '###DYNAMIC_FIELD###'
+            service:
+                name: chartsnap-kong-validation-webhook
+                namespace: default
+          failurePolicy: Ignore
+          name: validations.kong.konghq.com
+          objectSelector:
+            matchExpressions:
+                - key: owner
+                  operator: NotIn
+                  values:
+                    - helm
+          rules:
+            - apiGroups:
+                - configuration.konghq.com
+              apiVersions:
+                - '*'
+              operations:
+                - CREATE
+                - UPDATE
+              resources:
+                - kongconsumers
+                - kongplugins
+                - kongclusterplugins
+                - kongingresses
+            - apiGroups:
+                - \"\"
+              apiVersions:
+                - v1
+              operations:
+                - CREATE
+                - UPDATE
+              resources:
+                - secrets
+                - services
+            - apiGroups:
+                - networking.k8s.io
+              apiVersions:
+                - v1
+              operations:
+                - CREATE
+                - UPDATE
+              resources:
+                - ingresses
+            - apiGroups:
+                - gateway.networking.k8s.io
+              apiVersions:
+                - v1alpha2
+                - v1beta1
+                - v1
+              operations:
+                - CREATE
+                - UPDATE
+              resources:
+                - gateways
+                - httproutes
+          sideEffects: None
+- object:
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+        labels:
+            app.kubernetes.io/component: app
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong
+        namespace: default
+    spec:
+        replicas: 1
+        selector:
+            matchLabels:
+                app.kubernetes.io/component: app
+                app.kubernetes.io/instance: chartsnap
+                app.kubernetes.io/name: kong
+        template:
+            metadata:
+                annotations:
+                    kuma.io/gateway: enabled
+                    kuma.io/service-account-token-volume: chartsnap-kong-token
+                    traffic.sidecar.istio.io/includeInboundPorts: \"\"
+                labels:
+                    app: chartsnap-kong
+                    app.kubernetes.io/component: app
+                    app.kubernetes.io/instance: chartsnap
+                    app.kubernetes.io/managed-by: Helm
+                    app.kubernetes.io/name: kong
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
+            spec:
+                automountServiceAccountToken: false
+                containers:
+                    - args: null
+                      env:
+                        - name: POD_NAME
+                          valueFrom:
+                            fieldRef:
+                                apiVersion: v1
+                                fieldPath: metadata.name
+                        - name: POD_NAMESPACE
+                          valueFrom:
+                            fieldRef:
+                                apiVersion: v1
+                                fieldPath: metadata.namespace
+                        - name: CONTROLLER_ADMISSION_WEBHOOK_LISTEN
+                          value: 0.0.0.0:8080
+                        - name: CONTROLLER_ELECTION_ID
+                          value: kong-ingress-controller-leader-kong
+                        - name: CONTROLLER_INGRESS_CLASS
+                          value: kong
+                        - name: CONTROLLER_KONG_ADMIN_TLS_SKIP_VERIFY
+                          value: \"true\"
+                        - name: CONTROLLER_KONG_ADMIN_URL
+                          value: https://localhost:8444
+                        - name: CONTROLLER_PUBLISH_SERVICE
+                          value: default/chartsnap-kong-proxy
+                      image: kong/kubernetes-ingress-controller:3.1
+                      imagePullPolicy: IfNotPresent
+                      livenessProbe:
+                        failureThreshold: 3
+                        httpGet:
+                            path: /healthz
+                            port: 10254
+                            scheme: HTTP
+                        initialDelaySeconds: 5
+                        periodSeconds: 10
+                        successThreshold: 1
+                        timeoutSeconds: 5
+                      name: ingress-controller
+                      ports:
+                        - containerPort: 8080
+                          name: webhook
+                          protocol: TCP
+                        - containerPort: 10255
+                          name: cmetrics
+                          protocol: TCP
+                        - containerPort: 10254
+                          name: cstatus
+                          protocol: TCP
+                      readinessProbe:
+                        failureThreshold: 3
+                        httpGet:
+                            path: /readyz
+                            port: 10254
+                            scheme: HTTP
+                        initialDelaySeconds: 5
+                        periodSeconds: 10
+                        successThreshold: 1
+                        timeoutSeconds: 5
+                      resources: {}
+                      securityContext:
+                        allowPrivilegeEscalation: false
+                        capabilities:
+                            drop:
+                                - ALL
+                        readOnlyRootFilesystem: true
+                        runAsNonRoot: true
+                        runAsUser: 1000
+                        seccompProfile:
+                            type: RuntimeDefault
+                      volumeMounts:
+                        - mountPath: /admission-webhook
+                          name: webhook-cert
+                          readOnly: true
+                        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+                          name: chartsnap-kong-token
+                          readOnly: true
+                    - env:
+                        - name: KONG_ADMIN_ACCESS_LOG
+                          value: /dev/stdout
+                        - name: KONG_ADMIN_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_ADMIN_GUI_ACCESS_LOG
+                          value: /dev/stdout
+                        - name: KONG_ADMIN_GUI_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_ADMIN_LISTEN
+                          value: 127.0.0.1:8444 http2 ssl, [::1]:8444 http2 ssl
+                        - name: KONG_CLUSTER_LISTEN
+                          value: \"off\"
+                        - name: KONG_DATABASE
+                          value: \"off\"
+                        - name: KONG_KIC
+                          value: \"on\"
+                        - name: KONG_LUA_PACKAGE_PATH
+                          value: /opt/?.lua;/opt/?/init.lua;;
+                        - name: KONG_NGINX_WORKER_PROCESSES
+                          value: \"2\"
+                        - name: KONG_PORTAL_API_ACCESS_LOG
+                          value: /dev/stdout
+                        - name: KONG_PORTAL_API_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_PORT_MAPS
+                          value: 80:8000, 443:8443
+                        - name: KONG_PREFIX
+                          value: /kong_prefix/
+                        - name: KONG_PROXY_ACCESS_LOG
+                          value: /dev/stdout
+                        - name: KONG_PROXY_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_PROXY_LISTEN
+                          value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2 ssl
+                        - name: KONG_PROXY_STREAM_ACCESS_LOG
+                          value: /dev/stdout basic
+                        - name: KONG_PROXY_STREAM_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_ROUTER_FLAVOR
+                          value: traditional
+                        - name: KONG_STATUS_ACCESS_LOG
+                          value: \"off\"
+                        - name: KONG_STATUS_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_STATUS_LISTEN
+                          value: 0.0.0.0:8100, [::]:8100
+                        - name: KONG_STREAM_LISTEN
+                          value: \"off\"
+                        - name: KONG_NGINX_DAEMON
+                          value: \"off\"
+                      image: kong:3.6
+                      imagePullPolicy: IfNotPresent
+                      lifecycle:
+                        preStop:
+                            exec:
+                                command:
+                                    - kong
+                                    - quit
+                                    - --wait=15
+                      livenessProbe:
+                        failureThreshold: 3
+                        httpGet:
+                            path: /status
+                            port: status
+                            scheme: HTTP
+                        initialDelaySeconds: 5
+                        periodSeconds: 10
+                        successThreshold: 1
+                        timeoutSeconds: 5
+                      name: proxy
+                      ports:
+                        - containerPort: 8000
+                          name: proxy
+                          protocol: TCP
+                        - containerPort: 8443
+                          name: proxy-tls
+                          protocol: TCP
+                        - containerPort: 8100
+                          name: status
+                          protocol: TCP
+                      readinessProbe:
+                        failureThreshold: 3
+                        httpGet:
+                            path: /status/ready
+                            port: status
+                            scheme: HTTP
+                        initialDelaySeconds: 5
+                        periodSeconds: 10
+                        successThreshold: 1
+                        timeoutSeconds: 5
+                      resources: {}
+                      securityContext:
+                        allowPrivilegeEscalation: false
+                        capabilities:
+                            drop:
+                                - ALL
+                        readOnlyRootFilesystem: true
+                        runAsNonRoot: true
+                        runAsUser: 1000
+                        seccompProfile:
+                            type: RuntimeDefault
+                      volumeMounts:
+                        - mountPath: /kong_prefix/
+                          name: chartsnap-kong-prefix-dir
+                        - mountPath: /tmp
+                          name: chartsnap-kong-tmp
+                initContainers:
+                    - command:
+                        - rm
+                        - -vrf
+                        - $KONG_PREFIX/pids
+                      env:
+                        - name: KONG_ADMIN_ACCESS_LOG
+                          value: /dev/stdout
+                        - name: KONG_ADMIN_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_ADMIN_GUI_ACCESS_LOG
+                          value: /dev/stdout
+                        - name: KONG_ADMIN_GUI_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_ADMIN_LISTEN
+                          value: 127.0.0.1:8444 http2 ssl, [::1]:8444 http2 ssl
+                        - name: KONG_CLUSTER_LISTEN
+                          value: \"off\"
+                        - name: KONG_DATABASE
+                          value: \"off\"
+                        - name: KONG_KIC
+                          value: \"on\"
+                        - name: KONG_LUA_PACKAGE_PATH
+                          value: /opt/?.lua;/opt/?/init.lua;;
+                        - name: KONG_NGINX_WORKER_PROCESSES
+                          value: \"2\"
+                        - name: KONG_PORTAL_API_ACCESS_LOG
+                          value: /dev/stdout
+                        - name: KONG_PORTAL_API_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_PORT_MAPS
+                          value: 80:8000, 443:8443
+                        - name: KONG_PREFIX
+                          value: /kong_prefix/
+                        - name: KONG_PROXY_ACCESS_LOG
+                          value: /dev/stdout
+                        - name: KONG_PROXY_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_PROXY_LISTEN
+                          value: 0.0.0.0:8000, [::]:8000, 0.0.0.0:8443 http2 ssl, [::]:8443 http2 ssl
+                        - name: KONG_PROXY_STREAM_ACCESS_LOG
+                          value: /dev/stdout basic
+                        - name: KONG_PROXY_STREAM_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_ROUTER_FLAVOR
+                          value: traditional
+                        - name: KONG_STATUS_ACCESS_LOG
+                          value: \"off\"
+                        - name: KONG_STATUS_ERROR_LOG
+                          value: /dev/stderr
+                        - name: KONG_STATUS_LISTEN
+                          value: 0.0.0.0:8100, [::]:8100
+                        - name: KONG_STREAM_LISTEN
+                          value: \"off\"
+                      image: kong:3.6
+                      imagePullPolicy: IfNotPresent
+                      name: clear-stale-pid
+                      resources: {}
+                      securityContext:
+                        allowPrivilegeEscalation: false
+                        capabilities:
+                            drop:
+                                - ALL
+                        readOnlyRootFilesystem: true
+                        runAsNonRoot: true
+                        runAsUser: 1000
+                        seccompProfile:
+                            type: RuntimeDefault
+                      volumeMounts:
+                        - mountPath: /kong_prefix/
+                          name: chartsnap-kong-prefix-dir
+                        - mountPath: /tmp
+                          name: chartsnap-kong-tmp
+                securityContext: {}
+                serviceAccountName: chartsnap-kong
+                terminationGracePeriodSeconds: 30
+                volumes:
+                    - emptyDir:
+                        sizeLimit: 256Mi
+                      name: chartsnap-kong-prefix-dir
+                    - emptyDir:
+                        sizeLimit: 1Gi
+                      name: chartsnap-kong-tmp
+                    - name: chartsnap-kong-token
+                      projected:
+                        sources:
+                            - serviceAccountToken:
+                                expirationSeconds: 3607
+                                path: token
+                            - configMap:
+                                items:
+                                    - key: ca.crt
+                                      path: ca.crt
+                                name: kube-root-ca.crt
+                            - downwardAPI:
+                                items:
+                                    - fieldRef:
+                                        apiVersion: v1
+                                        fieldPath: metadata.namespace
+                                      path: namespace
+                    - name: webhook-cert
+                      secret:
+                        secretName: chartsnap-kong-validation-webhook-keypair
+- object:
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: ClusterRole
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong
+    rules:
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongupstreampolicies
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongupstreampolicies/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongconsumergroups
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongconsumergroups/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - \"\"
+          resources:
+            - events
+          verbs:
+            - create
+            - patch
+        - apiGroups:
+            - \"\"
+          resources:
+            - nodes
+          verbs:
+            - list
+            - watch
+        - apiGroups:
+            - \"\"
+          resources:
+            - pods
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - \"\"
+          resources:
+            - secrets
+          verbs:
+            - list
+            - watch
+        - apiGroups:
+            - \"\"
+          resources:
+            - services
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - \"\"
+          resources:
+            - services/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - ingressclassparameterses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongconsumers
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongconsumers/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongingresses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongingresses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongplugins
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongplugins/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - tcpingresses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - tcpingresses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - udpingresses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - udpingresses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - extensions
+          resources:
+            - ingresses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - extensions
+          resources:
+            - ingresses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - networking.k8s.io
+          resources:
+            - ingresses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - networking.k8s.io
+          resources:
+            - ingresses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - discovery.k8s.io
+          resources:
+            - endpointslices
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongclusterplugins
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongclusterplugins/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - apiextensions.k8s.io
+          resources:
+            - customresourcedefinitions
+          verbs:
+            - list
+            - watch
+        - apiGroups:
+            - networking.k8s.io
+          resources:
+            - ingressclasses
+          verbs:
+            - get
+            - list
+            - watch
+- object:
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: ClusterRoleBinding
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong
+    roleRef:
+        apiGroup: rbac.authorization.k8s.io
+        kind: ClusterRole
+        name: chartsnap-kong
+    subjects:
+        - kind: ServiceAccount
+          name: chartsnap-kong
+          namespace: default
+- object:
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: Role
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong
+        namespace: default
+    rules:
+        - apiGroups:
+            - \"\"
+          resources:
+            - configmaps
+            - pods
+            - secrets
+            - namespaces
+          verbs:
+            - get
+        - apiGroups:
+            - \"\"
+          resourceNames:
+            - kong-ingress-controller-leader-kong-kong
+          resources:
+            - configmaps
+          verbs:
+            - get
+            - update
+        - apiGroups:
+            - \"\"
+          resources:
+            - configmaps
+          verbs:
+            - create
+        - apiGroups:
+            - \"\"
+            - coordination.k8s.io
+          resources:
+            - configmaps
+            - leases
+          verbs:
+            - get
+            - list
+            - watch
+            - create
+            - update
+            - patch
+            - delete
+        - apiGroups:
+            - \"\"
+          resources:
+            - events
+          verbs:
+            - create
+            - patch
+        - apiGroups:
+            - \"\"
+          resources:
+            - services
+          verbs:
+            - get
+- object:
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong
+        namespace: default
+    roleRef:
+        apiGroup: rbac.authorization.k8s.io
+        kind: Role
+        name: chartsnap-kong
+    subjects:
+        - kind: ServiceAccount
+          name: chartsnap-kong
+          namespace: default
+- object:
+    apiVersion: v1
+    data:
+        tls.crt: '###DYNAMIC_FIELD###'
+        tls.key: '###DYNAMIC_FIELD###'
+    kind: Secret
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong-validation-webhook-ca-keypair
+        namespace: default
+    type: kubernetes.io/tls
+- object:
+    apiVersion: v1
+    data:
+        tls.crt: '###DYNAMIC_FIELD###'
+        tls.key: '###DYNAMIC_FIELD###'
+    kind: Secret
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong-validation-webhook-keypair
+        namespace: default
+    type: kubernetes.io/tls
+- object:
+    apiVersion: v1
+    kind: Service
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong-manager
+        namespace: default
+    spec:
+        ports:
+            - name: kong-manager
+              port: 8002
+              protocol: TCP
+              targetPort: 8002
+            - name: kong-manager-tls
+              port: 8445
+              protocol: TCP
+              targetPort: 8445
+        selector:
+            app.kubernetes.io/component: app
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/name: kong
+        type: NodePort
+- object:
+    apiVersion: v1
+    kind: Service
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            enable-metrics: \"true\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong-proxy
+        namespace: default
+    spec:
+        ports:
+            - appProtocol: http
+              name: kong-proxy
+              port: 80
+              protocol: TCP
+              targetPort: 8000
+            - appProtocol: https
+              name: kong-proxy-tls
+              port: 443
+              protocol: TCP
+              targetPort: 8443
+        selector:
+            app.kubernetes.io/component: app
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/name: kong
+        type: LoadBalancer
+- object:
+    apiVersion: v1
+    kind: Service
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong-validation-webhook
+        namespace: default
+    spec:
+        ports:
+            - name: webhook
+              port: 443
+              protocol: TCP
+              targetPort: webhook
+        selector:
+            app.kubernetes.io/component: app
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+- object:
+    apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+        labels:
+            app.kubernetes.io/instance: chartsnap
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/name: kong
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
+        name: chartsnap-kong
+        namespace: default
+"""

build_system/charts/open-appsec-kong/ci/__snapshots__/service-account.snap

@@ -8,8 +8,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validations
         namespace: default
     webhooks:
@@ -82,8 +82,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     spec:
@@ -105,9 +105,9 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
             spec:
                 automountServiceAccountToken: false
                 containers:
@@ -135,7 +135,7 @@ SnapShot = """
                           value: https://localhost:8444
                         - name: CONTROLLER_PUBLISH_SERVICE
                           value: default/chartsnap-kong-proxy
-                      image: kong/kubernetes-ingress-controller:3.0
+                      image: kong/kubernetes-ingress-controller:3.1
                       imagePullPolicy: IfNotPresent
                       livenessProbe:
                         failureThreshold: 3
@@ -156,7 +156,7 @@ SnapShot = """
                           name: cmetrics
                           protocol: TCP
                         - containerPort: 10254
-                          name: status
+                          name: cstatus
                           protocol: TCP
                       readinessProbe:
                         failureThreshold: 3
@@ -237,7 +237,7 @@ SnapShot = """
                           value: \"off\"
                         - name: KONG_NGINX_DAEMON
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       lifecycle:
                         preStop:
@@ -347,7 +347,7 @@ SnapShot = """
                           value: 0.0.0.0:8100, [::]:8100
                         - name: KONG_STREAM_LISTEN
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: clear-stale-pid
                       resources: {}
@@ -404,8 +404,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     rules:
         - apiGroups:
@@ -613,6 +613,38 @@ SnapShot = """
             - get
             - list
             - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
         - apiGroups:
             - configuration.konghq.com
           resources:
@@ -652,8 +684,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     roleRef:
         apiGroup: rbac.authorization.k8s.io
@@ -671,8 +703,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     rules:
@@ -735,8 +767,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     roleRef:
@@ -758,8 +790,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-ca-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -774,8 +806,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -787,8 +819,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-manager
         namespace: default
     spec:
@@ -814,9 +846,9 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
             enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -842,8 +874,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook
         namespace: default
     spec:
@@ -857,8 +889,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
     apiVersion: v1
     kind: ServiceAccount
@@ -867,8 +899,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: my-kong-sa
         namespace: default
 """

build_system/charts/open-appsec-kong/ci/__snapshots__/single-image-default-values.snap

@@ -8,8 +8,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validations
         namespace: default
     webhooks:
@@ -82,8 +82,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     spec:
@@ -105,9 +105,9 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
             spec:
                 automountServiceAccountToken: false
                 containers:
@@ -158,7 +158,7 @@ SnapShot = """
                           name: cmetrics
                           protocol: TCP
                         - containerPort: 10254
-                          name: status
+                          name: cstatus
                           protocol: TCP
                       readinessProbe:
                         failureThreshold: 3
@@ -410,8 +410,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     rules:
         - apiGroups:
@@ -619,6 +619,38 @@ SnapShot = """
             - get
             - list
             - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
         - apiGroups:
             - configuration.konghq.com
           resources:
@@ -658,8 +690,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     roleRef:
         apiGroup: rbac.authorization.k8s.io
@@ -677,8 +709,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     rules:
@@ -741,8 +773,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     roleRef:
@@ -764,8 +796,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-ca-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -780,8 +812,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -793,8 +825,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-manager
         namespace: default
     spec:
@@ -820,9 +852,9 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
             enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -848,8 +880,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook
         namespace: default
     spec:
@@ -863,8 +895,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
     apiVersion: v1
     kind: ServiceAccount
@@ -873,8 +905,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
 """

build_system/charts/open-appsec-kong/ci/__snapshots__/test-enterprise-version-3.4.0.0-values.snap

@@ -9,8 +9,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     spec:
@@ -32,9 +32,9 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
             spec:
                 automountServiceAccountToken: false
                 containers:
@@ -249,8 +249,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-manager
         namespace: default
     spec:
@@ -276,9 +276,9 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
             enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -304,8 +304,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
 """

build_system/charts/open-appsec-kong/ci/__snapshots__/test1-values.snap

@@ -8,8 +8,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validations
         namespace: default
     webhooks:
@@ -82,8 +82,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     spec:
@@ -104,10 +104,10 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
                     environment: test
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
             spec:
                 automountServiceAccountToken: false
                 containers:
@@ -139,7 +139,7 @@ SnapShot = """
                           value: https://localhost:8444
                         - name: CONTROLLER_PUBLISH_SERVICE
                           value: default/chartsnap-kong-proxy
-                      image: kong/kubernetes-ingress-controller:3.0
+                      image: kong/kubernetes-ingress-controller:3.1
                       imagePullPolicy: IfNotPresent
                       livenessProbe:
                         failureThreshold: 3
@@ -160,7 +160,7 @@ SnapShot = """
                           name: cmetrics
                           protocol: TCP
                         - containerPort: 10254
-                          name: status
+                          name: cstatus
                           protocol: TCP
                       readinessProbe:
                         failureThreshold: 3
@@ -252,7 +252,7 @@ SnapShot = """
                           value: \"off\"
                         - name: KONG_NGINX_DAEMON
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       lifecycle:
                         preStop:
@@ -370,7 +370,7 @@ SnapShot = """
                           value: 0.0.0.0:8100, [::]:8100
                         - name: KONG_STREAM_LISTEN
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: clear-stale-pid
                       resources: {}
@@ -447,8 +447,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     spec:
@@ -473,8 +473,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -497,8 +497,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     rules:
         - apiGroups:
@@ -706,6 +706,38 @@ SnapShot = """
             - get
             - list
             - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
         - apiGroups:
             - configuration.konghq.com
           resources:
@@ -745,8 +777,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     roleRef:
         apiGroup: rbac.authorization.k8s.io
@@ -764,8 +796,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     rules:
@@ -828,8 +860,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     roleRef:
@@ -851,8 +883,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-ca-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -867,8 +899,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -880,8 +912,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-manager
         namespace: default
     spec:
@@ -907,9 +939,9 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
             enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -935,8 +967,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook
         namespace: default
     spec:
@@ -950,8 +982,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
     apiVersion: v1
     kind: ServiceAccount
@@ -960,8 +992,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
 """

build_system/charts/open-appsec-kong/ci/__snapshots__/test2-values.snap

@@ -8,8 +8,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validations
         namespace: default
     webhooks:
@@ -83,8 +83,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     spec:
@@ -111,9 +111,9 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
             spec:
                 automountServiceAccountToken: false
                 containers:
@@ -150,7 +150,7 @@ SnapShot = """
                       envFrom:
                         - configMapRef:
                             name: env-config
-                      image: kong/kubernetes-ingress-controller:3.0
+                      image: kong/kubernetes-ingress-controller:3.1
                       imagePullPolicy: IfNotPresent
                       livenessProbe:
                         failureThreshold: 3
@@ -171,7 +171,7 @@ SnapShot = """
                           name: cmetrics
                           protocol: TCP
                         - containerPort: 10254
-                          name: status
+                          name: cstatus
                           protocol: TCP
                       readinessProbe:
                         failureThreshold: 3
@@ -270,7 +270,7 @@ SnapShot = """
                       envFrom:
                         - configMapRef:
                             name: env-config
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       lifecycle:
                         preStop:
@@ -404,7 +404,7 @@ SnapShot = """
                       envFrom:
                         - configMapRef:
                             name: env-config
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: clear-stale-pid
                       resources: {}
@@ -507,7 +507,7 @@ SnapShot = """
                       envFrom:
                         - configMapRef:
                             name: env-config
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: wait-for-db
                       resources: {}
@@ -724,8 +724,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-init-migrations
         namespace: default
     spec:
@@ -740,8 +740,8 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
                 name: kong-init-migrations
             spec:
                 automountServiceAccountToken: false
@@ -819,7 +819,7 @@ SnapShot = """
                       envFrom:
                         - configMapRef:
                             name: env-config
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: kong-migrations
                       resources: {}
@@ -924,7 +924,7 @@ SnapShot = """
                       envFrom:
                         - configMapRef:
                             name: env-config
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: wait-for-postgres
                       resources: {}
@@ -977,8 +977,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-post-upgrade-migrations
         namespace: default
     spec:
@@ -993,8 +993,8 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
                 name: kong-post-upgrade-migrations
             spec:
                 automountServiceAccountToken: false
@@ -1072,7 +1072,7 @@ SnapShot = """
                       envFrom:
                         - configMapRef:
                             name: env-config
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: kong-post-upgrade-migrations
                       resources: {}
@@ -1177,7 +1177,7 @@ SnapShot = """
                       envFrom:
                         - configMapRef:
                             name: env-config
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: wait-for-postgres
                       resources: {}
@@ -1232,8 +1232,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-pre-upgrade-migrations
         namespace: default
     spec:
@@ -1248,8 +1248,8 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
                 name: kong-pre-upgrade-migrations
             spec:
                 automountServiceAccountToken: false
@@ -1327,7 +1327,7 @@ SnapShot = """
                       envFrom:
                         - configMapRef:
                             name: env-config
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: kong-upgrade-migrations
                       resources: {}
@@ -1432,7 +1432,7 @@ SnapShot = """
                       envFrom:
                         - configMapRef:
                             name: env-config
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: wait-for-postgres
                       resources: {}
@@ -1481,8 +1481,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -1505,10 +1505,26 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     rules:
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
         - apiGroups:
             - configuration.konghq.com
           resources:
@@ -1548,8 +1564,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     roleRef:
         apiGroup: rbac.authorization.k8s.io
@@ -1567,8 +1583,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     rules:
@@ -1631,8 +1647,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-default
         namespace: default
     rules:
@@ -1841,6 +1857,22 @@ SnapShot = """
             - get
             - list
             - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
 - object:
     apiVersion: rbac.authorization.k8s.io/v1
     kind: RoleBinding
@@ -1849,8 +1881,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     roleRef:
@@ -1869,8 +1901,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-default
         namespace: default
     roleRef:
@@ -1895,8 +1927,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-bash-wait-for-postgres
         namespace: default
 - object:
@@ -1917,8 +1949,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-ca-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -1933,8 +1965,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -1961,8 +1993,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-manager
         namespace: default
     spec:
@@ -1988,9 +2020,9 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
             enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -2024,8 +2056,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook
         namespace: default
     spec:
@@ -2039,8 +2071,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
     apiVersion: v1
     kind: Service
@@ -2099,8 +2131,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
 """

build_system/charts/open-appsec-kong/ci/__snapshots__/test3-values.snap

@@ -9,8 +9,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     spec:
@@ -33,9 +33,9 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
             spec:
                 automountServiceAccountToken: false
                 containers:
@@ -92,7 +92,7 @@ SnapShot = """
                           value: \"off\"
                         - name: KONG_NGINX_DAEMON
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       lifecycle:
                         preStop:
@@ -208,7 +208,7 @@ SnapShot = """
                           value: 0.0.0.0:8100, [::]:8100
                         - name: KONG_STREAM_LISTEN
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: clear-stale-pid
                       resources: {}
@@ -295,8 +295,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-custom-dbless-config
         namespace: default
 - object:
@@ -307,8 +307,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-manager
         namespace: default
     spec:
@@ -334,9 +334,9 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
             enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -362,8 +362,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
 """

build_system/charts/open-appsec-kong/ci/__snapshots__/test4-values.snap

@@ -9,8 +9,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     spec:
@@ -33,9 +33,9 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
             spec:
                 automountServiceAccountToken: false
                 containers:
@@ -92,7 +92,7 @@ SnapShot = """
                           value: 0.0.0.0:9000, [::]:9000, 0.0.0.0:9001 ssl, [::]:9001 ssl
                         - name: KONG_NGINX_DAEMON
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       lifecycle:
                         preStop:
@@ -212,7 +212,7 @@ SnapShot = """
                           value: 0.0.0.0:8100, [::]:8100
                         - name: KONG_STREAM_LISTEN
                           value: 0.0.0.0:9000, [::]:9000, 0.0.0.0:9001 ssl, [::]:9001 ssl
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: clear-stale-pid
                       resources: {}
@@ -271,8 +271,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -304,8 +304,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-custom-dbless-config
         namespace: default
 - object:
@@ -316,8 +316,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-manager
         namespace: default
     spec:
@@ -343,9 +343,9 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
             enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -379,8 +379,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
 """

build_system/charts/open-appsec-kong/ci/__snapshots__/test5-values.snap

@@ -8,8 +8,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validations
         namespace: default
     webhooks:
@@ -82,8 +82,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     spec:
@@ -110,9 +110,9 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
-                    version: \"3.5\"
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
+                    version: \"3.6\"
             spec:
                 automountServiceAccountToken: false
                 containers:
@@ -142,7 +142,7 @@ SnapShot = """
                           value: https://localhost:8444
                         - name: CONTROLLER_PUBLISH_SERVICE
                           value: default/chartsnap-kong-proxy
-                      image: kong/kubernetes-ingress-controller:3.0
+                      image: kong/kubernetes-ingress-controller:3.1
                       imagePullPolicy: IfNotPresent
                       livenessProbe:
                         failureThreshold: 3
@@ -163,7 +163,7 @@ SnapShot = """
                           name: cmetrics
                           protocol: TCP
                         - containerPort: 10254
-                          name: status
+                          name: cstatus
                           protocol: TCP
                       readinessProbe:
                         failureThreshold: 3
@@ -261,7 +261,7 @@ SnapShot = """
                           value: \"off\"
                         - name: KONG_NGINX_DAEMON
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       lifecycle:
                         preStop:
@@ -388,7 +388,7 @@ SnapShot = """
                           value: 0.0.0.0:8100, [::]:8100
                         - name: KONG_STREAM_LISTEN
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: clear-stale-pid
                       resources: {}
@@ -477,7 +477,7 @@ SnapShot = """
                           value: 0.0.0.0:8100, [::]:8100
                         - name: KONG_STREAM_LISTEN
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: wait-for-db
                       resources: {}
@@ -694,8 +694,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-init-migrations
         namespace: default
     spec:
@@ -710,8 +710,8 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
                 name: kong-init-migrations
             spec:
                 automountServiceAccountToken: false
@@ -788,7 +788,7 @@ SnapShot = """
                           value: \"off\"
                         - name: KONG_NGINX_DAEMON
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: kong-migrations
                       resources: {}
@@ -879,7 +879,7 @@ SnapShot = """
                           value: \"off\"
                         - name: KONG_NGINX_DAEMON
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: wait-for-postgres
                       resources: {}
@@ -932,8 +932,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-post-upgrade-migrations
         namespace: default
     spec:
@@ -948,8 +948,8 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
                 name: kong-post-upgrade-migrations
             spec:
                 automountServiceAccountToken: false
@@ -1026,7 +1026,7 @@ SnapShot = """
                           value: \"off\"
                         - name: KONG_NGINX_DAEMON
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: kong-post-upgrade-migrations
                       resources: {}
@@ -1117,7 +1117,7 @@ SnapShot = """
                           value: \"off\"
                         - name: KONG_NGINX_DAEMON
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: wait-for-postgres
                       resources: {}
@@ -1172,8 +1172,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-pre-upgrade-migrations
         namespace: default
     spec:
@@ -1188,8 +1188,8 @@ SnapShot = """
                     app.kubernetes.io/instance: chartsnap
                     app.kubernetes.io/managed-by: Helm
                     app.kubernetes.io/name: kong
-                    app.kubernetes.io/version: \"3.5\"
-                    helm.sh/chart: kong-2.36.0
+                    app.kubernetes.io/version: \"3.6\"
+                    helm.sh/chart: kong-2.38.0
                 name: kong-pre-upgrade-migrations
             spec:
                 automountServiceAccountToken: false
@@ -1266,7 +1266,7 @@ SnapShot = """
                           value: \"off\"
                         - name: KONG_NGINX_DAEMON
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: kong-upgrade-migrations
                       resources: {}
@@ -1357,7 +1357,7 @@ SnapShot = """
                           value: \"off\"
                         - name: KONG_NGINX_DAEMON
                           value: \"off\"
-                      image: kong:3.5
+                      image: kong:3.6
                       imagePullPolicy: IfNotPresent
                       name: wait-for-postgres
                       resources: {}
@@ -1406,8 +1406,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -1430,8 +1430,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     rules:
         - apiGroups:
@@ -1639,6 +1639,38 @@ SnapShot = """
             - get
             - list
             - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - konglicenses/status
+          verbs:
+            - get
+            - patch
+            - update
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults
+          verbs:
+            - get
+            - list
+            - watch
+        - apiGroups:
+            - configuration.konghq.com
+          resources:
+            - kongvaults/status
+          verbs:
+            - get
+            - patch
+            - update
         - apiGroups:
             - configuration.konghq.com
           resources:
@@ -1678,8 +1710,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
     roleRef:
         apiGroup: rbac.authorization.k8s.io
@@ -1697,8 +1729,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     rules:
@@ -1761,8 +1793,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
     roleRef:
@@ -1787,8 +1819,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-bash-wait-for-postgres
         namespace: default
 - object:
@@ -1802,8 +1834,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-ca-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -1818,8 +1850,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook-keypair
         namespace: default
     type: kubernetes.io/tls
@@ -1846,8 +1878,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-manager
         namespace: default
     spec:
@@ -1873,9 +1905,9 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
+            app.kubernetes.io/version: \"3.6\"
             enable-metrics: \"true\"
-            helm.sh/chart: kong-2.36.0
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-proxy
         namespace: default
     spec:
@@ -1901,8 +1933,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong-validation-webhook
         namespace: default
     spec:
@@ -1916,8 +1948,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
 - object:
     apiVersion: v1
     kind: Service
@@ -1976,8 +2008,8 @@ SnapShot = """
             app.kubernetes.io/instance: chartsnap
             app.kubernetes.io/managed-by: Helm
             app.kubernetes.io/name: kong
-            app.kubernetes.io/version: \"3.5\"
-            helm.sh/chart: kong-2.36.0
+            app.kubernetes.io/version: \"3.6\"
+            helm.sh/chart: kong-2.38.0
         name: chartsnap-kong
         namespace: default
 """

build_system/charts/open-appsec-kong/ci/proxy-appprotocol-values.yaml

@@ -0,0 +1,7 @@
+# This values test that the `proxy.*.appProtocol` can be set to a custom value.
+
+proxy:
+  http:
+    appProtocol: "http"
+  tls:
+    appProtocol: "https"

build_system/charts/open-appsec-kong/templates/_helpers.tpl

@@ -213,6 +213,9 @@ spec:
   - name: kong-{{ .serviceName }}
     port: {{ .http.servicePort }}
     targetPort: {{ .http.containerPort }}
+  {{- if .http.appProtocol }}
+    appProtocol: {{ .http.appProtocol }}
+  {{- end }}
   {{- if (and (or (eq .type "LoadBalancer") (eq .type "NodePort")) (not (empty .http.nodePort))) }}
     nodePort: {{ .http.nodePort }}
   {{- end }}
@@ -223,6 +226,9 @@ spec:
   - name: kong-{{ .serviceName }}-tls
     port: {{ .tls.servicePort }}
     targetPort: {{ .tls.overrideServiceTargetPort | default .tls.containerPort }}
+  {{- if .tls.appProtocol }}
+    appProtocol: {{ .tls.appProtocol }}
+  {{- end }}
   {{- if (and (or (eq .type "LoadBalancer") (eq .type "NodePort")) (not (empty .tls.nodePort))) }}
     nodePort: {{ .tls.nodePort }}
   {{- end }}
@@ -890,7 +896,7 @@ The name of the Service which will be used by the controller to update the Ingre
     containerPort: 10255
     protocol: TCP
   {{- end }}
-  - name: status
+  - name: cstatus
     containerPort: 10254
     protocol: TCP
   env:

build_system/charts/open-appsec-kong/templates/default-policy.yaml

@@ -34,7 +34,7 @@ spec:
     http-headers: false
     request-body: false
   log-destination:
-    cloud: false
+    cloud: true
     stdout:
       format: json-formatted
 ---

build_system/charts/open-appsec-kong/values.yaml

@@ -130,7 +130,7 @@ extraLabels: {}
 # Specify Kong's Docker image and repository details here
 image:
   repository: kong
-  tag: "3.5"
+  tag: "3.6"
   # Kong Enterprise
   # repository: kong/kong-gateway
   # tag: "3.5"
@@ -317,6 +317,10 @@ proxy:
     parameters:
     - http2
 
+    # Specify the Service's TLS port's appProtocol. This can be useful when integrating with
+    # external load balancers that require the `appProtocol` field to be set (e.g. GCP).
+    appProtocol: ""
+
   # Define stream (TCP) listen
   # To enable, remove "[]", uncomment the section below, and select your desired
   # ports and parameters. Listens are dynamically named after their containerPort,
@@ -525,7 +529,7 @@ ingressController:
   enabled: true
   image:
     repository: kong/kubernetes-ingress-controller
-    tag: "3.0"
+    tag: "3.1"
     # Optionally set a semantic version for version-gated features. This can normally
     # be left unset. You only need to set this if your tag is not a semver string,
     # such as when you are using a "next" tag. Set this to the effective semantic
@@ -1255,7 +1259,7 @@ appsec:
     #registry:
     repository: ghcr.io/openappsec
     image: "agent"
-    tag: "1.1.6"
+    tag: "1.1.8"
     pullPolicy: Always
 
     securityContext:
@@ -1269,7 +1273,7 @@ appsec:
   kong:
     image:
       repository: "ghcr.io/openappsec/kong-attachment"
-      tag: "1.1.6"
+      tag: "1.1.8"
   configMapName: appsec-settings-configmap
   configMapContent:
     crowdsec:

build_system/docker/CMakeLists.txt

@@ -1,4 +1,4 @@
-install(FILES Dockerfile entry.sh install-cp-agent-intelligence-service.sh install-cp-crowdsec-aux.sh DESTINATION .)
+install(FILES Dockerfile entry.sh install-cp-agent-intelligence-service.sh install-cp-crowdsec-aux.sh self_managed_openappsec_manifest.json DESTINATION .)
 
 add_custom_command(
     OUTPUT ${CMAKE_INSTALL_PREFIX}/agent-docker.img

build_system/docker/Dockerfile

@@ -1,5 +1,7 @@
 FROM alpine
 
+ENV OPENAPPSEC_NANO_AGENT=TRUE
+
 RUN apk add --no-cache -u busybox
 RUN apk add --no-cache -u zlib
 RUN apk add --no-cache bash
@@ -11,8 +13,12 @@ RUN apk add --no-cache libunwind
 RUN apk add --no-cache gdb
 RUN apk add --no-cache libxml2
 RUN apk add --no-cache pcre2
+RUN apk add --no-cache ca-certificates
 RUN apk add --update coreutils
 
+
+COPY self_managed_openappsec_manifest.json /tmp/self_managed_openappsec_manifest.json
+
 COPY install*.sh /nano-service-installers/
 COPY entry.sh /entry.sh
 

build_system/docker/entry.sh

@@ -6,18 +6,40 @@ HTTP_TRANSACTION_HANDLER_SERVICE="install-cp-nano-service-http-transaction-handl
 ATTACHMENT_REGISTRATION_SERVICE="install-cp-nano-attachment-registration-manager.sh"
 ORCHESTRATION_INSTALLATION_SCRIPT="install-cp-nano-agent.sh"
 CACHE_INSTALLATION_SCRIPT="install-cp-nano-agent-cache.sh"
+PROMETHEUS_INSTALLATION_SCRIPT="install-cp-nano-service-prometheus.sh"
+NGINX_CENTRAL_MANAGER_INSTALLATION_SCRIPT="install-cp-nano-central-nginx-manager.sh"
 
 var_fog_address=
 var_proxy=
 var_mode=
 var_token=
+var_ignore=
 init=
+active_watchdog_pid=
+
+cleanup() {
+    local signal="$1"
+    echo "[$(date '+%Y-%m-%d %H:%M:%S')] Signal ${signal} was received, exiting gracefully..." >&2
+    if [ -n "${active_watchdog_pid}" ] && ps -p ${active_watchdog_pid} > /dev/null 2>&1; then
+        kill -TERM ${active_watchdog_pid} 2>/dev/null || true
+        wait ${active_watchdog_pid} 2>/dev/null || true
+    fi
+    echo "Cleanup completed. Exiting now." >&2
+    exit 0
+}
+
+trap 'cleanup SIGTERM' SIGTERM
+trap 'cleanup SIGINT' SIGINT
 
 if [ ! -f /nano-service-installers/$ORCHESTRATION_INSTALLATION_SCRIPT ]; then
     echo "Error: agent installation package doesn't exist."
     exit 1
 fi
 
+if [ -z $1 ]; then
+    var_mode="--hybrid_mode"
+fi
+
 while true; do
     if [ -z "$1" ]; then
         break
@@ -27,24 +49,30 @@ while true; do
     elif [ "$1" == "--proxy" ]; then
         shift
         var_proxy="$1"
-    elif [ "$1" == "--hybrid-mode" ]; then
+    elif [ "$1" == "--hybrid-mode" ] || [ "$1" == "--standalone" ]; then
         var_mode="--hybrid_mode"
+    elif [ "$1" == "--no-upgrade" ]; then
+        var_ignore="--ignore all"
     elif [ "$1" == "--token" ]; then
         shift
         var_token="$1"
-    elif [ "$1" == "--standalone" ]; then
-        var_mode="--hybrid_mode"
-        var_token="cp-3fb5c718-5e39-47e6-8d5e-99b4bc5660b74b4b7fc8-5312-451d-a763-aaf7872703c0"
     fi
     shift
 done
 
-if [ -z $var_token ]; then
-    echo "Error: Token was not provided as input argument."
-    exit 1
+if [ -z $var_token ] && [ $var_mode != "--hybrid_mode" ]; then
+    var_token=$(env | grep 'AGENT_TOKEN=' | cut -d'=' -f2-)
+    if  [ -z $var_token ]; then
+        echo "Error: Token was not provided as input argument."
+        exit 1
+    fi
 fi
 
-orchestration_service_installation_flags="--token $var_token --container_mode --skip_registration"
+orchestration_service_installation_flags="--container_mode --skip_registration"
+if [ ! -z $var_token ]; then
+    export AGENT_TOKEN="$var_token"
+    orchestration_service_installation_flags="$orchestration_service_installation_flags --token $var_token"
+fi
 if [ ! -z $var_fog_address ]; then
     orchestration_service_installation_flags="$orchestration_service_installation_flags --fog $var_fog_address"
 fi
@@ -55,6 +83,9 @@ fi
 if [ ! -z $var_mode ]; then
     orchestration_service_installation_flags="$orchestration_service_installation_flags $var_mode"
 fi
+if [ ! -z "$var_ignore" ]; then
+    orchestration_service_installation_flags="$orchestration_service_installation_flags $var_ignore"
+fi
 
 
 /nano-service-installers/$ORCHESTRATION_INSTALLATION_SCRIPT --install $orchestration_service_installation_flags
@@ -67,6 +98,14 @@ fi
 /nano-service-installers/$CACHE_INSTALLATION_SCRIPT --install
 /nano-service-installers/$HTTP_TRANSACTION_HANDLER_SERVICE --install
 
+if [ "$PROMETHEUS" == "true" ]; then
+    /nano-service-installers/$PROMETHEUS_INSTALLATION_SCRIPT --install
+fi
+
+if [ "$CENTRAL_NGINX_MANAGER" == "true" ]; then
+    /nano-service-installers/$NGINX_CENTRAL_MANAGER_INSTALLATION_SCRIPT --install
+fi
+
 if [ "$CROWDSEC_ENABLED" == "true" ]; then
     /nano-service-installers/$INTELLIGENCE_INSTALLATION_SCRIPT --install
     /nano-service-installers/$CROWDSEC_INSTALLATION_SCRIPT --install
@@ -79,25 +118,16 @@ if [ -f "$FILE" ]; then
 fi
 
 touch /etc/cp/watchdog/wd.startup
+/etc/cp/watchdog/cp-nano-watchdog >/dev/null 2>&1 &
+active_watchdog_pid=$!
 while true; do
-    if [ -z "$init" ]; then
-        init=true
-        /etc/cp/watchdog/cp-nano-watchdog >/dev/null 2>&1 &
-        sleep 5
-        active_watchdog_pid=$(pgrep -f -x -o "/bin/bash /etc/cp/watchdog/cp-nano-watchdog")
-    fi
-
-    current_watchdog_pid=$(pgrep -f -x -o "/bin/bash /etc/cp/watchdog/cp-nano-watchdog")
-    if [ ! -f /tmp/restart_watchdog ] && [ "$current_watchdog_pid" != "$active_watchdog_pid" ]; then
-        echo "Error: Watchdog exited abnormally"
-        exit 1
-    elif [ -f /tmp/restart_watchdog ]; then
+    if [ -f /tmp/restart_watchdog ]; then
         rm -f /tmp/restart_watchdog
-        kill -9 "$(pgrep -f -x -o "/bin/bash /etc/cp/watchdog/cp-nano-watchdog")"
-        /etc/cp/watchdog/cp-nano-watchdog >/dev/null 2>&1 &
-        sleep 5
-        active_watchdog_pid=$(pgrep -f -x -o "/bin/bash /etc/cp/watchdog/cp-nano-watchdog")
+        kill -9 ${active_watchdog_pid}
+    fi
+    if [ ! "$(ps -f | grep cp-nano-watchdog | grep ${active_watchdog_pid})" ]; then
+        /etc/cp/watchdog/cp-nano-watchdog >/dev/null 2>&1 &
+        active_watchdog_pid=$!
     fi
-
     sleep 5
 done

components/CMakeLists.txt

@@ -1,11 +1,10 @@
-add_subdirectory(report_messaging)
 add_subdirectory(http_manager)
 add_subdirectory(signal_handler)
 add_subdirectory(gradual_deployment)
 add_subdirectory(packet)
 add_subdirectory(pending_key)
-add_subdirectory(health_check_manager)
 
 add_subdirectory(utils)
 add_subdirectory(attachment-intakers)
 add_subdirectory(security_apps)
+add_subdirectory(nginx_message_reader)

components/attachment-intakers/attachment_registrator/attachment_registrator.cc

@@ -39,6 +39,8 @@ USE_DEBUG_FLAG(D_ATTACHMENT_REGISTRATION);
 
 using namespace std;
 
+static const AlertInfo alert(AlertTeam::CORE, "attachment registrator");
+
 class AttachmentRegistrator::Impl
 {
 public:
@@ -163,7 +165,7 @@ private:
                 break;
             }
             default:
-                dbgAssert(false) << "Unsupported Attachment " << static_cast<int>(type);
+                dbgAssert(false) << alert << "Unsupported Attachment " << static_cast<int>(type);
         }
 
         if (!family_id.empty()) handler_path << family_id << "_";
@@ -175,7 +177,9 @@ private:
     string
     genRegCommand(const string &family_id, const uint num_of_members, const AttachmentType type) const
     {
-        dbgAssert(num_of_members > 0) << "Failed to generate a registration command for an empty group of attachments";
+        dbgAssert(num_of_members > 0)
+            << alert
+            << "Failed to generate a registration command for an empty group of attachments";
 
         static const string registration_format = "/etc/cp/watchdog/cp-nano-watchdog --register ";
         stringstream registration_command;
@@ -187,7 +191,7 @@ private:
                 break;
             }
             default:
-                dbgAssert(false) << "Unsupported Attachment " << static_cast<int>(type);
+                dbgAssert(false) << alert << "Unsupported Attachment " << static_cast<int>(type);
         }
 
         if (!family_id.empty()) registration_command << " --family " << family_id;
@@ -265,7 +269,7 @@ private:
             return -1;
         }
 
-        dbgAssert(new_socket.unpack() > 0) << "Generated socket is OK yet negative";
+        dbgAssert(new_socket.unpack() > 0) << alert << "Generated socket is OK yet negative";
         return new_socket.unpack();
     }
 
@@ -281,7 +285,7 @@ private:
         }
 
         I_Socket::socketFd client_socket = accepted_socket.unpack();
-        dbgAssert(client_socket > 0) << "Generated client socket is OK yet negative";
+        dbgAssert(client_socket > 0) << alert << "Generated client socket is OK yet negative";
         auto close_socket_on_exit = make_scope_exit([&]() { i_socket->closeSocket(client_socket); });
 
         Maybe<uint8_t> attachment_id = readNumericParam(client_socket);
@@ -375,7 +379,7 @@ private:
         }
 
         I_Socket::socketFd client_socket = accepted_socket.unpack();
-        dbgAssert(client_socket > 0) << "Generated client socket is OK yet negative";
+        dbgAssert(client_socket > 0) << alert << "Generated client socket is OK yet negative";
         auto close_socket_on_exit = make_scope_exit([&]() { i_socket->closeSocket(client_socket); });
 
         Maybe<AttachmentType> attachment_type = readAttachmentType(client_socket);

components/attachment-intakers/nginx_attachment/nginx_attachment.cc

@@ -31,10 +31,12 @@
 #include <stdarg.h>
 
 #include <boost/range/iterator_range.hpp>
+#include <boost/algorithm/string.hpp>
 #include <boost/regex.hpp>
 
 #include "nginx_attachment_config.h"
 #include "nginx_attachment_opaque.h"
+#include "generic_rulebase/evaluators/trigger_eval.h"
 #include "nginx_parser.h"
 #include "i_instance_awareness.h"
 #include "common.h"
@@ -76,6 +78,7 @@ using namespace std;
 using ChunkType = ngx_http_chunk_type_e;
 
 static const uint32_t corrupted_session_id = CORRUPTED_SESSION_ID;
+static const AlertInfo alert(AlertTeam::CORE, "nginx attachment");
 
 class FailopenModeListener : public Listener<FailopenModeEvent>
 {
@@ -128,6 +131,7 @@ class NginxAttachment::Impl
     Singleton::Provide<I_StaticResourcesHandler>::From<NginxAttachment>
 {
     static constexpr auto INSPECT = ngx_http_cp_verdict_e::TRAFFIC_VERDICT_INSPECT;
+    static constexpr auto LIMIT_RESPONSE_HEADERS = ngx_http_cp_verdict_e::LIMIT_RESPONSE_HEADERS;
     static constexpr auto ACCEPT = ngx_http_cp_verdict_e::TRAFFIC_VERDICT_ACCEPT;
     static constexpr auto DROP = ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP;
     static constexpr auto INJECT = ngx_http_cp_verdict_e::TRAFFIC_VERDICT_INJECT;
@@ -259,6 +263,22 @@ public:
             );
         }
 
+        const char* ignored_headers_env = getenv("SAAS_IGNORED_UPSTREAM_HEADERS");
+        if (ignored_headers_env) {
+            string ignored_headers_str = ignored_headers_env;
+            ignored_headers_str = NGEN::Strings::trim(ignored_headers_str);
+
+            if (!ignored_headers_str.empty()) {
+                dbgInfo(D_HTTP_MANAGER)
+                    << "Ignoring SAAS_IGNORED_UPSTREAM_HEADERS environment variable: "
+                    << ignored_headers_str;
+
+                vector<string> ignored_headers_vec;
+                boost::split(ignored_headers_vec, ignored_headers_str, boost::is_any_of(";"));
+                for (const string &header : ignored_headers_vec) ignored_headers.insert(header);
+            }
+        }
+
         dbgInfo(D_NGINX_ATTACHMENT) << "Successfully initialized NGINX Attachment";
     }
 
@@ -410,7 +430,10 @@ private:
     bool
     registerAttachmentProcess(uint32_t nginx_user_id, uint32_t nginx_group_id, I_Socket::socketFd new_socket)
     {
-        dbgAssert(server_sock > 0) << "Registration attempt occurred while registration socket is uninitialized";
+        dbgAssert(server_sock > 0)
+        << alert
+        << "Registration attempt occurred while registration socket is uninitialized";
+
 #ifdef FAILURE_TEST
         bool did_fail_on_purpose = false;
 #endif
@@ -802,10 +825,10 @@ private:
         case ChunkType::HOLD_DATA:
             return "HOLD_DATA";
         case ChunkType::COUNT:
-            dbgAssert(false) << "Invalid 'COUNT' ChunkType";
+            dbgAssert(false) << alert << "Invalid 'COUNT' ChunkType";
             return "";
         }
-        dbgAssert(false) << "ChunkType was not handled by the switch case";
+        dbgAssert(false) << alert << "ChunkType was not handled by the switch case";
         return "";
     }
 
@@ -1030,7 +1053,11 @@ private:
             case ChunkType::REQUEST_START:
                 return handleStartTransaction(data, opaque);
             case ChunkType::REQUEST_HEADER:
-                return handleMultiModifiableChunks(NginxParser::parseRequestHeaders(data), "request header", true);
+                return handleMultiModifiableChunks(
+                    NginxParser::parseRequestHeaders(data, ignored_headers),
+                    "request header",
+                    true
+                );
             case ChunkType::REQUEST_BODY:
                 return handleModifiableChunk(NginxParser::parseRequestBody(data), "request body", true);
             case ChunkType::REQUEST_END: {
@@ -1121,17 +1148,29 @@ private:
     handleCustomWebResponse(
         SharedMemoryIPC *ipc,
         vector<const char *> &verdict_data,
-        vector<uint16_t> &verdict_data_sizes)
+        vector<uint16_t> &verdict_data_sizes,
+        string web_user_response_id)
     {
         ngx_http_cp_web_response_data_t web_response_data;
-
+        ScopedContext ctx;
+        if (web_user_response_id != "") {
+            dbgTrace(D_NGINX_ATTACHMENT)
+            << "web user response ID registered in contex: "
+            << web_user_response_id;
+            set<string> triggers_set{web_user_response_id};
+            ctx.registerValue<set<GenericConfigId>>(TriggerMatcher::ctx_key, triggers_set);
+        }
         WebTriggerConf web_trigger_conf = getConfigurationWithDefault<WebTriggerConf>(
             WebTriggerConf::default_trigger_conf,
             "rulebase",
             "webUserResponse"
         );
 
+        bool remove_event_id_param =
+            getProfileAgentSettingWithDefault<string>("false", "nginxAttachment.removeRedirectEventId") == "true";
+
         string uuid;
+        string redirectUrl;
         if (i_transaction_table->hasState<NginxAttachmentOpaque>()) {
             NginxAttachmentOpaque &opaque = i_transaction_table->getState<NginxAttachmentOpaque>();
             uuid = opaque.getSessionUUID();
@@ -1141,7 +1180,12 @@ private:
         if (web_trigger_conf.getDetailsLevel() == "Redirect") {
             web_response_data.response_data.redirect_data.redirect_location_size =
                 web_trigger_conf.getRedirectURL().size();
-            web_response_data.response_data.redirect_data.add_event_id = web_trigger_conf.getAddEventId() ? 1 : 0;
+            bool add_event = web_trigger_conf.getAddEventId();
+            if (add_event && !remove_event_id_param) {
+                web_response_data.response_data.redirect_data.redirect_location_size +=
+                    strlen("?event_id=") + uuid.size();
+            }
+            web_response_data.response_data.redirect_data.add_event_id = add_event ? 1 : 0;
             web_response_data.web_repsonse_type = static_cast<uint8_t>(ngx_web_response_type_e::REDIRECT_WEB_RESPONSE);
         } else {
             web_response_data.response_data.custom_response_data.title_size =
@@ -1155,8 +1199,13 @@ private:
         verdict_data_sizes.push_back(sizeof(ngx_http_cp_web_response_data_t));
 
         if (web_trigger_conf.getDetailsLevel() == "Redirect") {
-            verdict_data.push_back(reinterpret_cast<const char *>(web_trigger_conf.getRedirectURL().data()));
-            verdict_data_sizes.push_back(web_trigger_conf.getRedirectURL().size());
+            redirectUrl = web_trigger_conf.getRedirectURL();
+            if (!remove_event_id_param && web_trigger_conf.getAddEventId()) {
+                redirectUrl += "?event-id=" + uuid;
+            }
+
+            verdict_data.push_back(reinterpret_cast<const char *>(redirectUrl.data()));
+            verdict_data_sizes.push_back(redirectUrl.size());
         } else {
             verdict_data.push_back(reinterpret_cast<const char *>(web_trigger_conf.getResponseTitle().data()));
             verdict_data_sizes.push_back(web_trigger_conf.getResponseTitle().size());
@@ -1232,7 +1281,7 @@ private:
         if (verdict.getVerdict() == DROP) {
             nginx_attachment_event.addTrafficVerdictCounter(nginxAttachmentEvent::trafficVerdict::DROP);
             verdict_to_send.modification_count = 1;
-            return handleCustomWebResponse(ipc, verdict_fragments, fragments_sizes);
+            return handleCustomWebResponse(ipc, verdict_fragments, fragments_sizes, verdict.getWebUserResponseID());
         }
 
         if (verdict.getVerdict() == ACCEPT) {
@@ -1458,11 +1507,17 @@ private:
         opaque.activateContext();
 
         FilterVerdict verdict = handleChunkedData(*chunked_data_type, inspection_data, opaque);
-
         bool is_header =
             *chunked_data_type == ChunkType::REQUEST_HEADER  ||
             *chunked_data_type == ChunkType::RESPONSE_HEADER ||
             *chunked_data_type == ChunkType::CONTENT_LENGTH;
+
+        if (verdict.getVerdict() == LIMIT_RESPONSE_HEADERS) {
+            handleVerdictResponse(verdict, attachment_ipc, transaction_data->session_id, is_header);
+            popData(attachment_ipc);
+            verdict = FilterVerdict(INSPECT);
+        }
+
         handleVerdictResponse(verdict, attachment_ipc, transaction_data->session_id, is_header);
 
         bool is_final_verdict = verdict.getVerdict() == ACCEPT ||
@@ -1575,6 +1630,8 @@ private:
                 return "INJECT";
             case INSPECT:
                 return "INSPECT";
+            case LIMIT_RESPONSE_HEADERS:
+                return "LIMIT_RESPONSE_HEADERS";
             case IRRELEVANT:
                 return "IRRELEVANT";
             case RECONF:
@@ -1582,7 +1639,7 @@ private:
             case WAIT:
                 return "WAIT";
         }
-        dbgAssert(false) << "Invalid EventVerdict enum: " << static_cast<int>(verdict.getVerdict());
+        dbgAssert(false) << alert << "Invalid EventVerdict enum: " << static_cast<int>(verdict.getVerdict());
         return string();
     }
 
@@ -1633,13 +1690,14 @@ private:
             return false;
         }
 
-        dbgAssert(sock.unpack() > 0) << "The generated server socket is OK, yet negative";
+        dbgAssert(sock.unpack() > 0) << alert << "The generated server socket is OK, yet negative";
         server_sock = sock.unpack();
 
         I_MainLoop::Routine accept_attachment_routine =
             [this] ()
             {
                 dbgAssert(inst_awareness->getUniqueID().ok())
+                    << alert
                     << "NGINX attachment Initialized without Instance Awareness";
 
                 bool did_fail_on_purpose = false;
@@ -1652,7 +1710,7 @@ private:
                     << (did_fail_on_purpose ? "Intentional Failure" : new_sock.getErr());
                     return;
                 }
-                dbgAssert(new_sock.unpack() > 0) << "The generated client socket is OK, yet negative";
+                dbgAssert(new_sock.unpack() > 0) << alert << "The generated client socket is OK, yet negative";
                 I_Socket::socketFd new_attachment_socket = new_sock.unpack();
 
                 Maybe<string> uid = getUidFromSocket(new_attachment_socket);
@@ -1698,7 +1756,7 @@ private:
                 }
             };
         mainloop->addFileRoutine(
-            I_MainLoop::RoutineType::RealTime,
+            I_MainLoop::RoutineType::System,
             server_sock,
             accept_attachment_routine,
             "Nginx Attachment registration listener",
@@ -1711,7 +1769,9 @@ private:
     Maybe<string>
     getUidFromSocket(I_Socket::socketFd new_attachment_socket)
     {
-        dbgAssert(server_sock > 0) << "Registration attempt occurred while registration socket is uninitialized";
+        dbgAssert(server_sock > 0)
+            << alert
+            << "Registration attempt occurred while registration socket is uninitialized";
 
         bool did_fail_on_purpose = false;
         DELAY_IF_NEEDED(IntentionalFailureHandler::FailureType::ReceiveDataFromSocket);
@@ -1793,6 +1853,7 @@ private:
     HttpAttachmentConfig attachment_config;
     I_MainLoop::RoutineID attachment_routine_id = 0;
     bool traffic_indicator = false;
+    unordered_set<string> ignored_headers;
 
     // Interfaces
     I_Socket *i_socket                              = nullptr;

components/attachment-intakers/nginx_attachment/nginx_attachment_config.cc

@@ -42,6 +42,7 @@ HttpAttachmentConfig::init()
     setNumOfNginxIpcElements();
     setDebugByContextValues();
     setKeepAliveIntervalMsec();
+    setRetriesForVerdict();
 }
 
 bool
@@ -202,6 +203,13 @@ HttpAttachmentConfig::setFailOpenTimeout()
         "NGINX wait thread timeout msec"
     ));
 
+    conf_data.setNumericalValue("remove_server_header", getAttachmentConf<uint>(
+        0,
+        "agent.removeServerHeader.nginxModule",
+        "HTTP manager",
+        "Response server header removal"
+    ));
+
     uint inspection_mode = getAttachmentConf<uint>(
         static_cast<uint>(ngx_http_inspection_mode_e::NON_BLOCKING_THREAD),
         "agent.inspectionMode.nginxModule",
@@ -215,6 +223,46 @@ HttpAttachmentConfig::setFailOpenTimeout()
     conf_data.setNumericalValue("nginx_inspection_mode", inspection_mode);
 }
 
+void
+HttpAttachmentConfig::setRetriesForVerdict()
+{
+    conf_data.setNumericalValue("min_retries_for_verdict", getAttachmentConf<uint>(
+        3,
+        "agent.minRetriesForVerdict.nginxModule",
+        "HTTP manager",
+        "Min retries for verdict"
+    ));
+
+    conf_data.setNumericalValue("max_retries_for_verdict", getAttachmentConf<uint>(
+        15,
+        "agent.maxRetriesForVerdict.nginxModule",
+        "HTTP manager",
+        "Max retries for verdict"
+    ));
+
+    conf_data.setNumericalValue("hold_verdict_retries", getAttachmentConf<uint>(
+        3,
+        "agent.retriesForHoldVerdict.nginxModule",
+        "HTTP manager",
+        "Retries for hold verdict"
+    ));
+
+    conf_data.setNumericalValue("hold_verdict_polling_time", getAttachmentConf<uint>(
+        1,
+        "agent.holdVerdictPollingInterval.nginxModule",
+        "HTTP manager",
+        "Hold verdict polling interval seconds"
+    ));
+
+
+    conf_data.setNumericalValue("body_size_trigger", getAttachmentConf<uint>(
+        200000,
+        "agent.reqBodySizeTrigger.nginxModule",
+        "HTTP manager",
+        "Request body size trigger"
+    ));
+}
+
 void
 HttpAttachmentConfig::setFailOpenWaitMode()
 {

components/attachment-intakers/nginx_attachment/nginx_attachment_config.h

@@ -70,6 +70,8 @@ private:
 
     void setDebugByContextValues();
 
+    void setRetriesForVerdict();
+
     WebTriggerConf web_trigger_conf;
     HttpAttachmentConfiguration conf_data;
 };

components/attachment-intakers/nginx_attachment/nginx_attachment_opaque.cc

@@ -19,12 +19,15 @@
 
 #include "config.h"
 #include "virtual_modifiers.h"
+#include "agent_core_utilities.h"
 
 using namespace std;
 using namespace boost::uuids;
 
 USE_DEBUG_FLAG(D_HTTP_MANAGER);
 
+extern bool is_keep_alive_ctx;
+
 NginxAttachmentOpaque::NginxAttachmentOpaque(HttpTransactionData _transaction_data)
         :
     TableOpaqueSerialize<NginxAttachmentOpaque>(this),
@@ -67,6 +70,12 @@ NginxAttachmentOpaque::NginxAttachmentOpaque(HttpTransactionData _transaction_da
         ctx.registerValue(HttpTransactionData::uri_query_decoded, decoded_url.substr(question_mark_location + 1));
     }
     ctx.registerValue(HttpTransactionData::uri_path_decoded, decoded_url);
+
+    // Register waf_tag from transaction data if available
+    const std::string& waf_tag = transaction_data.getWafTag();
+    if (!waf_tag.empty()) {
+        ctx.registerValue(HttpTransactionData::waf_tag_ctx, waf_tag);
+    }
 }
 
 NginxAttachmentOpaque::~NginxAttachmentOpaque()
@@ -119,3 +128,47 @@ NginxAttachmentOpaque::setSavedData(const string &name, const string &data, EnvK
     saved_data[name] = data;
     ctx.registerValue(name, data, log_ctx);
 }
+
+bool
+NginxAttachmentOpaque::setKeepAliveCtx(const string &hdr_key, const string &hdr_val)
+{
+    if (!is_keep_alive_ctx) return false;
+
+    static pair<string, string> keep_alive_hdr;
+    static bool keep_alive_hdr_initialized = false;
+
+    if (keep_alive_hdr_initialized) {
+        if (!keep_alive_hdr.first.empty() && hdr_key == keep_alive_hdr.first && hdr_val == keep_alive_hdr.second) {
+            dbgTrace(D_HTTP_MANAGER) << "Registering keep alive context";
+            ctx.registerValue("keep_alive_request_ctx", true);
+            return true;
+        }
+        return false;
+    }
+
+    const char* saas_keep_alive_hdr_name_env = getenv("SAAS_KEEP_ALIVE_HDR_NAME");
+    if (saas_keep_alive_hdr_name_env) {
+        keep_alive_hdr.first = NGEN::Strings::trim(saas_keep_alive_hdr_name_env);
+        dbgInfo(D_HTTP_MANAGER) << "Using SAAS_KEEP_ALIVE_HDR_NAME environment variable: " << keep_alive_hdr.first;
+    }
+
+    if (!keep_alive_hdr.first.empty()) {
+        const char* saas_keep_alive_hdr_value_env = getenv("SAAS_KEEP_ALIVE_HDR_VALUE");
+        if (saas_keep_alive_hdr_value_env) {
+            keep_alive_hdr.second = NGEN::Strings::trim(saas_keep_alive_hdr_value_env);
+            dbgInfo(D_HTTP_MANAGER)
+                << "Using SAAS_KEEP_ALIVE_HDR_VALUE environment variable: "
+                << keep_alive_hdr.second;
+        }
+
+        if (!keep_alive_hdr.second.empty() && (hdr_key == keep_alive_hdr.first && hdr_val == keep_alive_hdr.second)) {
+            dbgTrace(D_HTTP_MANAGER) << "Registering keep alive context";
+            ctx.registerValue("keep_alive_request_ctx", true);
+            keep_alive_hdr_initialized = true;
+            return true;
+        }
+    }
+
+    keep_alive_hdr_initialized = true;
+    return false;
+}

components/attachment-intakers/nginx_attachment/nginx_attachment_opaque.h

@@ -85,6 +85,7 @@ public:
         EnvKeyAttr::LogSection log_ctx = EnvKeyAttr::LogSection::NONE
     );
     void setApplicationState(const ApplicationState &app_state) { application_state = app_state; }
+    bool setKeepAliveCtx(const std::string &hdr_key, const std::string &hdr_val);
 
 private:
     CompressionStream       *response_compression_stream;

components/attachment-intakers/nginx_attachment/nginx_parser.cc

@@ -29,6 +29,7 @@ USE_DEBUG_FLAG(D_NGINX_ATTACHMENT_PARSER);
 Buffer NginxParser::tenant_header_key = Buffer();
 static const Buffer proxy_ip_header_key("X-Forwarded-For", 15, Buffer::MemoryType::STATIC);
 static const Buffer source_ip("sourceip", 8, Buffer::MemoryType::STATIC);
+bool is_keep_alive_ctx = getenv("SAAS_KEEP_ALIVE_HDR_NAME") != nullptr;
 
 map<Buffer, CompressionType> NginxParser::content_encodings = {
     {Buffer("identity"), CompressionType::NO_COMPRESSION},
@@ -177,37 +178,70 @@ getActivetenantAndProfile(const string &str, const string &deli = ",")
 }
 
 Maybe<vector<HttpHeader>>
-NginxParser::parseRequestHeaders(const Buffer &data)
+NginxParser::parseRequestHeaders(const Buffer &data, const unordered_set<string> &ignored_headers)
 {
-    auto parsed_headers = genHeaders(data);
-    if (!parsed_headers.ok()) return parsed_headers.passErr();
+    auto maybe_parsed_headers = genHeaders(data);
+    if (!maybe_parsed_headers.ok()) return maybe_parsed_headers.passErr();
 
     auto i_transaction_table = Singleton::Consume<I_TableSpecific<SessionID>>::by<NginxAttachment>();
+    auto parsed_headers = maybe_parsed_headers.unpack();
+    NginxAttachmentOpaque &opaque = i_transaction_table->getState<NginxAttachmentOpaque>();
 
-    for (const HttpHeader &header : *parsed_headers) {
+    if (is_keep_alive_ctx || !ignored_headers.empty()) {
+        bool is_last_header_removed = false;
+        parsed_headers.erase(
+            remove_if(
+                parsed_headers.begin(),
+                parsed_headers.end(),
+                [&opaque, &is_last_header_removed, &ignored_headers](const HttpHeader &header)
+                {
+                    string hdr_key = static_cast<string>(header.getKey());
+                    string hdr_val = static_cast<string>(header.getValue());
+                    if (
+                        opaque.setKeepAliveCtx(hdr_key, hdr_val)
+                        || ignored_headers.find(hdr_key) != ignored_headers.end()
+                    ) {
+                        dbgTrace(D_NGINX_ATTACHMENT_PARSER) << "Header was removed from headers list: " << hdr_key;
+                        if (header.isLastHeader()) {
+                            dbgTrace(D_NGINX_ATTACHMENT_PARSER) << "Last header was removed from headers list";
+                            is_last_header_removed = true;
+                        }
+                        return true;
+                    }
+                    return false;
+                }
+            ),
+            parsed_headers.end()
+        );
+        if (is_last_header_removed) {
+            dbgTrace(D_NGINX_ATTACHMENT_PARSER) << "Adjusting last header flag";
+            if (!parsed_headers.empty()) parsed_headers.back().setIsLastHeader();
+        }
+    }
+
+    for (const HttpHeader &header : parsed_headers) {
         auto source_identifiers = getConfigurationWithDefault<UsersAllIdentifiersConfig>(
             UsersAllIdentifiersConfig(),
             "rulebase",
             "usersIdentifiers"
         );
         source_identifiers.parseRequestHeaders(header);
-
-        NginxAttachmentOpaque &opaque = i_transaction_table->getState<NginxAttachmentOpaque>();
         opaque.addToSavedData(
             HttpTransactionData::req_headers,
             static_cast<string>(header.getKey()) + ": " + static_cast<string>(header.getValue()) + "\r\n"
         );
 
-        if (NginxParser::tenant_header_key == header.getKey()) {
+        const auto &header_key = header.getKey();
+        if (NginxParser::tenant_header_key == header_key) {
             dbgDebug(D_NGINX_ATTACHMENT_PARSER)
                 << "Identified active tenant header. Key: "
-                << dumpHex(header.getKey())
+                << dumpHex(header_key)
                 << ", Value: "
                 << dumpHex(header.getValue());
 
             auto active_tenant_and_profile = getActivetenantAndProfile(header.getValue());
             opaque.setSessionTenantAndProfile(active_tenant_and_profile[0], active_tenant_and_profile[1]);
-        } else if (proxy_ip_header_key == header.getKey()) {
+        } else if (proxy_ip_header_key == header_key) {
             source_identifiers.setXFFValuesToOpaqueCtx(header, UsersAllIdentifiersConfig::ExtractType::PROXYIP);
         }
     }
@@ -345,12 +379,15 @@ NginxParser::parseResponseBody(const Buffer &raw_response_body, CompressionStrea
 Maybe<CompressionType>
 NginxParser::parseContentEncoding(const vector<HttpHeader> &headers)
 {
-    static const Buffer content_encoding_header_key("Content-Encoding");
+    dbgFlow(D_NGINX_ATTACHMENT_PARSER) << "Parsing \"Content-Encoding\" header";
+    static const Buffer content_encoding_header_key("content-encoding");
 
     auto it = find_if(
         headers.begin(),
         headers.end(),
-        [&] (const HttpHeader &http_header) { return http_header.getKey() == content_encoding_header_key; }
+        [&] (const HttpHeader &http_header) {
+            return http_header.getKey().isEqualLowerCase(content_encoding_header_key);
+        }
     );
     if (it == headers.end()) {
         dbgTrace(D_NGINX_ATTACHMENT_PARSER)

components/attachment-intakers/nginx_attachment/nginx_parser.h

@@ -28,7 +28,10 @@ public:
     static Maybe<HttpTransactionData> parseStartTrasaction(const Buffer &data);
     static Maybe<ResponseCode> parseResponseCode(const Buffer &data);
     static Maybe<uint64_t> parseContentLength(const Buffer &data);
-    static Maybe<std::vector<HttpHeader>> parseRequestHeaders(const Buffer &data);
+    static Maybe<std::vector<HttpHeader>> parseRequestHeaders(
+        const Buffer &data,
+        const std::unordered_set<std::string> &ignored_headers
+    );
     static Maybe<std::vector<HttpHeader>> parseResponseHeaders(const Buffer &data);
     static Maybe<HttpBody> parseRequestBody(const Buffer &data);
     static Maybe<HttpBody> parseResponseBody(const Buffer &raw_response_body, CompressionStream *compression_stream);

components/attachment-intakers/nginx_attachment/user_identifiers_config.cc

@@ -282,21 +282,39 @@ isIpTrusted(const string &value, const vector<CIDRSData> &cidr_values)
 }
 
 Maybe<string>
-UsersAllIdentifiersConfig::parseXForwardedFor(const string &str) const
+UsersAllIdentifiersConfig::parseXForwardedFor(const string &str, ExtractType type) const
 {
     vector<string> header_values = split(str);
-
     if (header_values.empty()) return genError("No IP found in the xff header list");
 
     vector<string> xff_values = getHeaderValuesFromConfig("x-forwarded-for");
     vector<CIDRSData> cidr_values(xff_values.begin(), xff_values.end());
+    string last_valid_ip;
 
-    for (const string &value : header_values) {
-        if (!IPAddr::createIPAddr(value).ok()) {
-            dbgWarning(D_NGINX_ATTACHMENT_PARSER) << "Invalid IP address found in the xff header IPs list: " << value;
-            return genError("Invalid IP address");
+    for (auto it = header_values.rbegin(); it != header_values.rend() - 1; ++it) {
+        if (!IPAddr::createIPAddr(*it).ok()) {
+            dbgWarning(D_NGINX_ATTACHMENT_PARSER) << "Invalid IP address found in the xff header IPs list: " << *it;
+            if (last_valid_ip.empty()) {
+                return genError("Invalid IP address");
+            }
+            return last_valid_ip;
         }
-        if (!isIpTrusted(value, cidr_values)) return genError("Untrusted Ip found");
+        last_valid_ip = *it;
+        if (type == ExtractType::PROXYIP) continue;
+        if (!isIpTrusted(*it, cidr_values)) {
+            dbgDebug(D_NGINX_ATTACHMENT_PARSER) << "Found untrusted IP in the xff header IPs list: " << *it;
+            return *it;
+        }
+    }
+
+    if (!IPAddr::createIPAddr(header_values[0]).ok()) {
+        dbgWarning(D_NGINX_ATTACHMENT_PARSER)
+            << "Invalid IP address found in the xff header IPs list: "
+            << header_values[0];
+        if (last_valid_ip.empty()) {
+            return genError("No Valid Ip address was found");
+        }
+        return last_valid_ip;
     }
 
     return header_values[0];
@@ -306,22 +324,28 @@ UsersAllIdentifiersConfig::parseXForwardedFor(const string &str) const
 void
 UsersAllIdentifiersConfig::setXFFValuesToOpaqueCtx(const HttpHeader &header, ExtractType type) const
 {
-    auto value = parseXForwardedFor(header.getValue());
+    auto i_transaction_table = Singleton::Consume<I_TableSpecific<SessionID>>::by<NginxAttachment>();
+    if (!i_transaction_table || !i_transaction_table->hasState<NginxAttachmentOpaque>()) {
+        dbgTrace(D_NGINX_ATTACHMENT_PARSER) << "Can't get the transaction table";
+        return;
+    }
+    NginxAttachmentOpaque &opaque = i_transaction_table->getState<NginxAttachmentOpaque>();
+    auto value = parseXForwardedFor(header.getValue(), type);
     if (!value.ok()) {
         dbgTrace(D_NGINX_ATTACHMENT_PARSER) << "Could not extract source identifier from X-Forwarded-For header";
         return;
     };
-    auto i_transaction_table = Singleton::Consume<I_TableSpecific<SessionID>>::by<NginxAttachment>();
-    if (!i_transaction_table || !i_transaction_table->hasState<NginxAttachmentOpaque>()) {
-        dbgDebug(D_NGINX_ATTACHMENT_PARSER) << "Can't get the transaction table";
-        return;
-    }
-    NginxAttachmentOpaque &opaque = i_transaction_table->getState<NginxAttachmentOpaque>();
+
     if (type == ExtractType::SOURCEIDENTIFIER) {
         opaque.setSourceIdentifier(header.getKey(), value.unpack());
         dbgDebug(D_NGINX_ATTACHMENT_PARSER)
-            << "Added source identifir to XFF "
+            << "Added source identifier from XFF header"
             <<  value.unpack();
+        opaque.setSavedData(HttpTransactionData::xff_vals_ctx, header.getValue());
+        opaque.setSavedData(HttpTransactionData::source_identifier, value.unpack());
+        dbgTrace(D_NGINX_ATTACHMENT_PARSER)
+            << "XFF found, set ctx with value from header: "
+            << static_cast<string>(header.getValue());
     } else {
         opaque.setSavedData(HttpTransactionData::proxy_ip_ctx, value.unpack());
     }
@@ -342,6 +366,24 @@ UsersAllIdentifiersConfig::setCustomHeaderToOpaqueCtx(const HttpHeader &header)
     return;
 }
 
+void
+UsersAllIdentifiersConfig::setWafTagValuesToOpaqueCtx(const HttpHeader &header) const
+{
+    auto i_transaction_table = Singleton::Consume<I_TableSpecific<SessionID>>::by<NginxAttachment>();
+    if (!i_transaction_table || !i_transaction_table->hasState<NginxAttachmentOpaque>()) {
+        dbgDebug(D_NGINX_ATTACHMENT_PARSER) << "Can't get the transaction table";
+        return;
+    }
+
+    NginxAttachmentOpaque &opaque = i_transaction_table->getState<NginxAttachmentOpaque>();
+    opaque.setSavedData(HttpTransactionData::waf_tag_ctx, static_cast<string>(header.getValue()));
+
+    dbgDebug(D_NGINX_ATTACHMENT_PARSER)
+        << "Added waf tag to context: "
+        <<  static_cast<string>(header.getValue());
+    return;
+}
+
 Maybe<string>
 UsersAllIdentifiersConfig::parseCookieElement(
     const string::const_iterator &start,

components/generic_rulebase/assets_config.cc

@@ -1,137 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/assets_config.h"
-
-#include <string>
-#include <algorithm>
-#include <unordered_map>
-
-#include "generic_rulebase/generic_rulebase_utils.h"
-#include "config.h"
-#include "debug.h"
-#include "ip_utilities.h"
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-using namespace std;
-
-void
-RuleAsset::load(cereal::JSONInputArchive &archive_in)
-{
-    archive_in(cereal::make_nvp("assetId", asset_id));
-    archive_in(cereal::make_nvp("assetName", asset_name));
-    archive_in(cereal::make_nvp("assetUrls", asset_urls));
-
-    dbgWarning(D_RULEBASE_CONFIG) << "Adding asset with UID: " << asset_id;
-}
-
-void
-RuleAsset::AssetUrl::load(cereal::JSONInputArchive &archive_in)
-{
-    archive_in(cereal::make_nvp("protocol", protocol));
-    transform(protocol.begin(), protocol.end(), protocol.begin(), [](unsigned char c) { return tolower(c); });
-
-    archive_in(cereal::make_nvp("ip", ip));
-    archive_in(cereal::make_nvp("port", port));
-
-    int value;
-    if (protocol == "*") {
-        is_any_proto = true;
-    } else {
-        is_any_proto = false;
-        try {
-            value = 0;
-            if(protocol == "udp") value = IPPROTO_UDP;
-            if(protocol == "tcp") value = IPPROTO_TCP;
-            if(protocol == "dccp") value = IPPROTO_DCCP;
-            if(protocol == "sctp") value = IPPROTO_SCTP;
-            if(protocol == "icmp") value = IPPROTO_ICMP;
-            if(protocol == "icmpv6") value = IPPROTO_ICMP;
-
-            if (value > static_cast<int>(UINT8_MAX) || value < 0) {
-                dbgWarning(D_RULEBASE_CONFIG)
-                    << "provided value is not a legal IP protocol number. Value: "
-                    << protocol;
-            } else {
-                parsed_proto = value;
-            }
-        } catch (...) {
-            dbgWarning(D_RULEBASE_CONFIG) << "provided value is not a legal IP protocol. Value: " << protocol;
-        }
-    }
-
-    if (port == "*") {
-        is_any_port = true;
-    } else {
-        is_any_port = false;
-        try {
-            value = stoi(port);
-            if (value > static_cast<int>(UINT16_MAX) || value < 0) {
-                dbgWarning(D_RULEBASE_CONFIG) << "provided value is not a legal port number. Value: " << port;
-            } else {
-                parsed_port = value;
-            }
-        } catch (...) {
-            dbgWarning(D_RULEBASE_CONFIG) << "provided value is not a legal port. Value: " << port;
-        }
-    }
-
-    if (ip == "*") {
-        is_any_ip = true;
-    } else {
-        is_any_ip = false;
-        auto ip_addr = IPAddr::createIPAddr(ip);
-        if (!ip_addr.ok()) {
-            dbgWarning(D_RULEBASE_CONFIG) << "Could not create IP address. Error: " << ip_addr.getErr();
-        } else {
-            parsed_ip = ConvertToIpAddress(ip_addr.unpackMove());
-        }
-    }
-}
-
-IpAddress
-RuleAsset::AssetUrl::ConvertToIpAddress(const IPAddr &addr)
-{
-    IpAddress address;
-    switch (addr.getType()) {
-        case IPType::UNINITIALIZED: {
-            address.addr4_t = {0};
-            address.ip_type = IP_VERSION_ANY;
-            break;
-        }
-        case IPType::V4: {
-            address.addr4_t = addr.getIPv4();
-            address.ip_type = IP_VERSION_4;
-            break;
-        }
-        case IPType::V6: {
-            address.addr6_t = addr.getIPv6();
-            address.ip_type = IP_VERSION_6;
-            break;
-        }
-        default:
-            address.addr4_t = {0};
-            address.ip_type = IP_VERSION_ANY;
-            dbgWarning(D_RULEBASE_CONFIG) << "Unsupported IP type: " << static_cast<int>(addr.getType());
-    }
-    return address;
-}
-
-const Assets Assets::empty_assets_config = Assets();
-
-void
-Assets::preload()
-{
-    registerExpectedSetting<Assets>("rulebase", "usedAssets");
-}

components/generic_rulebase/evaluators/asset_eval.cc

@@ -1,52 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/evaluators/asset_eval.h"
-
-#include <vector>
-#include <string>
-
-#include "generic_rulebase/assets_config.h"
-#include "config.h"
-#include "debug.h"
-
-using namespace std;
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-string AssetMatcher::ctx_key = "asset_id";
-
-AssetMatcher::AssetMatcher(const vector<string> &params)
-{
-    if (params.size() != 1) reportWrongNumberOfParams(AssetMatcher::getName(), params.size(), 1, 1);
-    asset_id = params[0];
-}
-
-Maybe<bool, Context::Error>
-AssetMatcher::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<AssetMatcher>();
-    auto bc_asset_id_ctx = env->get<GenericConfigId>(AssetMatcher::ctx_key);
-
-    if (bc_asset_id_ctx.ok()) {
-        dbgTrace(D_RULEBASE_CONFIG)
-            << "Asset ID: "
-            << asset_id
-            << "; Current set assetId context: "
-            << *bc_asset_id_ctx;
-    } else {
-        dbgTrace(D_RULEBASE_CONFIG) << "Asset ID: " << asset_id << ". Empty context";
-    }
-
-    return bc_asset_id_ctx.ok() && *bc_asset_id_ctx == asset_id;
-}

components/generic_rulebase/evaluators/connection_eval.cc

@@ -1,299 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/evaluators/connection_eval.h"
-
-#include <vector>
-#include <string>
-
-#include "generic_rulebase/rulebase_config.h"
-#include "config.h"
-#include "debug.h"
-#include "ip_utilities.h"
-
-using namespace std;
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-string IpAddressMatcher::ctx_key = "ipAddress";
-string SourceIpMatcher::ctx_key = "sourceIP";
-string DestinationIpMatcher::ctx_key = "destinationIP";
-string SourcePortMatcher::ctx_key = "sourcePort";
-string ListeningPortMatcher::ctx_key = "listeningPort";
-string IpProtocolMatcher::ctx_key = "ipProtocol";
-string UrlMatcher::ctx_key = "url";
-
-Maybe<IPAddr>
-getIpAddrFromEnviroment(I_Environment *env, Context::MetaDataType enum_data_type, const string &str_data_type)
-{
-    auto ip_str = env->get<string>(enum_data_type);
-    if (!ip_str.ok()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get " << str_data_type << " from the enviroment.";
-        return genError("Failed to get " + str_data_type + " from the enviroment.");
-    }
-    return IPAddr::createIPAddr(ip_str.unpack());
-}
-
-bool
-checkIfIpInRangesVec(const vector<CustomRange<IPAddr>> &values, const IPAddr &ip_to_check)
-{
-    if (values.size() == 0) {
-        dbgTrace(D_RULEBASE_CONFIG) << "Ip addersses vector empty. Match is true.";
-        return true;
-    }
-    for (const CustomRange<IPAddr> &range : values) {
-        if (range.contains(ip_to_check)) {
-            dbgTrace(D_RULEBASE_CONFIG) << "Ip adderss matched: " << ip_to_check;
-            return true;
-        }
-    }
-    dbgTrace(D_RULEBASE_CONFIG) << "Ip adderss not match: " << ip_to_check;
-    return false;
-}
-
-
-IpAddressMatcher::IpAddressMatcher(const vector<string> &params)
-{
-    for (const string &param : params) {
-        Maybe<CustomRange<IPAddr>> ip_range = CustomRange<IPAddr>::createRange(param);
-        if (!ip_range.ok()) {
-            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create ip. Error: " + ip_range.getErr();
-            continue;
-        }
-        values.push_back(ip_range.unpack());
-    }
-}
-
-Maybe<bool, Context::Error>
-IpAddressMatcher::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<IpAddressMatcher>();
-    Maybe<IPAddr> subject_ip = getIpAddrFromEnviroment(
-        env,
-        Context::MetaDataType::SubjectIpAddr,
-        "subject ip address"
-    );
-    if (subject_ip.ok() && checkIfIpInRangesVec(values, subject_ip.unpack())) return true;
-
-    Maybe<IPAddr> other_ip = getIpAddrFromEnviroment(
-        env,
-        Context::MetaDataType::OtherIpAddr,
-        "other ip address"
-    );
-    if (other_ip.ok() && checkIfIpInRangesVec(values, other_ip.unpack())) return true;
-    if (!subject_ip.ok() && !other_ip.ok()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Error in getting subject ip and other ip from the enviroment";
-        return false;
-    }
-    dbgTrace(D_RULEBASE_CONFIG) << "Ip adderss didn't match";
-    return false;
-}
-
-SourceIpMatcher::SourceIpMatcher(const vector<string> &params)
-{
-    for (const string &param : params) {
-        Maybe<CustomRange<IPAddr>> ip_range = CustomRange<IPAddr>::createRange(param);
-        if (!ip_range.ok()) {
-            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create source ip. Error: " + ip_range.getErr();
-            continue;
-        }
-        values.push_back(ip_range.unpack());
-    }
-}
-
-Maybe<bool, Context::Error>
-SourceIpMatcher::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<SourceIpMatcher>();
-    auto direction_maybe = env->get<string>(Context::MetaDataType::Direction);
-    if (!direction_maybe.ok()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get direction from the enviroment.";
-        return false;
-    }
-    string direction = direction_maybe.unpack();
-    if (direction == "incoming") {
-        Maybe<IPAddr> other_ip = getIpAddrFromEnviroment(
-            env,
-            Context::MetaDataType::OtherIpAddr,
-            "other ip address"
-        );
-        return other_ip.ok() && checkIfIpInRangesVec(values, other_ip.unpack());
-    } else if (direction == "outgoing") {
-        Maybe<IPAddr> subject_ip = getIpAddrFromEnviroment(
-            env,
-            Context::MetaDataType::SubjectIpAddr,
-            "subject ip address"
-        );
-        return subject_ip.ok() && checkIfIpInRangesVec(values, subject_ip.unpack());
-    }
-    dbgTrace(D_RULEBASE_CONFIG) << "Source ip adderss didn't match";
-    return false;
-}
-
-DestinationIpMatcher::DestinationIpMatcher(const vector<string> &params)
-{
-    for (const string &param : params) {
-        Maybe<CustomRange<IPAddr>> ip_range = CustomRange<IPAddr>::createRange(param);
-        if (!ip_range.ok()) {
-            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create destination ip. Error: " + ip_range.getErr();
-            continue;
-        }
-        values.push_back(ip_range.unpack());
-    }
-}
-
-Maybe<bool, Context::Error>
-DestinationIpMatcher::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<DestinationIpMatcher>();
-    auto direction_maybe = env->get<string>(Context::MetaDataType::Direction);
-    if (!direction_maybe.ok()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get direction.";
-        return false;
-    }
-    string direction = direction_maybe.unpack();
-    if (direction == "outgoing") {
-        Maybe<IPAddr> other_ip = getIpAddrFromEnviroment(
-            env,
-            Context::MetaDataType::OtherIpAddr,
-            "other ip address"
-        );
-        return other_ip.ok() && checkIfIpInRangesVec(values, other_ip.unpack());
-    } else if (direction == "incoming") {
-        Maybe<IPAddr> subject_ip = getIpAddrFromEnviroment(
-            env,
-            Context::MetaDataType::SubjectIpAddr,
-            "subject ip address"
-        );
-        return subject_ip.ok() && checkIfIpInRangesVec(values, subject_ip.unpack());
-    }
-    dbgTrace(D_RULEBASE_CONFIG) << "Destination ip adderss didn't match";
-    return false;
-}
-
-SourcePortMatcher::SourcePortMatcher(const vector<string> &params)
-{
-    for (const string &param : params) {
-        Maybe<CustomRange<PortNumber>> port_range = CustomRange<PortNumber>::createRange(param);
-        if (!port_range.ok()) {
-            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create source port.";
-            continue;
-        }
-        values.push_back(port_range.unpack());
-    }
-}
-
-Maybe<bool, Context::Error>
-SourcePortMatcher::evalVariable() const
-{
-    dbgTrace(D_RULEBASE_CONFIG) << "Source is not a match";
-    return false;
-}
-
-
-ListeningPortMatcher::ListeningPortMatcher(const vector<string> &params)
-{
-    for (const string &param : params) {
-        Maybe<CustomRange<PortNumber>> port_range = CustomRange<PortNumber>::createRange(param);
-        if (!port_range.ok()) {
-            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create listening port range.";
-            continue;
-        }
-        values.push_back(port_range.unpack());
-    }
-}
-
-Maybe<bool, Context::Error>
-ListeningPortMatcher::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<ListeningPortMatcher>();
-    auto port_str = env->get<string>(Context::MetaDataType::Port);
-    if (!port_str.ok()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get port from the enviroment.";
-        return false;
-    }
-    PortNumber port;
-    if (ConnKeyUtil::fromString(port_str.unpack(), port)) {
-        if (values.size() == 0) return true;
-        for (const CustomRange<PortNumber> &port_range : values) {
-            if (port_range.contains(port)) {
-                dbgTrace(D_RULEBASE_CONFIG) << "Listening port is a match. Value: " << port_str.unpack();
-                return true;
-            }
-        }
-    }
-    dbgTrace(D_RULEBASE_CONFIG) << "Listening port is not a match. Value: " << port_str.unpack();
-    return false;
-}
-
-IpProtocolMatcher::IpProtocolMatcher(const vector<string> &params)
-{
-    for (const string &param : params) {
-        Maybe<CustomRange<IPProto>> proto_range = CustomRange<IPProto>::createRange(param);
-        if (!proto_range.ok()) {
-            dbgWarning(D_RULEBASE_CONFIG) << "Failed to create ip protocol.";
-            continue;
-        }
-        values.push_back(proto_range.unpack());
-    }
-}
-
-Maybe<bool, Context::Error>
-IpProtocolMatcher::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<IpProtocolMatcher>();
-    auto proto_str = env->get<string>(Context::MetaDataType::Protocol);
-    if (!proto_str.ok()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get ip protocol from the enviroment.";
-        return false;
-    }
-    IPProto protocol;
-    if (ConnKeyUtil::fromString(proto_str.unpack(), protocol)) {
-        if (values.size() == 0) return true;
-        for (const CustomRange<IPProto> &proto_range : values) {
-            if (proto_range.contains(protocol)) {
-                dbgTrace(D_RULEBASE_CONFIG) << "Ip protocol is a match. Value: " << proto_str.unpack();
-                return true;
-            }
-        }
-    }
-    dbgTrace(D_RULEBASE_CONFIG) << "Source port is not a match. Value: " << proto_str.unpack();
-    return false;
-}
-
-UrlMatcher::UrlMatcher(const vector<string> &params) : values(params) {}
-
-Maybe<bool, Context::Error>
-UrlMatcher::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<UrlMatcher>();
-    auto curr_url_ctx = env->get<string>(Context::MetaDataType::Url);
-    if (!curr_url_ctx.ok()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to get URL from the enviroment.";
-        return false;
-    }
-    
-    if (values.size() == 0) {
-        dbgTrace(D_RULEBASE_CONFIG) << "Matched URL on \"any\". Url: " << *curr_url_ctx;
-        return true;
-    }
-
-    for (const string &url : values) {
-        if (*curr_url_ctx == url) {
-            dbgTrace(D_RULEBASE_CONFIG) << "Matched URL. Value: " << *curr_url_ctx;
-            return true;
-        }
-    }
-
-    dbgTrace(D_RULEBASE_CONFIG) << "URL is not a match. Value: " << *curr_url_ctx;
-    return false;
-}

components/generic_rulebase/evaluators/http_transaction_data_eval.cc

@@ -1,168 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/evaluators/http_transaction_data_eval.h"
-
-#include <boost/lexical_cast.hpp>
-#include <algorithm>
-
-#include "http_transaction_data.h"
-#include "environment/evaluator_templates.h"
-#include "i_environment.h"
-#include "singleton.h"
-#include "debug.h"
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-using namespace std;
-using namespace EnvironmentHelper;
-
-EqualHost::EqualHost(const vector<string> &params)
-{
-    if (params.size() != 1) reportWrongNumberOfParams("EqualHost", params.size(), 1, 1);
-    host = params[0];
-}
-
-Maybe<bool, Context::Error>
-EqualHost::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<EqualHost>();
-    auto host_ctx = env->get<string>(HttpTransactionData::host_name_ctx);
-
-    if (!host_ctx.ok())
-    {
-        return false;
-    }
-
-    std::string lower_host_ctx = host_ctx.unpack();
-    std::transform(lower_host_ctx.begin(), lower_host_ctx.end(), lower_host_ctx.begin(), ::tolower);
-
-    std::string lower_host = host;
-    std::transform(lower_host.begin(), lower_host.end(), lower_host.begin(), ::tolower);
-
-
-    if (lower_host_ctx == lower_host) return true;
-    size_t pos = lower_host_ctx.find_last_of(':');
-    if (pos == string::npos) return false;
-    lower_host_ctx = string(lower_host_ctx.data(), pos);
-    return lower_host_ctx == lower_host;
-}
-
-WildcardHost::WildcardHost(const vector<string> &params)
-{
-    if (params.size() != 1) reportWrongNumberOfParams("WildcardHost", params.size(), 1, 1);
-    host = params[0];
-}
-
-Maybe<bool, Context::Error>
-WildcardHost::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<WildcardHost>();
-    auto host_ctx = env->get<string>(HttpTransactionData::host_name_ctx);
-
-    if (!host_ctx.ok())
-    {
-        return false;
-    }
-
-    string lower_host_ctx = host_ctx.unpack();
-    transform(lower_host_ctx.begin(), lower_host_ctx.end(), lower_host_ctx.begin(), ::tolower);
-
-    dbgTrace(D_RULEBASE_CONFIG) << "found host in current context: " << lower_host_ctx;
-
-    size_t pos = lower_host_ctx.find_first_of(".");
-    if (pos == string::npos) {
-        return false;
-    }
-
-    lower_host_ctx = "*" + lower_host_ctx.substr(pos, lower_host_ctx.length());
-
-    string lower_host = host;
-    transform(lower_host.begin(), lower_host.end(), lower_host.begin(), ::tolower);
-
-    dbgTrace(D_RULEBASE_CONFIG)
-        << "trying to match host context with its corresponding wildcard address: "
-        << lower_host_ctx
-        << ". Matcher host: "
-        << lower_host;
-
-    if (lower_host_ctx == lower_host) return true;
-    pos = lower_host_ctx.find_last_of(':');
-    if (pos == string::npos) return false;
-    lower_host_ctx = string(lower_host_ctx.data(), pos);
-    return lower_host_ctx == lower_host;
-}
-
-EqualListeningIP::EqualListeningIP(const vector<string> &params)
-{
-    if (params.size() != 1) reportWrongNumberOfParams("EqualListeningIP", params.size(), 1, 1);
-
-    auto maybe_ip = IPAddr::createIPAddr(params[0]);
-    if (!maybe_ip.ok()) reportWrongParamType(getName(), params[0], "Not a valid IP Address");
-
-    listening_ip = maybe_ip.unpack();
-}
-
-Maybe<bool, Context::Error>
-EqualListeningIP::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<EqualListeningIP>();
-    auto listening_ip_ctx = env->get<IPAddr>(HttpTransactionData::listening_ip_ctx);
-    return listening_ip_ctx.ok() &&  listening_ip_ctx.unpack() == listening_ip;
-}
-
-EqualListeningPort::EqualListeningPort(const vector<string> &params)
-{
-    if (params.size() != 1) reportWrongNumberOfParams("EqualListeningPort", params.size(), 1, 1);
-
-    try {
-        listening_port = boost::lexical_cast<PortNumber>(params[0]);
-    } catch (boost::bad_lexical_cast const&) {
-        reportWrongParamType(getName(), params[0], "Not a valid port number");
-    }
-}
-
-Maybe<bool, Context::Error>
-EqualListeningPort::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<EqualListeningPort>();
-    auto port_ctx = env->get<PortNumber>(HttpTransactionData::listening_port_ctx);
-
-    return port_ctx.ok() && port_ctx.unpack() == listening_port;
-}
-
-BeginWithUri::BeginWithUri(const vector<string> &params)
-{
-    if (params.size() != 1) reportWrongNumberOfParams("BeginWithUri", params.size(), 1, 1);
-    uri_prefix = params[0];
-}
-
-Maybe<bool, Context::Error>
-BeginWithUri::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<BeginWithUri>();
-    auto uri_ctx = env->get<string>(HttpTransactionData::uri_ctx);
-
-    if (!uri_ctx.ok())
-    {
-        return false;
-    }
-
-    std::string lower_uri_ctx = uri_ctx.unpack();
-    std::transform(lower_uri_ctx.begin(), lower_uri_ctx.end(), lower_uri_ctx.begin(), ::tolower);
-
-    std::string lower_uri_prefix = uri_prefix;
-    std::transform(lower_uri_prefix.begin(), lower_uri_prefix.end(), lower_uri_prefix.begin(), ::tolower);
-
-    return lower_uri_ctx.find(lower_uri_prefix) == 0;
-}

components/generic_rulebase/evaluators/practice_eval.cc

@@ -1,50 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/evaluators/practice_eval.h"
-
-#include <vector>
-#include <string>
-
-#include "generic_rulebase/rulebase_config.h"
-#include "config.h"
-#include "debug.h"
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-using namespace std;
-
-string PracticeMatcher::ctx_key = "practices";
-
-PracticeMatcher::PracticeMatcher(const vector<string> &params)
-{
-    if (params.size() != 1) reportWrongNumberOfParams(PracticeMatcher::getName(), params.size(), 1, 1);
-    practice_id = params[0];
-}
-
-Maybe<bool, Context::Error>
-PracticeMatcher::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<PracticeMatcher>();
-    auto bc_practice_id_ctx = env->get<set<GenericConfigId>>(PracticeMatcher::ctx_key);
-    dbgTrace(D_RULEBASE_CONFIG)
-        << "Trying to match practice. ID: "
-        << practice_id << ", Current set IDs: "
-        << makeSeparatedStr(bc_practice_id_ctx.ok() ? *bc_practice_id_ctx : set<GenericConfigId>(), ", ");
-    if (bc_practice_id_ctx.ok()) {
-        return bc_practice_id_ctx.unpack().count(practice_id) > 0;
-    }
-
-    auto rule = getConfiguration<BasicRuleConfig>("rulebase", "rulesConfig");
-    return rule.ok() && rule.unpack().isPracticeActive(practice_id);
-}

components/generic_rulebase/evaluators/query_eval.cc

@@ -1,136 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/evaluators/query_eval.h"
-
-#include <vector>
-#include <string>
-#include <map>
-
-#include "generic_rulebase/rulebase_config.h"
-#include "generic_rulebase/zones_config.h"
-#include "i_environment.h"
-#include "singleton.h"
-#include "config.h"
-#include "debug.h"
-#include "enum_range.h"
-
-using namespace std;
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-QueryMatcher::QueryMatcher(const vector<string> &params)
-{
-    if (params.size() < 1) reportWrongNumberOfParams(QueryMatcher::getName(), params.size(), 1);
-
-    key = params.front();
-    if (key == "any") {
-        is_any = true;
-    } else {
-        values.reserve(params.size() - 1);
-        for (uint i = 1; i < params.size() ; i++) {
-            if (params[i] == "any") {
-                values.clear();
-                break;
-            }
-            values.insert(params[i]);
-        }
-    }
-}
-
-const string
-QueryMatcher::contextKeyToString(Context::MetaDataType type)
-{
-    if (type == Context::MetaDataType::SubjectIpAddr || type == Context::MetaDataType::OtherIpAddr) return "ip";
-    return Context::convertToString(type);
-}
-
-class QueryMatchSerializer
-{
-public:
-    static const string req_attr_ctx_key;
-
-    template <typename Archive>
-    void
-    serialize(Archive &ar)
-    {
-        I_Environment *env = Singleton::Consume<I_Environment>::by<QueryMatcher>();
-        auto req_attr = env->get<string>(req_attr_ctx_key);
-        if (!req_attr.ok()) return;
-
-        try {
-            ar(cereal::make_nvp(*req_attr, value));
-            dbgDebug(D_RULEBASE_CONFIG)
-                << "Found value for requested attribute. Tag: "
-                << *req_attr
-                << ", Value: "
-                << value;
-        } catch (exception &e) {
-            dbgDebug(D_RULEBASE_CONFIG) << "Could not find values for requested attribute. Tag: " << *req_attr;
-            ar.finishNode();
-        }
-    }
-
-    template <typename Values>
-    bool
-    matchValues(const Values &requested_vals) const
-    {
-        return value != "" && (requested_vals.empty() || requested_vals.count(value) > 0);
-    }
-
-private:
-    string value;
-};
-
-const string QueryMatchSerializer::req_attr_ctx_key = "requested attribute key";
-
-Maybe<bool, Context::Error>
-QueryMatcher::evalVariable() const
-{
-    if (is_any) return true;
-
-    I_Environment *env = Singleton::Consume<I_Environment>::by<QueryMatcher>();
-    auto local_asset_ctx = env->get<bool>("is local asset");
-    bool is_remote_asset = local_asset_ctx.ok() && !(*local_asset_ctx);
-
-    QueryRequest request;
-    for (Context::MetaDataType name : makeRange<Context::MetaDataType>()) {
-        auto val = env->get<string>(name);
-        if (val.ok()) {
-            if ((name == Context::MetaDataType::SubjectIpAddr && is_remote_asset) ||
-                (name == Context::MetaDataType::OtherIpAddr && !is_remote_asset)) {
-                continue;
-            }
-
-            request.addCondition(Condition::EQUALS, contextKeyToString(name), *val);
-        }
-    }
-    if (request.empty()) return false;
-
-    request.setRequestedAttr(key);
-    ScopedContext req_attr_key;
-    req_attr_key.registerValue<string>(QueryMatchSerializer::req_attr_ctx_key, key);
-
-    I_Intelligence_IS_V2 *intelligence = Singleton::Consume<I_Intelligence_IS_V2>::by<Zone>();
-    auto query_res = intelligence->queryIntelligence<QueryMatchSerializer>(request);
-    if (!query_res.ok()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to perform intelligence query. Error: " << query_res.getErr();
-        return false;
-    }
-
-    for (const AssetReply<QueryMatchSerializer> &asset : query_res.unpack()) {
-        if (asset.matchValues<unordered_set<string>>(values)) return true;
-    }
-
-    return false;
-}

components/generic_rulebase/evaluators/trigger_eval.cc

@@ -1,57 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/evaluators/trigger_eval.h"
-
-#include <vector>
-#include <string>
-
-#include "generic_rulebase/rulebase_config.h"
-#include "config.h"
-#include "debug.h"
-
-using namespace std;
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-string TriggerMatcher::ctx_key = "triggers";
-
-TriggerMatcher::TriggerMatcher(const vector<string> &params)
-{
-    if (params.size() != 1) reportWrongNumberOfParams(TriggerMatcher::getName(), params.size(), 1, 1);
-    trigger_id = params[0];
-}
-
-Maybe<bool, Context::Error>
-TriggerMatcher::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<TriggerMatcher>();
-    auto ac_bc_trigger_id_ctx = env->get<set<GenericConfigId>>("ac_trigger_id");
-    dbgTrace(D_RULEBASE_CONFIG)
-        << "Trying to match trigger for access control rule. ID: "
-        << trigger_id << ", Current set IDs: "
-        << makeSeparatedStr(ac_bc_trigger_id_ctx.ok() ? *ac_bc_trigger_id_ctx : set<GenericConfigId>(), ", ");
-    if (ac_bc_trigger_id_ctx.ok()) {
-        return ac_bc_trigger_id_ctx.unpack().count(trigger_id) > 0;
-    }
-
-    auto bc_trigger_id_ctx = env->get<set<GenericConfigId>>(TriggerMatcher::ctx_key);
-    dbgTrace(D_RULEBASE_CONFIG)
-        << "Trying to match trigger. ID: "
-        << trigger_id << ", Current set IDs: "
-        << makeSeparatedStr(bc_trigger_id_ctx.ok() ? *bc_trigger_id_ctx : set<GenericConfigId>(), ", ");
-    if (bc_trigger_id_ctx.ok() && bc_trigger_id_ctx.unpack().count(trigger_id) > 0 ) return true;
-
-    auto rule = getConfiguration<BasicRuleConfig>("rulebase", "rulesConfig");
-    return rule.ok() && rule.unpack().isTriggerActive(trigger_id);
-}

components/generic_rulebase/evaluators/zone_eval.cc

@@ -1,44 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/evaluators/zone_eval.h"
-
-#include <vector>
-#include <string>
-
-#include "generic_rulebase/zone.h"
-#include "generic_rulebase/rulebase_config.h"
-#include "config.h"
-
-using namespace std;
-
-string ZoneMatcher::ctx_key = "zone_id";
-
-ZoneMatcher::ZoneMatcher(const vector<string> &params)
-{
-    if (params.size() != 1) reportWrongNumberOfParams(ZoneMatcher::getName(), params.size(), 1, 1);
-    zone_id = params[0];
-}
-
-Maybe<bool, Context::Error>
-ZoneMatcher::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<ZoneMatcher>();
-    auto bc_zone_id_ctx = env->get<GenericConfigId>(ZoneMatcher::ctx_key);
-    if (bc_zone_id_ctx.ok() && *bc_zone_id_ctx == zone_id) return true;
-
-    if (!getProfileAgentSettingWithDefault<bool>(false, "rulebase.enableQueryBasedMatch")) return false;
-
-    auto zone = getConfiguration<Zone>("rulebase", "zones");
-    return zone.ok() && zone.unpack().getId() == zone_id;
-}

components/generic_rulebase/generic_rulebase.cc

@@ -1,126 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/generic_rulebase.h"
-
-#include <unordered_set>
-
-#include "generic_rulebase/evaluators/trigger_eval.h"
-#include "generic_rulebase/evaluators/practice_eval.h"
-#include "generic_rulebase/evaluators/parameter_eval.h"
-#include "generic_rulebase/evaluators/zone_eval.h"
-#include "generic_rulebase/evaluators/asset_eval.h"
-#include "generic_rulebase/evaluators/query_eval.h"
-#include "generic_rulebase/evaluators/connection_eval.h"
-#include "generic_rulebase/evaluators/http_transaction_data_eval.h"
-#include "generic_rulebase/zone.h"
-#include "generic_rulebase/triggers_config.h"
-#include "singleton.h"
-#include "common.h"
-#include "debug.h"
-#include "cache.h"
-#include "config.h"
-
-using namespace std;
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-class GenericRulebase::Impl : Singleton::Provide<I_GenericRulebase>::From<GenericRulebase>
-{
-public:
-    void init() {}
-    void fini() {}
-
-    void preload();
-
-    Maybe<Zone, Config::Errors> getLocalZone() const override { return getZoneConfig(true); }
-    Maybe<Zone, Config::Errors> getOtherZone() const override { return getZoneConfig(false); }
-
-    set<ParameterBehavior> getBehavior(const ParameterKeyValues &key_value_pairs) const override;
-
-private:
-    Maybe<Zone, Config::Errors>
-    getZoneConfig(bool is_local_zone) const
-    {
-        ScopedContext asset_location_ctx;
-        asset_location_ctx.registerValue<bool>("is local asset", is_local_zone);
-        return getConfiguration<Zone>("rulebase", "zones");
-    }
-};
-
-void
-GenericRulebase::Impl::preload()
-{
-    addMatcher<TriggerMatcher>();
-    addMatcher<PracticeMatcher>();
-    addMatcher<ParameterMatcher>();
-    addMatcher<ZoneMatcher>();
-    addMatcher<AssetMatcher>();
-    addMatcher<QueryMatcher>();
-    addMatcher<IpAddressMatcher>();
-    addMatcher<SourceIpMatcher>();
-    addMatcher<DestinationIpMatcher>();
-    addMatcher<SourcePortMatcher>();
-    addMatcher<ListeningPortMatcher>();
-    addMatcher<IpProtocolMatcher>();
-    addMatcher<UrlMatcher>();
-    addMatcher<EqualHost>();
-    addMatcher<WildcardHost>();
-    addMatcher<EqualListeningIP>();
-    addMatcher<EqualListeningPort>();
-    addMatcher<BeginWithUri>();
-    BasicRuleConfig::preload();
-    LogTriggerConf::preload();
-    ParameterException::preload();
-    registerExpectedConfiguration<Zone>("rulebase", "zones");
-    registerExpectedConfigFile("zones", Config::ConfigFileType::Policy);
-    registerExpectedConfigFile("triggers", Config::ConfigFileType::Policy);
-    registerExpectedConfigFile("rules", Config::ConfigFileType::Policy);
-    registerExpectedConfigFile("parameters", Config::ConfigFileType::Policy);
-    registerExpectedConfigFile("exceptions", Config::ConfigFileType::Policy);
-
-}
-
-set<ParameterBehavior>
-GenericRulebase::Impl::getBehavior(const ParameterKeyValues &key_value_pairs) const
-{
-    auto &exceptions = getConfiguration<ParameterException>("rulebase", "exception");
-
-    if (!exceptions.ok()) {
-        dbgTrace(D_RULEBASE_CONFIG) << "Could not find any exception with the current rule's context";
-        return {};
-    }
-    return (*exceptions).getBehavior(key_value_pairs);
-}
-
-GenericRulebase::GenericRulebase() : Component("GenericRulebase"), pimpl(make_unique<Impl>()) {}
-
-GenericRulebase::~GenericRulebase() {}
-
-void
-GenericRulebase::init()
-{
-    pimpl->init();
-}
-
-void
-GenericRulebase::fini()
-{
-    pimpl->fini();
-}
-
-void
-GenericRulebase::preload()
-{
-    pimpl->preload();
-}

components/generic_rulebase/generic_rulebase_context.cc

@@ -1,109 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/generic_rulebase_context.h"
-
-#include <vector>
-
-#include "context.h"
-#include "config.h"
-#include "generic_rulebase/evaluators/trigger_eval.h"
-#include "generic_rulebase/evaluators/parameter_eval.h"
-#include "generic_rulebase/evaluators/practice_eval.h"
-#include "generic_rulebase/evaluators/zone_eval.h"
-#include "generic_rulebase/evaluators/asset_eval.h"
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-using namespace std;
-
-template<typename Configs>
-set<GenericConfigId>
-extractIds(const vector<Configs> &configurations)
-{
-    set<GenericConfigId> ids;
-    for (const Configs &conf : configurations) {
-        ids.insert(conf.getId());
-    }
-    return ids;
-}
-
-void
-GenericRulebaseContext::activate(const BasicRuleConfig &rule)
-{
-    switch(registration_state) {
-        case RuleRegistrationState::UNINITIALIZED: {
-            registration_state = RuleRegistrationState::REGISTERED;
-            ctx.registerValue<set<GenericConfigId>>(
-                TriggerMatcher::ctx_key,
-                extractIds<RuleTrigger>(rule.getTriggers())
-            );
-            ctx.registerValue<set<GenericConfigId>>(
-                PracticeMatcher::ctx_key,
-                extractIds<RulePractice>(rule.getPractices())
-            );
-            dbgTrace(D_RULEBASE_CONFIG)
-                << "Activating current practices. Current practice IDs: "
-                << makeSeparatedStr(extractIds<RulePractice>(rule.getPractices()), ", ");
-
-            ctx.registerValue<set<GenericConfigId>>(
-                ParameterMatcher::ctx_key,
-                extractIds<RuleParameter>(rule.getParameters())
-            );
-            ctx.registerValue<GenericConfigId>(
-                ZoneMatcher::ctx_key,
-                rule.getZoneId()
-            );
-            ctx.registerValue<GenericConfigId>(
-                AssetMatcher::ctx_key,
-                rule.getAssetId()
-            );
-            ctx.activate();
-            break;
-        }
-        case RuleRegistrationState::REGISTERED: {
-            dbgTrace(D_RULEBASE_CONFIG) << "Activating registered rule values";
-            ctx.activate();
-            break;
-        }
-        case RuleRegistrationState::UNREGISTERED: {
-            dbgTrace(D_RULEBASE_CONFIG) << "Failed to register rule values";
-        }
-    }
-}
-
-void
-GenericRulebaseContext::activate()
-{
-    switch(registration_state) {
-        case RuleRegistrationState::UNINITIALIZED: {
-            auto maybe_rule = getConfiguration<BasicRuleConfig>("rulebase", "rulesConfig");
-            if (!maybe_rule.ok()) {
-                registration_state = RuleRegistrationState::UNREGISTERED;
-                return;
-            }
-            dbgTrace(D_RULEBASE_CONFIG) << "Registering new rule values";
-            activate(maybe_rule.unpack());
-            registration_state = RuleRegistrationState::REGISTERED;
-            break;
-        }
-        case RuleRegistrationState::REGISTERED: {
-            dbgTrace(D_RULEBASE_CONFIG) << "Activating registered rule values";
-            ctx.activate();
-            break;
-        }
-        case RuleRegistrationState::UNREGISTERED: {
-            dbgTrace(D_RULEBASE_CONFIG) << "Failed to register rule values";
-        }
-    }
-}

components/generic_rulebase/match_query.cc

@@ -1,347 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/match_query.h"
-
-#include "cereal/types/set.hpp"
-
-#include "generic_rulebase/generic_rulebase_utils.h"
-#include "config.h"
-#include "ip_utilities.h"
-#include "agent_core_utilities.h"
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-using namespace std;
-
-static const unordered_map<string, MatchQuery::MatchType> string_to_match_type = {
-    { "condition", MatchQuery::MatchType::Condition },
-    { "operator", MatchQuery::MatchType::Operator }
-};
-
-static const unordered_map<string, MatchQuery::Operators> string_to_operator = {
-    { "and", MatchQuery::Operators::And },
-    { "or", MatchQuery::Operators::Or }
-};
-
-static const unordered_map<string, MatchQuery::Conditions> string_to_condition = {
-    { "equals", MatchQuery::Conditions::Equals },
-    { "not-equals", MatchQuery::Conditions::NotEquals },
-    { "not equals", MatchQuery::Conditions::NotEquals },
-    { "in", MatchQuery::Conditions::In },
-    { "not-in", MatchQuery::Conditions::NotIn },
-    { "not in", MatchQuery::Conditions::NotIn },
-    { "exist", MatchQuery::Conditions::Exist }
-};
-
-static const string ip_addr_type_name = "IP address";
-static const string port_type_name = "port";
-static const string ip_proto_type_name = "IP protocol";
-
-static const unordered_map<string, MatchQuery::StaticKeys> string_to_key = {
-    { "sourceIP", MatchQuery::StaticKeys::SrcIpAddress },
-    { "sourceIpAddr", MatchQuery::StaticKeys::SrcIpAddress },
-    { "destinationIP", MatchQuery::StaticKeys::DstIpAddress },
-    { "destinationIpAddr", MatchQuery::StaticKeys::DstIpAddress },
-    { "ipAddress", MatchQuery::StaticKeys::IpAddress },
-    { "sourcePort", MatchQuery::StaticKeys::SrcPort },
-    { "listeningPort", MatchQuery::StaticKeys::ListeningPort },
-    { "ipProtocol", MatchQuery::StaticKeys::IpProtocol },
-    { "domain", MatchQuery::StaticKeys::Domain }
-};
-
-MatchQuery::MatchQuery(const string &match) : is_specific_label(false), is_ignore_keyword(false)
-{
-    try {
-        stringstream ss;
-        ss.str(match);
-        cereal::JSONInputArchive archive_in(ss);
-        load(archive_in);
-    } catch (const exception &e) {
-        dbgWarning(D_RULEBASE_CONFIG)
-            << "Unable to load match query JSON. JSON content: "
-            << match
-            << ", Error: "
-            << e.what();
-    }
-}
-
-void
-MatchQuery::load(cereal::JSONInputArchive &archive_in)
-{
-    string type_as_string;
-    archive_in(cereal::make_nvp("type", type_as_string));
-
-    string op_as_string;
-    archive_in(cereal::make_nvp("op", op_as_string));
-
-    auto maybe_type = string_to_match_type.find(type_as_string);
-    if (maybe_type == string_to_match_type.end()) {
-        reportConfigurationError("Illegal Zone match query type. Provided type in configuration: " + type_as_string);
-    }
-
-    type = maybe_type->second;
-    switch (type) {
-        case (MatchType::Condition): {
-            auto maybe_condition = string_to_condition.find(op_as_string);
-            if (maybe_condition == string_to_condition.end()) {
-                reportConfigurationError(
-                    "Illegal op provided for condition. Provided op in configuration: " +
-                    op_as_string
-                );
-            }
-            condition_type = maybe_condition->second;
-            operator_type = Operators::None;
-            archive_in(cereal::make_nvp("key", key));
-            key_type = getKeyByName(key);
-            if (key_type == StaticKeys::NotStatic) {
-                if (key.rfind("containerLabels.", 0) == 0)  {
-                    is_specific_label = true;
-                } else {
-                    is_specific_label = false;
-                }
-            }
-            is_ignore_keyword = (key == "indicator");
-
-            if (condition_type != Conditions::Exist) {
-                archive_in(cereal::make_nvp("value", value));
-                for(const auto &val: value) {
-                    if (isKeyTypeIp()) {
-                        auto ip_range = IPUtilities::createRangeFromString<IPRange, IpAddress>(val, ip_addr_type_name);
-                        if (ip_range.ok()) {
-                            ip_addr_value.push_back(ip_range.unpack());
-                        } else {
-                            dbgWarning(D_RULEBASE_CONFIG)
-                                << "Failed to parse IP address range. Error: "
-                                << ip_range.getErr();
-                        }
-                    } else if (isKeyTypePort()) {
-                        auto port_range = IPUtilities::createRangeFromString<PortsRange, uint16_t>(
-                            val,
-                            port_type_name
-                        );
-                        if (port_range.ok()) {
-                            port_value.push_back(port_range.unpack());
-                        } else {
-                            dbgWarning(D_RULEBASE_CONFIG)
-                                << "Failed to parse port range. Error: "
-                                << port_range.getErr();
-                        }
-                    } else if (isKeyTypeProtocol()) {
-                        auto proto_range = IPUtilities::createRangeFromString<IpProtoRange, uint8_t>(
-                            val,
-                            ip_proto_type_name
-                        );
-                        if (proto_range.ok()) {
-                            ip_proto_value.push_back(proto_range.unpack());
-                        } else {
-                            dbgWarning(D_RULEBASE_CONFIG)
-                                << "Failed to parse IP protocol range. Error: "
-                                << proto_range.getErr();
-                        }
-                    }
-
-                    try {
-                        regex_values.insert(boost::regex(val));
-                    } catch (const exception &e) {
-                        dbgDebug(D_RULEBASE_CONFIG) << "Failed to compile regex. Error: " << e.what();
-                    }
-                }
-                first_value = *(value.begin());
-            }
-            break;
-        }
-        case (MatchType::Operator): {
-            auto maybe_operator = string_to_operator.find(op_as_string);
-            if (maybe_operator == string_to_operator.end()) {
-                reportConfigurationError(
-                    "Illegal op provided for operator. Provided op in configuration: " +
-                    op_as_string
-                );
-            }
-            operator_type = maybe_operator->second;
-            condition_type = Conditions::None;
-            archive_in(cereal::make_nvp("items", items));
-            break;
-        }
-    }
-}
-
-MatchQuery::StaticKeys
-MatchQuery::getKeyByName(const string &key_type_name)
-{
-    auto key = string_to_key.find(key_type_name);
-    if (key == string_to_key.end()) return StaticKeys::NotStatic;
-    return key->second;
-}
-
-bool
-MatchQuery::isKeyTypeIp() const
-{
-    return (key_type >= StaticKeys::IpAddress && key_type <= StaticKeys::DstIpAddress);
-}
-
-bool
-MatchQuery::isKeyTypePort() const
-{
-    return (key_type == StaticKeys::SrcPort || key_type == StaticKeys::ListeningPort);
-}
-
-bool
-MatchQuery::isKeyTypeProtocol() const
-{
-    return (key_type == StaticKeys::IpProtocol);
-}
-
-bool
-MatchQuery::isKeyTypeDomain() const
-{
-    return (key_type == StaticKeys::Domain);
-}
-
-bool
-MatchQuery::isKeyTypeSpecificLabel() const
-{
-    return is_specific_label;
-}
-
-bool
-MatchQuery::isKeyTypeStatic() const
-{
-    return (key_type != StaticKeys::NotStatic);
-}
-
-set<string>
-MatchQuery::getAllKeys() const
-{
-    set<string> keys;
-    if (type == MatchType::Condition) {
-        if (!key.empty()) keys.insert(key);
-        return keys;
-    }
-
-    for (const MatchQuery &inner_match: items) {
-        set<string> iner_keys = inner_match.getAllKeys();
-        keys.insert(iner_keys.begin(), iner_keys.end());
-    }
-
-    return keys;
-}
-
-bool
-MatchQuery::matchAttributes(
-        const unordered_map<string, set<string>> &key_value_pairs,
-        set<string> &matched_override_keywords ) const
-{
-
-    if (type == MatchType::Condition) {
-        auto key_value_pair = key_value_pairs.find(key);
-        if (key_value_pair == key_value_pairs.end()) {
-            dbgTrace(D_RULEBASE_CONFIG) << "Ignoring irrelevant key: " << key;
-            return false;
-        }
-        return matchAttributes(key_value_pair->second, matched_override_keywords);
-    } else if (type == MatchType::Operator && operator_type == Operators::And) {
-        for (const MatchQuery &inner_match: items) {
-            if (!inner_match.matchAttributes(key_value_pairs, matched_override_keywords)) {
-                return false;
-            }
-        }
-        return true;
-    } else if (type == MatchType::Operator && operator_type == Operators::Or) {
-        // With 'or' condition, evaluate matched override keywords first and add the ones that were fully matched
-        set<string> inner_override_keywords;
-        bool res = false;
-        for (const MatchQuery &inner_match: items) {
-            inner_override_keywords.clear();
-            if (inner_match.matchAttributes(key_value_pairs, inner_override_keywords)) {
-                matched_override_keywords.insert(inner_override_keywords.begin(), inner_override_keywords.end());
-                res = true;
-            }
-        }
-        return res;
-    } else {
-        dbgWarning(D_RULEBASE_CONFIG) << "Unsupported match query type";
-    }
-    return false;
-}
-
-MatchQuery::MatchResult
-MatchQuery::getMatch( const unordered_map<string, set<string>> &key_value_pairs) const
-{
-    MatchQuery::MatchResult matches;
-    matches.matched_keywords = make_shared<set<string>>();
-    matches.is_match = matchAttributes(key_value_pairs, *matches.matched_keywords);
-    return matches;
-}
-
-bool
-MatchQuery::matchAttributes(
-        const unordered_map<string, set<string>> &key_value_pairs) const
-{
-    return getMatch(key_value_pairs).is_match;
-}
-
-bool
-MatchQuery::matchAttributes(
-        const set<string> &values,
-        set<string> &matched_override_keywords) const
-{
-    auto &type = condition_type;
-    bool negate = type == MatchQuery::Conditions::NotEquals || type == MatchQuery::Conditions::NotIn;
-    bool match = isRegEx() ? matchAttributesRegEx(values, matched_override_keywords) : matchAttributesString(values);
-    return negate ? !match : match;
-}
-
-bool
-MatchQuery::matchAttributesRegEx(
-        const set<string> &values,
-        set<string> &matched_override_keywords) const
-{
-    bool res = false;
-    boost::cmatch value_matcher;
-    for (const boost::regex &val_regex : regex_values) {
-        for (const string &requested_match_value : values) {
-            if (NGEN::Regex::regexMatch(
-                __FILE__,
-                __LINE__,
-                requested_match_value.c_str(),
-                value_matcher,
-                val_regex))
-            {
-                res = true;
-                if (is_ignore_keyword) {
-                    matched_override_keywords.insert(requested_match_value);
-                } else {
-                    return res;
-                }
-            }
-        }
-    }
-    return res;
-}
-
-bool
-MatchQuery::matchAttributesString(const set<string> &values) const
-{
-    for (const string &requested_value : values) {
-        if (value.find(requested_value) != value.end()) return true;
-    }
-    return false;
-}
-
-bool
-MatchQuery::isRegEx() const
-{
-    return key != "protectionName";
-}

components/generic_rulebase/parameters_config.cc

@@ -1,157 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/parameters_config.h"
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-using namespace std;
-
-bool ParameterException::is_geo_location_exception_exists(false);
-bool ParameterException::is_geo_location_exception_being_loaded(false);
-
-void
-ParameterOverrides::load(cereal::JSONInputArchive &archive_in)
-{
-    parseJSONKey<vector<ParsedBehavior>>("parsedBehavior", parsed_behaviors, archive_in);
-}
-
-void
-ParameterTrustedSources::load(cereal::JSONInputArchive &archive_in)
-{
-    parseJSONKey<uint>("numOfSources", num_of_sources, archive_in);
-    parseJSONKey<vector<SourcesIdentifier>>("sourcesIdentifiers", sources_identidiers, archive_in);
-}
-
-void
-ParameterBehavior::load(cereal::JSONInputArchive &archive_in)
-{
-    string key_string;
-    string val_string;
-    parseJSONKey<string>("id", id, archive_in);
-    parseJSONKey<string>("key", key_string, archive_in);
-    parseJSONKey<string>("value", val_string, archive_in);
-    if (string_to_behavior_key.find(key_string) == string_to_behavior_key.end()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Unsupported behavior key: " << key_string;
-        return;
-    }
-    key = string_to_behavior_key.at(key_string);
-
-    if (string_to_behavior_val.find(val_string) == string_to_behavior_val.end()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Unsupported behavior value: " << val_string;
-        return;
-    }
-    value = string_to_behavior_val.at(val_string);
-}
-
-void
-ParameterAntiBot::load(cereal::JSONInputArchive &archive_in)
-{
-    parseJSONKey<vector<string>>("injected", injected, archive_in);
-    parseJSONKey<vector<string>>("validated", validated, archive_in);
-}
-
-void
-ParameterOAS::load(cereal::JSONInputArchive &archive_in)
-{
-    parseJSONKey<string>("value", value, archive_in);
-}
-
-void
-ParameterException::MatchBehaviorPair::load(cereal::JSONInputArchive &archive_in)
-{
-    parseJSONKey<MatchQuery>("match", match, archive_in);
-    parseJSONKey<ParameterBehavior>("behavior", behavior, archive_in);
-}
-
-void
-ParameterException::load(cereal::JSONInputArchive &archive_in)
-{
-    try {
-        archive_in(
-            cereal::make_nvp("match", match),
-            cereal::make_nvp("behavior", behavior)
-        );
-    } catch (...) {
-        parseJSONKey<vector<MatchBehaviorPair>>("exceptions", match_queries, archive_in);
-    }
-
-    function<bool(const MatchQuery &)> isGeoLocationExists =
-        [&](const MatchQuery &query)
-        {
-            if (query.getKey() == "countryCode" || query.getKey() == "countryName") {
-                is_geo_location_exception_being_loaded = true;
-                return true;
-            }
-
-            for (const MatchQuery &query_item : query.getItems()) {
-                if (isGeoLocationExists(query_item)) return true;
-            }
-
-            return false;
-        };
-
-    if (isGeoLocationExists(match)) return;
-    for (const MatchBehaviorPair &match_query : match_queries) {
-        if (isGeoLocationExists(match_query.match)) return;
-    }
-}
-
-set<ParameterBehavior>
-ParameterException::getBehavior(
-        const unordered_map<string, set<string>> &key_value_pairs,
-        set<string> &matched_override_keywords) const
-{
-    set<ParameterBehavior> matched_behaviors;
-
-    matched_override_keywords.clear();
-    dbgTrace(D_RULEBASE_CONFIG) << "Matching exception";
-    for (const MatchBehaviorPair &match_behavior_pair: match_queries) {
-        MatchQuery::MatchResult match_res = match_behavior_pair.match.getMatch(key_value_pairs);
-        if (match_res.is_match) {
-            dbgTrace(D_RULEBASE_CONFIG) << "Successfully matched an exception from a list of matches.";
-            // When matching indicators with action=ignore, we expect no behavior override.
-            // Instead, a matched keywords list should be returned which will be later removed from score calculation
-            if (match_res.matched_keywords->size() > 0 && match_behavior_pair.behavior == action_ignore) {
-                matched_override_keywords.insert(match_res.matched_keywords->begin(),
-                        match_res.matched_keywords->end());
-            } else {
-                matched_behaviors.insert(match_behavior_pair.behavior);
-            }
-        }
-    }
-
-    if (match_queries.empty()) {
-        MatchQuery::MatchResult match_res = match.getMatch(key_value_pairs);
-        if (match_res.is_match) {
-            dbgTrace(D_RULEBASE_CONFIG) << "Successfully matched an exception.";
-            // When matching indicators with action=ignore, we expect no behavior override.
-            // Instead, a matched keywords list should be returned which will be later removed from score calculation
-            if (match_res.matched_keywords->size() > 0 && behavior == action_ignore) {
-                matched_override_keywords.insert(match_res.matched_keywords->begin(),
-                        match_res.matched_keywords->end());
-            } else {
-                matched_behaviors.insert(behavior);
-            }
-        }
-    }
-
-    return matched_behaviors;
-}
-
-set<ParameterBehavior>
-ParameterException::getBehavior(const unordered_map<string, set<string>> &key_value_pairs) const
-{
-    set<string> keywords;
-    return getBehavior(key_value_pairs, keywords);
-}

components/generic_rulebase/rulebase_config.cc

@@ -1,79 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/rulebase_config.h"
-
-#include "telemetry.h"
-#include "config.h"
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-using namespace std;
-
-set<string> BasicRuleConfig::assets_ids{};
-set<string> BasicRuleConfig::assets_ids_aggregation{};
-
-void
-BasicRuleConfig::load(cereal::JSONInputArchive &ar)
-{
-    parseJSONKey<vector<RulePractice>>("practices", practices, ar);
-    parseJSONKey<vector<RuleTrigger>>("triggers", triggers, ar);
-    parseJSONKey<vector<RuleParameter>>("parameters", parameters, ar);
-    parseJSONKey<uint8_t>("priority", priority, ar);
-    parseJSONKey<string>("ruleId", rule_id, ar);
-    parseJSONKey<string>("ruleName", rule_name, ar);
-    parseJSONKey<string>("assetId", asset_id, ar);
-    parseJSONKey<string>("assetName", asset_name, ar);
-    parseJSONKey<string>("zoneId", zone_id, ar);
-    parseJSONKey<string>("zoneName", zone_name, ar);
-
-    assets_ids_aggregation.insert(asset_id);
-}
-
-void
-BasicRuleConfig::updateCountMetric()
-{
-    BasicRuleConfig::assets_ids = BasicRuleConfig::assets_ids_aggregation;
-    AssetCountEvent(AssetType::ALL, BasicRuleConfig::assets_ids.size()).notify();
-}
-
-bool
-BasicRuleConfig::isPracticeActive(const string &practice_id) const
-{
-    for (auto practice: practices) {
-        if (practice.getId() == practice_id) return true;
-    }
-    return false;
-}
-
-bool
-BasicRuleConfig::isTriggerActive(const string &trigger_id) const
-{
-    for (auto trigger: triggers) {
-        if (trigger.getId() == trigger_id) {
-            return true;
-        }
-    }
-    return false;
-}
-
-bool
-BasicRuleConfig::isParameterActive(const string &parameter_id) const
-{
-    for (auto param: parameters) {
-        if (param.getId() == parameter_id) {
-            return true;
-        }
-    }
-    return false;
-}

components/generic_rulebase/triggers_config.cc

@@ -1,243 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include <string>
-#include <map>
-
-#include "generic_rulebase/triggers_config.h"
-#include "generic_rulebase/generic_rulebase_utils.h"
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-using namespace std;
-
-WebTriggerConf::WebTriggerConf() :  response_title(""), response_body(""), response_code(0) {}
-WebTriggerConf::WebTriggerConf(const string &title, const string &body, uint code)
-        :
-    response_title(title),
-    response_body(body),
-    response_code(code)
-{}
-
-WebTriggerConf WebTriggerConf::default_trigger_conf = WebTriggerConf(
-    "Attack blocked by web application protection",                                     // title
-    "Check Point's <b>Application Security</b> has detected an attack and blocked it.", // body
-    403
-);
-
-void
-WebTriggerConf::load(cereal::JSONInputArchive &archive_in)
-{
-    try {
-        parseJSONKey<string>("details level", details_level, archive_in);
-        if (details_level == "Redirect") {
-            parseJSONKey<string>("redirect URL", redirect_url, archive_in);
-            parseJSONKey<bool>("xEventId", add_event_id_to_header, archive_in);
-            parseJSONKey<bool>("eventIdInHeader", add_event_id_to_header, archive_in);
-            return;
-        }
-        parseJSONKey<uint>("response code", response_code, archive_in);
-        if (response_code < 100 || response_code > 599) {
-            throw cereal::Exception(
-                "illegal web trigger response code: " +
-                to_string(response_code) +
-                " is out of range (100-599)"
-            );
-        }
-
-        if (details_level == "Response Code") return;
-
-        parseJSONKey<string>("response body", response_body, archive_in);
-        parseJSONKey<string>("response title", response_title, archive_in);
-    } catch (const exception &e) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to parse the web trigger configuration: '" << e.what() << "'";
-        archive_in.setNextName(nullptr);
-    }
-}
-
-bool
-WebTriggerConf::operator==(const WebTriggerConf &other) const
-{
-    return
-        response_code == other.response_code &&
-        response_title == other.response_title &&
-        response_body == other.response_body;
-}
-
-LogTriggerConf::LogTriggerConf(string trigger_name, bool log_detect, bool log_prevent) : name(trigger_name)
-{
-    if (log_detect) should_log_on_detect.setAll();
-    if (log_prevent) should_log_on_prevent.setAll();
-    active_streams.setFlag(ReportIS::StreamType::JSON_FOG);
-    active_streams.setFlag(ReportIS::StreamType::JSON_LOG_FILE);
-}
-
-ReportIS::Severity
-LogTriggerConf::getSeverity(bool is_action_drop_or_prevent) const
-{
-    return is_action_drop_or_prevent ? ReportIS::Severity::MEDIUM : ReportIS::Severity::LOW;
-}
-
-ReportIS::Priority
-LogTriggerConf::getPriority(bool is_action_drop_or_prevent) const
-{
-    return is_action_drop_or_prevent ? ReportIS::Priority::HIGH : ReportIS::Priority::MEDIUM;
-}
-
-Flags<ReportIS::StreamType>
-LogTriggerConf::getStreams(SecurityType security_type, bool is_action_drop_or_prevent) const
-{
-    if (is_action_drop_or_prevent && should_log_on_prevent.isSet(security_type)) return active_streams;
-    if (!is_action_drop_or_prevent && should_log_on_detect.isSet(security_type)) return active_streams;
-
-    return Flags<ReportIS::StreamType>();
-}
-
-Flags<ReportIS::Enreachments>
-LogTriggerConf::getEnrechments(SecurityType security_type) const
-{
-    Flags<ReportIS::Enreachments> enreachments;
-
-    if (log_geo_location.isSet(security_type)) enreachments.setFlag(ReportIS::Enreachments::GEOLOCATION);
-    if (should_format_output) enreachments.setFlag(ReportIS::Enreachments::BEAUTIFY_OUTPUT);
-
-    return enreachments;
-}
-
-template <typename EnumClass>
-static void
-setTriggersFlag(const string &key, cereal::JSONInputArchive &ar, EnumClass flag, Flags<EnumClass> &flags)
-{
-    bool value = false;
-    parseJSONKey<bool>(key, value, ar);
-    if (value) flags.setFlag(flag);
-}
-
-static void
-setLogConfiguration(
-    const ReportIS::StreamType &log_type,
-    const string &log_server_url = "",
-    const string &protocol = ""
-)
-{
-    dbgTrace(D_RULEBASE_CONFIG) << "log server url:" << log_server_url;
-    if (log_server_url != "" && protocol != "") {
-        Singleton::Consume<I_Logging>::by<LogTriggerConf>()->addStream(log_type, log_server_url, protocol);
-    } else {
-        Singleton::Consume<I_Logging>::by<LogTriggerConf>()->addStream(log_type);
-    }
-}
-
-static string
-parseProtocolWithDefault(
-    const std::string &default_value,
-    const std::string &key_name,
-    cereal::JSONInputArchive &archive_in
-)
-{
-    string value;
-    try {
-        archive_in(cereal::make_nvp(key_name, value));
-    } catch (const cereal::Exception &e) {
-        return default_value;
-    }
-    return value;
-}
-
-void
-LogTriggerConf::load(cereal::JSONInputArchive& archive_in)
-{
-    try {
-        parseJSONKey<string>("triggerName", name, archive_in);
-        parseJSONKey<string>("verbosity", verbosity, archive_in);
-        parseJSONKey<string>("urlForSyslog", url_for_syslog, archive_in);
-        parseJSONKey<string>("urlForCef", url_for_cef, archive_in);
-        parseJSONKey<string>("syslogProtocol", syslog_protocol, archive_in);
-        syslog_protocol = parseProtocolWithDefault("UDP", "syslogProtocol", archive_in);
-        cef_protocol = parseProtocolWithDefault("UDP", "cefProtocol", archive_in);
-
-        setTriggersFlag("webBody",  archive_in, WebLogFields::webBody, log_web_fields);
-        setTriggersFlag("webHeaders", archive_in, WebLogFields::webHeaders, log_web_fields);
-        setTriggersFlag("webRequests", archive_in, WebLogFields::webRequests, log_web_fields);
-        setTriggersFlag("webUrlPath", archive_in, WebLogFields::webUrlPath, log_web_fields);
-        setTriggersFlag("webUrlQuery", archive_in, WebLogFields::webUrlQuery, log_web_fields);
-        setTriggersFlag("logToAgent", archive_in, ReportIS::StreamType::JSON_LOG_FILE, active_streams);
-        setTriggersFlag("logToCloud", archive_in, ReportIS::StreamType::JSON_FOG, active_streams);
-        setTriggersFlag("logToK8sService", archive_in, ReportIS::StreamType::JSON_K8S_SVC, active_streams);
-        setTriggersFlag("logToSyslog", archive_in, ReportIS::StreamType::SYSLOG, active_streams);
-        setTriggersFlag("logToCef", archive_in, ReportIS::StreamType::CEF, active_streams);
-        setTriggersFlag("acAllow", archive_in, SecurityType::AccessControl, should_log_on_detect);
-        setTriggersFlag("acDrop", archive_in, SecurityType::AccessControl, should_log_on_prevent);
-        setTriggersFlag("tpDetect", archive_in, SecurityType::ThreatPrevention, should_log_on_detect);
-        setTriggersFlag("tpPrevent", archive_in, SecurityType::ThreatPrevention, should_log_on_prevent);
-        setTriggersFlag("complianceWarnings", archive_in, SecurityType::Compliance, should_log_on_detect);
-        setTriggersFlag("complianceViolations", archive_in, SecurityType::Compliance, should_log_on_prevent);
-        setTriggersFlag("acLogGeoLocation", archive_in, SecurityType::AccessControl, log_geo_location);
-        setTriggersFlag("tpLogGeoLocation", archive_in, SecurityType::ThreatPrevention, log_geo_location);
-        setTriggersFlag("complianceLogGeoLocation", archive_in, SecurityType::Compliance, log_geo_location);
-
-        bool extend_logging = false;
-        parseJSONKey<bool>("extendLogging", extend_logging, archive_in);
-        if (extend_logging) {
-            setTriggersFlag("responseCode", archive_in, WebLogFields::responseCode, log_web_fields);
-            setTriggersFlag("responseBody", archive_in, WebLogFields::responseBody, log_web_fields);
-
-            string severity;
-            static const map<string, extendLoggingSeverity> extend_logging_severity_strings = {
-                {"High", extendLoggingSeverity::High},
-                {"Critical", extendLoggingSeverity::Critical}
-            };
-            parseJSONKey<string>("extendLoggingMinSeverity", severity, archive_in);
-            auto extended_severity = extend_logging_severity_strings.find(severity);
-            if (extended_severity != extend_logging_severity_strings.end()) {
-                extend_logging_severity = extended_severity->second;
-            } else {
-                dbgWarning(D_RULEBASE_CONFIG)
-                    << "Failed to parse the extendLoggingMinSeverityfield: '"
-                    << severity
-                    << "'";
-            }
-        }
-
-        for (ReportIS::StreamType log_stream : makeRange<ReportIS::StreamType>()) {
-            if (!active_streams.isSet(log_stream)) continue;
-            switch (log_stream) {
-                case ReportIS::StreamType::JSON_DEBUG:
-                    setLogConfiguration(ReportIS::StreamType::JSON_DEBUG);
-                    break;
-                case ReportIS::StreamType::JSON_FOG:
-                    setLogConfiguration(ReportIS::StreamType::JSON_FOG);
-                    break;
-                case ReportIS::StreamType::JSON_LOG_FILE:
-                    setLogConfiguration(ReportIS::StreamType::JSON_LOG_FILE);
-                    break;
-                case ReportIS::StreamType::JSON_K8S_SVC:
-                    setLogConfiguration(ReportIS::StreamType::JSON_K8S_SVC);
-                    break;
-                case ReportIS::StreamType::SYSLOG:
-                    setLogConfiguration(ReportIS::StreamType::SYSLOG, getUrlForSyslog(), syslog_protocol);
-                    break;
-                case ReportIS::StreamType::CEF:
-                    setLogConfiguration(ReportIS::StreamType::CEF, getUrlForCef(), cef_protocol);
-                    break;
-                case ReportIS::StreamType::NONE: break;
-                case ReportIS::StreamType::COUNT: break;
-            }
-        }
-
-        parseJSONKey<bool>("formatLoggingOutput", should_format_output, archive_in);
-    } catch (const exception &e) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to parse the log trigger configuration: '" << e.what() << "'";
-        archive_in.setNextName(nullptr);
-    }
-}

components/generic_rulebase/zone.cc

@@ -1,179 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/zone.h"
-
-#include <set>
-#include <vector>
-#include <string>
-
-using namespace std;
-
-static const unordered_map<string, Zone::Direction> string_to_direction = {
-    { "to", Zone::Direction::To },
-    { "from", Zone::Direction::From },
-    { "bidirectional", Zone::Direction::Bidirectional }
-};
-
-class AdjacentZone
-{
-public:
-    void
-    load(cereal::JSONInputArchive &archive_in)
-    {
-        string direction_as_string;
-        archive_in(cereal::make_nvp("direction", direction_as_string));
-        archive_in(cereal::make_nvp("zoneId", id));
-        auto maybe_direction = string_to_direction.find(direction_as_string);
-        if (maybe_direction == string_to_direction.end()) {
-            reportConfigurationError(
-                "Illegal direction provided for adjacency. Provided direction in configuration: " +
-                direction_as_string
-            );
-        }
-        dir = maybe_direction->second;
-    }
-
-    pair<Zone::Direction, GenericConfigId> getValue() const { return make_pair(dir, id); }
-
-private:
-    Zone::Direction dir;
-    GenericConfigId id;
-};
-
-class TagsValues
-{
-public:
-    static const string req_attrs_ctx_key;
-
-    TagsValues() {}
-
-    template <typename Archive>
-    void
-    serialize(Archive &ar)
-    {
-        I_Environment *env = Singleton::Consume<I_Environment>::by<Zone>();
-        auto req_attrs = env->get<set<string>>(req_attrs_ctx_key);
-        if (!req_attrs.ok()) return;
-
-        for (const string &req_attr : *req_attrs) {
-            try {
-                string data;
-                ar(cereal::make_nvp(req_attr, data));
-                dbgDebug(D_RULEBASE_CONFIG)
-                    << "Found value for requested attribute. Tag: "
-                    << req_attr
-                    << ", Value: "
-                    << data;
-
-                tags_set[req_attr].insert(data);
-            } catch (const exception &e) {
-                dbgDebug(D_RULEBASE_CONFIG) << "Could not find values for requested attribute. Tag: " << req_attr;
-                ar.setNextName(nullptr);
-            }
-        }
-    }
-
-    bool
-    matchValueByKey(const string &requested_key, const unordered_set<string> &possible_values) const
-    {
-        auto values = tags_set.find(requested_key);
-        if (values == tags_set.end()) return false;
-
-        for (const string &val : possible_values) {
-            if (values->second.count(val)) return true;
-        }
-        return false;
-    }
-
-    void
-    insert(const TagsValues &other)
-    {
-        for (auto &single_tags_value : other.getData()) {
-            tags_set[single_tags_value.first].insert(single_tags_value.second.begin(), single_tags_value.second.end());
-        }
-    }
-
-    const unordered_map<string, set<string>> & getData() const { return tags_set; }
-
-private:
-    unordered_map<string, set<string>> tags_set;
-};
-
-const string TagsValues::req_attrs_ctx_key = "requested attributes key";
-
-void
-Zone::load(cereal::JSONInputArchive &archive_in)
-{
-    archive_in(cereal::make_nvp("id", zone_id));
-    archive_in(cereal::make_nvp("name", zone_name));
-    vector<AdjacentZone> adjacency;
-    try {
-        archive_in(cereal::make_nvp("adjacentZones", adjacency));
-    } catch (const cereal::Exception &) {
-        dbgTrace(D_RULEBASE_CONFIG)
-            << "List of adjacentZones does not exist for current object. Zone id: "
-            << zone_id
-            << ", Zone name: "
-            << zone_name;
-
-        archive_in.setNextName(nullptr);
-    }
-
-    for (const AdjacentZone &zone : adjacency) {
-        adjacent_zones.push_back(zone.getValue());
-    }
-
-    archive_in(cereal::make_nvp("match", match_query));
-
-    is_any =
-        match_query.getType() == MatchQuery::MatchType::Condition &&
-        match_query.getKey() == "any" &&
-        match_query.getValue().count("any") > 0;
-
-    set<string> keys = match_query.getAllKeys();
-}
-
-const string
-contextKeyToString(Context::MetaDataType type)
-{
-    if (type == Context::MetaDataType::SubjectIpAddr || type == Context::MetaDataType::OtherIpAddr) return "ip";
-    return Context::convertToString(type);
-}
-
-bool
-Zone::contains(const Asset &asset)
-{
-    QueryRequest request;
-
-    for (const auto &main_attr : asset.getAttrs()) {
-        request.addCondition(Condition::EQUALS, contextKeyToString(main_attr.first), main_attr.second);
-    }
-
-    ScopedContext req_attrs_key;
-    req_attrs_key.registerValue<set<string>>(TagsValues::req_attrs_ctx_key, match_query.getAllKeys());
-
-    I_Intelligence_IS_V2 *intelligence = Singleton::Consume<I_Intelligence_IS_V2>::by<Zone>();
-    auto query_res = intelligence->queryIntelligence<TagsValues>(request);
-    if (!query_res.ok()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to perform intelligence query. Error: " << query_res.getErr();
-        return false;
-    }
-
-    for (const AssetReply<TagsValues> &asset : query_res.unpack()) {
-        TagsValues tag_values = asset.mergeReplyData();
-
-        if (match_query.matchAttributes(tag_values.getData())) return true;
-    }
-    return false;
-}

components/generic_rulebase/zones_config.cc

@@ -1,114 +0,0 @@
-// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
-
-// Licensed under the Apache License, Version 2.0 (the "License");
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#include "generic_rulebase/zones_config.h"
-
-#include <string>
-#include <unordered_map>
-
-#include "generic_rulebase/generic_rulebase_utils.h"
-#include "config.h"
-#include "ip_utilities.h"
-#include "connkey.h"
-#include "i_generic_rulebase.h"
-
-USE_DEBUG_FLAG(D_RULEBASE_CONFIG);
-
-using namespace std;
-
-void
-ZonesConfig::load(cereal::JSONInputArchive &archive_in)
-{
-    dbgFlow(D_RULEBASE_CONFIG) << "Saving active zones";
-    set<string> used_zones;
-    cereal::load(archive_in, used_zones);
-
-    dbgTrace(D_RULEBASE_CONFIG) << "Loading all zones";
-    auto all_zones_maybe = getSetting<Zones>("rulebase", "zones");
-    if (!all_zones_maybe.ok()) {
-        dbgWarning(D_RULEBASE_CONFIG) << "Failed to load zones";
-        return;
-    }
-
-    dbgTrace(D_RULEBASE_CONFIG) << "Creating cache of all zones by ID";
-    map<GenericConfigId, Zone> all_zones;
-    for (const auto &single_zone : all_zones_maybe.unpack().zones) {
-        if (used_zones.count(single_zone.getId()) > 0 && single_zone.isAnyZone()) {
-            dbgTrace(D_RULEBASE_CONFIG) << "Found used zone of type \"Any\": saving all zones as active zones";
-            zones = all_zones_maybe.unpack().zones;
-            return;
-        }
-
-        dbgDebug(D_RULEBASE_CONFIG)
-            << "Adding specific zone to cache. Zone ID: "
-            << single_zone.getId()
-            << ", name: "
-            << single_zone.getName();
-        all_zones.emplace(single_zone.getId(), single_zone);
-    }
-
-    dbgTrace(D_RULEBASE_CONFIG) << "Creating list of active zones";
-    map<GenericConfigId, Zone> active_zones_set;
-    for (const auto &single_used_zone_id : used_zones) {
-        const auto &found_zone = all_zones[single_used_zone_id];
-        dbgTrace(D_RULEBASE_CONFIG)
-            << "Adding zone to list of active zones. Zone ID: "
-            << single_used_zone_id
-            << ", zone name: "
-            << found_zone.getName();
-        active_zones_set.emplace(found_zone.getId(), found_zone);
-
-        for (const auto &adjacent_zone : found_zone.getAdjacentZones()) {
-            const auto &adjacent_zone_obj = all_zones[adjacent_zone.second];
-            dbgTrace(D_RULEBASE_CONFIG)
-                << "Adding adjacent zone to list of active zones. Zone ID: "
-                << adjacent_zone_obj.getId()
-                << ", zone name: "
-                << adjacent_zone_obj.getName();
-            active_zones_set.emplace(adjacent_zone_obj.getId(), adjacent_zone_obj);
-        }
-    }
-
-    vector<GenericConfigId> implied_zones = {
-        "impliedAzure",
-        "impliedDNS",
-        "impliedSSH",
-        "impliedProxy",
-        "impliedFog"
-    };
-
-    GenericConfigId any_zone_id = "";
-    for (const auto &single_zone : all_zones_maybe.unpack().zones) {
-        if (single_zone.isAnyZone()) any_zone_id = single_zone.getId();
-    }
-    for (GenericConfigId &implied_id: implied_zones) {
-        if (all_zones.find(implied_id) != all_zones.end()) {
-            dbgDebug(D_RULEBASE_CONFIG) << "Adding implied zone to cache. Zone ID: " << implied_id;
-            active_zones_set.emplace(implied_id, all_zones[implied_id]);
-            if (any_zone_id != "" && active_zones_set.count(any_zone_id) == 0) {
-                active_zones_set.emplace(any_zone_id, all_zones[any_zone_id]);
-            }
-        }
-    }
-
-    for (const auto &single_id_zone_pair : active_zones_set) {
-        zones.push_back(single_id_zone_pair.second);
-    }
-}
-
-void
-ZonesConfig::preload()
-{
-    registerExpectedSetting<Zones>("rulebase", "zones");
-    registerExpectedSetting<ZonesConfig>("rulebase", "usedZones");
-}

components/gradual_deployment/gradual_deployment.cc

@@ -128,7 +128,7 @@ private:
                 break;
             }
             default:
-                dbgAssert(false) << "Unsupported IP type";
+                dbgAssert(false) << AlertInfo(AlertTeam::CORE, "gradual deployment") << "Unsupported IP type";
         }
         return address;
     }
@@ -142,7 +142,7 @@ private:
         if (temp_params_list.size() == 1) {
             Maybe<IPAddr> maybe_ip = IPAddr::createIPAddr(temp_params_list[0]);
             if (!maybe_ip.ok()) return genError("Could not create IP address, " + maybe_ip.getErr());
-            IpAddress addr = move(ConvertToIpAddress(maybe_ip.unpackMove()));
+            IpAddress addr = ConvertToIpAddress(maybe_ip.unpackMove());
 
             return move(IPRange{.start = addr, .end = addr});
         }
@@ -157,11 +157,11 @@ private:
             IPAddr max_addr = maybe_ip_max.unpackMove();
             if (min_addr > max_addr) return genError("Could not create ip range - start greater then end");
 
-            IpAddress addr_min = move(ConvertToIpAddress(move(min_addr)));
-            IpAddress addr_max = move(ConvertToIpAddress(move(max_addr)));
+            IpAddress addr_min = ConvertToIpAddress(move(min_addr));
+            IpAddress addr_max = ConvertToIpAddress(move(max_addr));
             if (addr_max.ip_type != addr_min.ip_type) return genError("Range IP's type does not match");
 
-            return move(IPRange{.start = move(addr_min), .end = move(addr_max)});
+            return IPRange{.start = move(addr_min), .end = move(addr_max)};
         }
 
         return genError("Illegal range received: " + range);

components/health_check_manager/health_check_manager_ut/CMakeLists.txt

@@ -1,8 +0,0 @@
-include_directories(${CMAKE_SOURCE_DIR}/components/include)
-link_directories(${BOOST_ROOT}/lib)
-
-add_unit_test(
-    health_check_manager_ut
-    "health_check_manager_ut.cc"
-    "singleton;messaging;mainloop;health_check_manager;event_is;metric;-lboost_regex"
-)

components/http_manager/http_manager.cc

@@ -15,19 +15,18 @@
 
 #include <string>
 #include <map>
-#include <sys/stat.h>
-#include <climits>
 #include <unordered_map>
-#include <boost/range/iterator_range.hpp>
+#include <unordered_set>
+#include <boost/algorithm/string.hpp>
 #include <fstream>
 #include <algorithm>
 
 #include "common.h"
 #include "config.h"
-#include "table_opaque.h"
 #include "http_manager_opaque.h"
 #include "log_generator.h"
 #include "http_inspection_events.h"
+#include "agent_core_utilities.h"
 
 USE_DEBUG_FLAG(D_HTTP_MANAGER);
 
@@ -38,6 +37,7 @@ operator<<(ostream &os, const EventVerdict &event)
 {
     switch (event.getVerdict()) {
         case ngx_http_cp_verdict_e::TRAFFIC_VERDICT_INSPECT: return os << "Inspect";
+        case ngx_http_cp_verdict_e::LIMIT_RESPONSE_HEADERS: return os << "Limit Response Headers";
         case ngx_http_cp_verdict_e::TRAFFIC_VERDICT_ACCEPT: return os << "Accept";
         case ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP: return os << "Drop";
         case ngx_http_cp_verdict_e::TRAFFIC_VERDICT_INJECT: return os << "Inject";
@@ -46,7 +46,10 @@ operator<<(ostream &os, const EventVerdict &event)
         case ngx_http_cp_verdict_e::TRAFFIC_VERDICT_WAIT: return os << "Wait";
     }
 
-    dbgAssert(false) << "Illegal Event Verdict value: " << static_cast<uint>(event.getVerdict());
+    dbgAssert(false)
+        << AlertInfo(AlertTeam::CORE, "http manager")
+        << "Illegal Event Verdict value: "
+        << static_cast<uint>(event.getVerdict());
     return os;
 }
 
@@ -91,12 +94,14 @@ public:
         ctx.registerValue(app_sec_marker_key, i_transaction_table->keyToString(), EnvKeyAttr::LogSection::MARKER);
 
         HttpManagerOpaque &state = i_transaction_table->getState<HttpManagerOpaque>();
-        string event_key = static_cast<string>(event.getKey());
-        if (event_key == getProfileAgentSettingWithDefault<string>("", "agent.customHeaderValueLogging")) {
+        
+        const auto &custom_header = getProfileAgentSettingWithDefault<string>("", "agent.customHeaderValueLogging");
+        
+        if (event.getKey().isEqualLowerCase(custom_header)) {
             string event_value = static_cast<string>(event.getValue());
             dbgTrace(D_HTTP_MANAGER)
                 << "Found header key and value - ("
-                << event_key
+                << custom_header
                 << ": "
                 << event_value
                 << ") that matched agent settings";
@@ -192,7 +197,6 @@ public:
         if (state.getUserDefinedValue().ok()) {
             ctx.registerValue("UserDefined", state.getUserDefinedValue().unpack(), EnvKeyAttr::LogSection::DATA);
         }
-
         return handleEvent(EndRequestEvent().performNamedQuery());
     }
 
@@ -320,9 +324,13 @@ private:
                 << respond.second.getVerdict();
 
             state.setApplicationVerdict(respond.first, respond.second.getVerdict());
+            state.setApplicationWebResponse(respond.first, respond.second.getWebUserResponseByPractice());
         }
-
-        return state.getCurrVerdict();
+        FilterVerdict aggregated_verdict(state.getCurrVerdict(), state.getCurrWebUserResponse());
+        if (aggregated_verdict.getVerdict() == ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP) {
+            SecurityAppsDropEvent(state.getCurrentDropVerdictCausers()).notify();
+        }
+        return aggregated_verdict;
     }
 
     static void

components/http_manager/http_manager_opaque.cc

@@ -32,6 +32,13 @@ HttpManagerOpaque::setApplicationVerdict(const string &app_name, ngx_http_cp_ver
     applications_verdicts[app_name] = verdict;
 }
 
+void
+HttpManagerOpaque::setApplicationWebResponse(const string &app_name, string web_user_response_id)
+{
+    dbgTrace(D_HTTP_MANAGER) << "Security app: " << app_name << ", has web user response: " << web_user_response_id;
+    applications_web_user_response[app_name] = web_user_response_id;
+}
+
 ngx_http_cp_verdict_e
 HttpManagerOpaque::getApplicationsVerdict(const string &app_name) const
 {
@@ -51,8 +58,12 @@ HttpManagerOpaque::getCurrVerdict() const
     for (const auto &app_verdic_pair : applications_verdicts) {
         switch (app_verdic_pair.second) {
             case ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP:
+                dbgTrace(D_HTTP_MANAGER) << "Verdict DROP for app: " << app_verdic_pair.first;
+                current_web_user_response = applications_web_user_response.at(app_verdic_pair.first);
+                dbgTrace(D_HTTP_MANAGER) << "current_web_user_response=" << current_web_user_response;
                 return app_verdic_pair.second;
             case ngx_http_cp_verdict_e::TRAFFIC_VERDICT_INJECT:
+                // Sent in ResponseHeaders and ResponseBody.
                 verdict = ngx_http_cp_verdict_e::TRAFFIC_VERDICT_INJECT;
                 break;
             case ngx_http_cp_verdict_e::TRAFFIC_VERDICT_ACCEPT:
@@ -60,15 +71,21 @@ HttpManagerOpaque::getCurrVerdict() const
                 break;
             case ngx_http_cp_verdict_e::TRAFFIC_VERDICT_INSPECT:
                 break;
+            case ngx_http_cp_verdict_e::LIMIT_RESPONSE_HEADERS:
+                // Sent in End Request.
+                verdict = ngx_http_cp_verdict_e::LIMIT_RESPONSE_HEADERS;
+                break;
             case ngx_http_cp_verdict_e::TRAFFIC_VERDICT_IRRELEVANT:
                 dbgTrace(D_HTTP_MANAGER) << "Verdict 'Irrelevant' is not yet supported. Returning Accept";
                 accepted_apps++;
                 break;
             case ngx_http_cp_verdict_e::TRAFFIC_VERDICT_WAIT:
+                // Sent in Request Headers and Request Body.
                 verdict = ngx_http_cp_verdict_e::TRAFFIC_VERDICT_WAIT;
                 break;
             default:
                 dbgAssert(false)
+                    << AlertInfo(AlertTeam::CORE, "http manager")
                     << "Received unknown verdict "
                     << static_cast<int>(app_verdic_pair.second);
         }
@@ -77,6 +94,25 @@ HttpManagerOpaque::getCurrVerdict() const
     return accepted_apps == applications_verdicts.size() ? ngx_http_cp_verdict_e::TRAFFIC_VERDICT_ACCEPT : verdict;
 }
 
+std::set<std::string>
+HttpManagerOpaque::getCurrentDropVerdictCausers() const
+{
+    std::set<std::string> causers;
+    if (manager_verdict == ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP) {
+        causers.insert(HTTP_MANAGER_NAME);
+    }
+    for (const auto &app_verdic_pair : applications_verdicts) {
+        bool was_dropped = app_verdic_pair.second == ngx_http_cp_verdict_e::TRAFFIC_VERDICT_DROP;
+        dbgTrace(D_HTTP_MANAGER)
+            << "The verdict from: " << app_verdic_pair.first
+            << (was_dropped ? " is \"drop\"" : " is not \"drop\" ");
+        if (was_dropped) {
+            causers.insert(app_verdic_pair.first);
+        }
+    }
+    return causers;
+}
+
 void
 HttpManagerOpaque::saveCurrentDataToCache(const Buffer &full_data)
 {

components/http_manager/http_manager_opaque.h

@@ -20,16 +20,21 @@
 #include "table_opaque.h"
 #include "nginx_attachment_common.h"
 
+static const std::string HTTP_MANAGER_NAME = "HTTP Manager";
+
 class HttpManagerOpaque : public TableOpaqueSerialize<HttpManagerOpaque>
 {
 public:
     HttpManagerOpaque();
 
     void setApplicationVerdict(const std::string &app_name, ngx_http_cp_verdict_e verdict);
+    void setApplicationWebResponse(const std::string &app_name, std::string web_user_response_id);
     ngx_http_cp_verdict_e getApplicationsVerdict(const std::string &app_name) const;
     void setManagerVerdict(ngx_http_cp_verdict_e verdict) { manager_verdict = verdict; }
     ngx_http_cp_verdict_e getManagerVerdict() const { return manager_verdict; }
     ngx_http_cp_verdict_e getCurrVerdict() const;
+    const std::string & getCurrWebUserResponse() const { return current_web_user_response; };
+    std::set<std::string> getCurrentDropVerdictCausers() const;
     void saveCurrentDataToCache(const Buffer &full_data);
     void setUserDefinedValue(const std::string &value) { user_defined_value = value; }
     Maybe<std::string> getUserDefinedValue() const { return user_defined_value; }
@@ -49,6 +54,8 @@ public:
 
 private:
     std::unordered_map<std::string, ngx_http_cp_verdict_e> applications_verdicts;
+    std::unordered_map<std::string, std::string> applications_web_user_response;
+    mutable std::string current_web_user_response;
     ngx_http_cp_verdict_e manager_verdict = ngx_http_cp_verdict_e::TRAFFIC_VERDICT_INSPECT;
     Buffer prev_data_cache;
     uint aggregated_payload_size = 0;

components/include/central_nginx_manager.h

@@ -0,0 +1,45 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef __CENTRAL_NGINX_MANAGER_H__
+#define __CENTRAL_NGINX_MANAGER_H__
+
+#include "component.h"
+#include "singleton.h"
+#include "i_messaging.h"
+#include "i_rest_api.h"
+#include "i_mainloop.h"
+#include "i_agent_details.h"
+
+class CentralNginxManager
+        :
+    public Component,
+    Singleton::Consume<I_RestApi>,
+    Singleton::Consume<I_Messaging>,
+    Singleton::Consume<I_MainLoop>,
+    Singleton::Consume<I_AgentDetails>
+{
+public:
+    CentralNginxManager();
+    ~CentralNginxManager();
+
+    void preload() override;
+    void init() override;
+    void fini() override;
+
+private:
+    class Impl;
+    std::unique_ptr<Impl> pimpl;
+};
+
+#endif // __CENTRAL_NGINX_MANAGER_H__

components/include/details_resolver.h

@@ -34,6 +34,7 @@ public:
     ~DetailsResolver();
 
     void preload() override;
+    void init() override;
 
 private:
     class Impl;

components/include/downloader.h

@@ -21,6 +21,7 @@
 #include "url_parser.h"
 #include "i_agent_details.h"
 #include "i_mainloop.h"
+#include "i_environment.h"
 #include "singleton.h"
 #include "component.h"
 
@@ -32,6 +33,7 @@ class Downloader
     Singleton::Consume<I_Encryptor>,
     Singleton::Consume<I_MainLoop>,
     Singleton::Consume<I_OrchestrationTools>,
+    Singleton::Consume<I_Environment>,
     Singleton::Consume<I_UpdateCommunication>
 {
 public:

components/include/external_sdk_server.h

@@ -24,7 +24,8 @@ class ExternalSdkServer
         :
     public Component,
     Singleton::Provide<I_ExternalSdkServer>,
-    Singleton::Consume<I_RestApi>
+    Singleton::Consume<I_RestApi>,
+    Singleton::Consume<I_Messaging>
 {
 public:
     ExternalSdkServer();

components/include/generic_rulebase/evaluators/http_transaction_data_eval.h

@@ -45,6 +45,19 @@ private:
     std::string host;
 };
 
+class EqualWafTag : public EnvironmentEvaluator<bool>, Singleton::Consume<I_Environment>
+{
+public:
+EqualWafTag(const std::vector<std::string> &params);
+
+    static std::string getName() { return "EqualWafTag"; }
+
+    Maybe<bool, Context::Error> evalVariable() const override;
+
+private:
+    std::string waf_tag;
+};
+
 class EqualListeningIP : public EnvironmentEvaluator<bool>, Singleton::Consume<I_Environment>
 {
 public:

components/include/generic_rulebase/match_query.h

@@ -89,7 +89,9 @@ private:
     bool matchAttributesRegEx(const std::set<std::string> &values,
             std::set<std::string> &matched_override_keywords) const;
     bool matchAttributesString(const std::set<std::string> &values) const;
+    bool matchAttributesIp(const std::set<std::string> &values) const;
     bool isRegEx() const;
+    void sortAndMergeIpRangesValues();
 
     MatchType type;
     Operators operator_type;

components/include/generic_rulebase/triggers_config.h

@@ -317,12 +317,12 @@ public:
     {
         return url_for_cef;
     }
+    Flags<ReportIS::StreamType> getStreams(SecurityType security_type, bool is_action_drop_or_prevent) const;
+    Flags<ReportIS::Enreachments> getEnrechments(SecurityType security_type) const;
 
 private:
     ReportIS::Severity getSeverity(bool is_action_drop_or_prevent) const;
     ReportIS::Priority getPriority(bool is_action_drop_or_prevent) const;
-    Flags<ReportIS::StreamType> getStreams(SecurityType security_type, bool is_action_drop_or_prevent) const;
-    Flags<ReportIS::Enreachments> getEnrechments(SecurityType security_type) const;
 
     std::string name;
     std::string verbosity;
@@ -339,4 +339,32 @@ private:
     bool should_format_output = false;
 };
 
+class ReportTriggerConf
+{
+public:
+    /// \brief Default constructor for ReportTriggerConf.
+    ReportTriggerConf() {}
+
+    /// \brief Preload function to register expected configuration.
+    static void
+    preload()
+    {
+        registerExpectedConfiguration<ReportTriggerConf>("rulebase", "report");
+    }
+
+    /// \brief Load function to deserialize configuration from JSONInputArchive.
+    /// \param archive_in The JSON input archive.
+    void load(cereal::JSONInputArchive &archive_in);
+
+    /// \brief Get the name.
+    /// \return The name.
+    const std::string &
+    getName() const
+    {
+        return name;
+    }
+private:
+    std::string name;
+};
+
 #endif //__TRIGGERS_CONFIG_H__

components/include/health_checker.h

@@ -21,6 +21,7 @@
 #include "i_shell_cmd.h"
 #include "i_orchestration_status.h"
 #include "component.h"
+#include "i_service_controller.h"
 
 class HealthChecker
         :
@@ -29,7 +30,8 @@ class HealthChecker
     Singleton::Consume<I_Socket>,
     Singleton::Consume<I_Health_Check_Manager>,
     Singleton::Consume<I_ShellCmd>,
-    Singleton::Consume<I_OrchestrationStatus>
+    Singleton::Consume<I_OrchestrationStatus>,
+    Singleton::Consume<I_ServiceController>
 {
 public:
     HealthChecker();

components/include/http_event_impl/filter_verdict.h

@@ -27,9 +27,18 @@ public:
         verdict(_verdict)
     {}
 
+    FilterVerdict(
+        ngx_http_cp_verdict_e _verdict,
+        const std::string &_web_reponse_id)
+            :
+        verdict(_verdict),
+        web_user_response_id(_web_reponse_id)
+    {}
+
     FilterVerdict(const EventVerdict &_verdict, ModifiedChunkIndex _event_idx = -1)
             :
-        verdict(_verdict.getVerdict())
+        verdict(_verdict.getVerdict()),
+        web_user_response_id(_verdict.getWebUserResponseByPractice())
     {
         if (verdict == ngx_http_cp_verdict_e::TRAFFIC_VERDICT_INJECT) {
             addModifications(_verdict.getModifications(), _event_idx);
@@ -59,10 +68,12 @@ public:
     uint getModificationsAmount() const { return total_modifications; }
     ngx_http_cp_verdict_e getVerdict() const { return verdict; }
     const std::vector<EventModifications> & getModifications() const { return modifications; }
+    const std::string getWebUserResponseID() const { return web_user_response_id; }
 
 private:
     ngx_http_cp_verdict_e verdict = ngx_http_cp_verdict_e::TRAFFIC_VERDICT_INSPECT;
     std::vector<EventModifications> modifications;
+    std::string web_user_response_id;
     uint total_modifications = 0;
 };
 

components/include/http_event_impl/i_http_event_impl.h

@@ -50,9 +50,11 @@ public:
         position(mod_position)
     {
         dbgAssert(mod_type != ModificationType::APPEND || position == injection_pos_irrelevant)
+            << AlertInfo(AlertTeam::CORE, "http manager")
             << "Injection position is not applicable to a modification of type \"Append\"";
 
         dbgAssert(mod_type != ModificationType::INJECT || position >= 0)
+            << AlertInfo(AlertTeam::CORE, "http manager")
             << "Invalid injection position: must be non-negative. Position: "
             << position;
     }
@@ -166,6 +168,7 @@ private:
             }
             default:
                 dbgAssert(false)
+                    << AlertInfo(AlertTeam::CORE, "http manager")
                     << "Unknown type of ModificationType: "
                     << static_cast<int>(modification_type);
         }
@@ -236,6 +239,7 @@ public:
     const Buffer & getValue() const { return value; }
 
     bool isLastHeader() const { return is_last_header; }
+    void setIsLastHeader() { is_last_header = true; }
     uint8_t getHeaderIndex() const { return header_index; }
 
 private:
@@ -372,16 +376,31 @@ public:
         verdict(event_verdict)
     {}
 
+    EventVerdict(
+        const ModificationList &mods,
+        ngx_http_cp_verdict_e event_verdict,
+        std::string response_id) :
+        modifications(mods),
+        verdict(event_verdict),
+        webUserResponseByPractice(response_id)
+    {}
+
 // LCOV_EXCL_START - sync functions, can only be tested once the sync module exists
     template <typename T> void serialize(T &ar, uint) { ar(verdict); }
 // LCOV_EXCL_STOP
 
     const ModificationList & getModifications() const { return modifications; }
     ngx_http_cp_verdict_e getVerdict() const { return verdict; }
+    const std::string getWebUserResponseByPractice() const { return webUserResponseByPractice; }
+    void setWebUserResponseByPractice(const std::string id) {
+        dbgTrace(D_HTTP_MANAGER) << "current verdict web user response set to: " << id;
+        webUserResponseByPractice = id;
+    }
 
 private:
     ModificationList modifications;
     ngx_http_cp_verdict_e verdict = ngx_http_cp_verdict_e::TRAFFIC_VERDICT_INSPECT;
+    std::string webUserResponseByPractice;
 };
 
 #endif // __I_HTTP_EVENT_IMPL_H__

components/include/http_geo_filter.h

@@ -15,7 +15,8 @@ class HttpGeoFilter
     public Component,
     Singleton::Consume<I_MainLoop>,
     Singleton::Consume<I_GeoLocation>,
-    Singleton::Consume<I_GenericRulebase>
+    Singleton::Consume<I_GenericRulebase>,
+    Singleton::Consume<I_Environment>
 {
 public:
     HttpGeoFilter();

components/include/http_inspection_events.h

@@ -183,4 +183,16 @@ class WaitTransactionEvent : public Event<WaitTransactionEvent, EventVerdict>
 {
 };
 
+class SecurityAppsDropEvent : public Event<SecurityAppsDropEvent>
+{
+public:
+    SecurityAppsDropEvent(
+        const std::set<std::string> &apps_names)
+            :
+        apps_names(apps_names) {}
+    const std::set<std::string> & getAppsNames() const { return apps_names; }
+
+private:
+    const std::set<std::string> apps_names;
+};
 #endif // __HTTP_INSPECTION_EVENTS_H__

components/include/http_transaction_data.h

@@ -72,7 +72,8 @@ public:
             parsed_uri,
             client_ip,
             client_port,
-            response_content_encoding
+            response_content_encoding,
+            waf_tag
         );
     }
 
@@ -91,7 +92,8 @@ public:
             parsed_uri,
             client_ip,
             client_port,
-            response_content_encoding
+            response_content_encoding,
+            waf_tag
         );
     }
 // LCOV_EXCL_STOP
@@ -122,6 +124,9 @@ public:
         response_content_encoding = _response_content_encoding;
     }
 
+    const std::string & getWafTag() const { return waf_tag; }
+    void setWafTag(const std::string &_waf_tag) { waf_tag = _waf_tag; }
+
     static const std::string http_proto_ctx;
     static const std::string method_ctx;
     static const std::string host_name_ctx;
@@ -136,6 +141,8 @@ public:
     static const std::string req_body;
     static const std::string source_identifier;
     static const std::string proxy_ip_ctx;
+    static const std::string xff_vals_ctx;
+    static const std::string waf_tag_ctx;
 
     static const CompressionType default_response_content_encoding;
 
@@ -152,6 +159,7 @@ private:
     uint16_t client_port;
     bool is_request;
     CompressionType response_content_encoding;
+    std::string waf_tag;
 };
 
 #endif // __HTTP_TRANSACTION_DATA_H__

components/include/i_details_resolver.h

@@ -26,10 +26,13 @@ public:
     virtual Maybe<std::string> getArch() = 0;
     virtual std::string getAgentVersion() = 0;
     virtual bool isKernelVersion3OrHigher() = 0;
+    virtual bool isGw() = 0;
     virtual bool isGwNotVsx() = 0;
     virtual bool isVersionAboveR8110() = 0;
     virtual bool isReverseProxy() = 0;
-    virtual Maybe<std::tuple<std::string, std::string, std::string>> parseNginxMetadata() = 0;
+    virtual bool isCloudStorageEnabled() = 0;
+    virtual Maybe<std::tuple<std::string, std::string, std::string, std::string>> parseNginxMetadata() = 0;
+    virtual Maybe<std::tuple<std::string, std::string, std::string, std::string, std::string>> readCloudMetadata() = 0;
     virtual std::map<std::string, std::string> getResolvedDetails() = 0;
 #if defined(gaia) || defined(smb)
     virtual bool compareCheckpointVersion(int cp_version, std::function<bool(int, int)> compare_operator) const = 0;

components/include/i_downloader.h

@@ -22,7 +22,7 @@
 class I_Downloader
 {
 public:
-    virtual Maybe<std::string> downloadFileFromFog(
+    virtual Maybe<std::string> downloadFile(
         const std::string &checksum,
         Package::ChecksumTypes,
         const GetResourceFile &resourse_file

components/include/i_orchestration_tools.h

@@ -117,7 +117,7 @@ public:
         const std::string &conf_path) const = 0;
     virtual bool copyFile(const std::string &src_path, const std::string &dst_path) const = 0;
     virtual bool doesFileExist(const std::string &file_path) const = 0;
-    virtual void getClusterId() const = 0;
+    virtual void setClusterId() const = 0;
     virtual void fillKeyInJson(
         const std::string &filename,
         const std::string &_key,

components/include/i_service_controller.h

@@ -64,7 +64,9 @@ public:
         const std::string &service_id
     ) = 0;
 
-    virtual std::map<std::string, PortNumber> getServiceToPortMap() = 0;
+    virtual std::map<std::string, std::vector<PortNumber>> getServiceToPortMap() = 0;
+
+    virtual bool getServicesPolicyStatus() const = 0;
 
 protected:
     virtual ~I_ServiceController() {}

components/include/i_update_communication.h

@@ -32,6 +32,7 @@ public:
         const std::string &policy_versions
     ) const = 0;
     virtual Maybe<void> authenticateAgent() = 0;
+    virtual void registerLocalAgentToFog() = 0;
     virtual Maybe<void> getUpdate(CheckUpdateRequest &request) = 0;
     virtual Maybe<std::string> downloadAttributeFile(
         const GetResourceFile &resourse_file,

components/include/i_waap_telemetry.h

@@ -27,6 +27,7 @@ struct DecisionTelemetryData
     int responseCode;
     uint64_t elapsedTime;
     std::set<std::string> attackTypes;
+    bool temperatureDetected;
 
     DecisionTelemetryData() :
         blockType(NOT_BLOCKING),
@@ -38,7 +39,8 @@ struct DecisionTelemetryData
         method(POST),
         responseCode(0),
         elapsedTime(0),
-        attackTypes()
+        attackTypes(),
+        temperatureDetected(false)
     {
     }
 };

components/include/ip_utilities.h

@@ -28,8 +28,9 @@
 
 // LCOV_EXCL_START Reason: temporary until we add relevant UT until 07/10
 bool operator<(const IpAddress &this_ip_addr, const IpAddress &other_ip_addr);
-
 bool operator==(const IpAddress &this_ip_addr, const IpAddress &other_ip_addr);
+bool operator<=(const IpAddress &this_ip_addr, const IpAddress &other_ip_addr);
+bool operator<(const IPRange &range1, const IPRange &range2);
 // LCOV_EXCL_STOP
 
 Maybe<std::pair<std::string, int>> extractAddressAndMaskSize(const std::string &cidr);