Add prometheus support

README.md

@@ -177,7 +177,7 @@ open-appsec code was audited by an independent third party in September-October
 See the [full report](https://github.com/openappsec/openappsec/blob/main/LEXFO-CHP20221014-Report-Code_audit-OPEN-APPSEC-v1.2.pdf).
 
 ### Reporting security vulnerabilities
-If you've found a vulnerability or a potential vulnerability in open-appsec please let us know at security-alert@openappsec.io. We'll send a confirmation email to acknowledge your report within 24 hours, and we'll send an additional email when we've identified the issue positively or negatively.
+If you've found a vulnerability or a potential vulnerability in open-appsec please let us know at securityalert@openappsec.io. We'll send a confirmation email to acknowledge your report within 24 hours, and we'll send an additional email when we've identified the issue positively or negatively.
 
 
 # License

build_system/docker/entry.sh

@@ -7,7 +7,6 @@ ATTACHMENT_REGISTRATION_SERVICE="install-cp-nano-attachment-registration-manager
 ORCHESTRATION_INSTALLATION_SCRIPT="install-cp-nano-agent.sh"
 CACHE_INSTALLATION_SCRIPT="install-cp-nano-agent-cache.sh"
 PROMETHEUS_INSTALLATION_SCRIPT="install-cp-nano-service-prometheus.sh"
-NGINX_CENTRAL_MANAGER_INSTALLATION_SCRIPT="install-cp-nano-central-nginx-manager.sh"
 
 var_fog_address=
 var_proxy=
@@ -87,10 +86,6 @@ if [ "$PROMETHEUS" == "true" ]; then
     /nano-service-installers/$PROMETHEUS_INSTALLATION_SCRIPT --install
 fi
 
-if [ "$CENTRAL_NGINX_MANAGER" == "true" ]; then
-    /nano-service-installers/$NGINX_CENTRAL_MANAGER_INSTALLATION_SCRIPT --install
-fi
-
 if [ "$CROWDSEC_ENABLED" == "true" ]; then
     /nano-service-installers/$INTELLIGENCE_INSTALLATION_SCRIPT --install
     /nano-service-installers/$CROWDSEC_INSTALLATION_SCRIPT --install
@@ -103,16 +98,25 @@ if [ -f "$FILE" ]; then
 fi
 
 touch /etc/cp/watchdog/wd.startup
-/etc/cp/watchdog/cp-nano-watchdog >/dev/null 2>&1 &
-active_watchdog_pid=$!
 while true; do
-    if [ -f /tmp/restart_watchdog ]; then
-        rm -f /tmp/restart_watchdog
-        kill -9 ${active_watchdog_pid}
-    fi
-    if [ ! "$(ps -f | grep cp-nano-watchdog | grep ${active_watchdog_pid})" ]; then
+    if [ -z "$init" ]; then
+        init=true
         /etc/cp/watchdog/cp-nano-watchdog >/dev/null 2>&1 &
-        active_watchdog_pid=$!
+        sleep 5
+        active_watchdog_pid=$(pgrep -f -x -o "/bin/(bash|sh) /etc/cp/watchdog/cp-nano-watchdog")
     fi
+
+    current_watchdog_pid=$(pgrep -f -x -o "/bin/(bash|sh) /etc/cp/watchdog/cp-nano-watchdog")
+    if [ ! -f /tmp/restart_watchdog ] && [ "$current_watchdog_pid" != "$active_watchdog_pid" ]; then
+        echo "Error: Watchdog exited abnormally"
+        exit 1
+    elif [ -f /tmp/restart_watchdog ]; then
+        rm -f /tmp/restart_watchdog
+        kill -9 "$(pgrep -f -x -o "/bin/(bash|sh) /etc/cp/watchdog/cp-nano-watchdog")"
+        /etc/cp/watchdog/cp-nano-watchdog >/dev/null 2>&1 &
+        sleep 5
+        active_watchdog_pid=$(pgrep -f -x -o "/bin/(bash|sh) /etc/cp/watchdog/cp-nano-watchdog")
+    fi
+
     sleep 5
 done

components/attachment-intakers/nginx_attachment/nginx_parser.cc

@@ -28,7 +28,6 @@ USE_DEBUG_FLAG(D_NGINX_ATTACHMENT_PARSER);
 
 Buffer NginxParser::tenant_header_key = Buffer();
 static const Buffer proxy_ip_header_key("X-Forwarded-For", 15, Buffer::MemoryType::STATIC);
-static const Buffer waf_tag_key("x-waf-tag", 9, Buffer::MemoryType::STATIC);
 static const Buffer source_ip("sourceip", 8, Buffer::MemoryType::STATIC);
 bool is_keep_alive_ctx = getenv("SAAS_KEEP_ALIVE_HDR_NAME") != nullptr;
 
@@ -232,20 +231,17 @@ NginxParser::parseRequestHeaders(const Buffer &data, const unordered_set<string>
             static_cast<string>(header.getKey()) + ": " + static_cast<string>(header.getValue()) + "\r\n"
         );
 
-        const auto &header_key = header.getKey();
-        if (NginxParser::tenant_header_key == header_key) {
+        if (NginxParser::tenant_header_key == header.getKey()) {
             dbgDebug(D_NGINX_ATTACHMENT_PARSER)
                 << "Identified active tenant header. Key: "
-                << dumpHex(header_key)
+                << dumpHex(header.getKey())
                 << ", Value: "
                 << dumpHex(header.getValue());
 
             auto active_tenant_and_profile = getActivetenantAndProfile(header.getValue());
             opaque.setSessionTenantAndProfile(active_tenant_and_profile[0], active_tenant_and_profile[1]);
-        } else if (proxy_ip_header_key == header_key) {
+        } else if (proxy_ip_header_key == header.getKey()) {
             source_identifiers.setXFFValuesToOpaqueCtx(header, UsersAllIdentifiersConfig::ExtractType::PROXYIP);
-        } else if (waf_tag_key == header_key) {
-            source_identifiers.setWafTagValuesToOpaqueCtx(header);
         }
     }
 

components/attachment-intakers/nginx_attachment/user_identifiers_config.cc

@@ -366,24 +366,6 @@ UsersAllIdentifiersConfig::setCustomHeaderToOpaqueCtx(const HttpHeader &header)
     return;
 }
 
-void
-UsersAllIdentifiersConfig::setWafTagValuesToOpaqueCtx(const HttpHeader &header) const
-{
-    auto i_transaction_table = Singleton::Consume<I_TableSpecific<SessionID>>::by<NginxAttachment>();
-    if (!i_transaction_table || !i_transaction_table->hasState<NginxAttachmentOpaque>()) {
-        dbgDebug(D_NGINX_ATTACHMENT_PARSER) << "Can't get the transaction table";
-        return;
-    }
-
-    NginxAttachmentOpaque &opaque = i_transaction_table->getState<NginxAttachmentOpaque>();
-    opaque.setSavedData(HttpTransactionData::waf_tag_ctx, static_cast<string>(header.getValue()));
-
-    dbgDebug(D_NGINX_ATTACHMENT_PARSER)
-        << "Added waf tag to context: "
-        <<  static_cast<string>(header.getValue());
-    return;
-}
-
 Maybe<string>
 UsersAllIdentifiersConfig::parseCookieElement(
     const string::const_iterator &start,

components/include/generic_rulebase/evaluators/http_transaction_data_eval.h

@@ -45,19 +45,6 @@ private:
     std::string host;
 };
 
-class EqualWafTag : public EnvironmentEvaluator<bool>, Singleton::Consume<I_Environment>
-{
-public:
-EqualWafTag(const std::vector<std::string> &params);
-
-    static std::string getName() { return "EqualWafTag"; }
-
-    Maybe<bool, Context::Error> evalVariable() const override;
-
-private:
-    std::string waf_tag;
-};
-
 class EqualListeningIP : public EnvironmentEvaluator<bool>, Singleton::Consume<I_Environment>
 {
 public:

components/include/http_transaction_data.h

@@ -137,7 +137,6 @@ public:
     static const std::string source_identifier;
     static const std::string proxy_ip_ctx;
     static const std::string xff_vals_ctx;
-    static const std::string waf_tag_ctx;
 
     static const CompressionType default_response_content_encoding;
 

components/include/user_identifiers_config.h

@@ -30,7 +30,6 @@ public:
     void parseRequestHeaders(const HttpHeader &header) const;
     std::vector<std::string> getHeaderValuesFromConfig(const std::string &header_key) const;
     void setXFFValuesToOpaqueCtx(const HttpHeader &header, ExtractType type) const;
-    void setWafTagValuesToOpaqueCtx(const HttpHeader &header) const;
 
 private:
     class UsersIdentifiersConfig

components/security_apps/waap/waap_clib/CidrMatch.cc

@@ -41,7 +41,6 @@ static in6_addr applyMaskV6(const in6_addr& addr, uint8_t prefixLength) {
     in6_addr maskedAddr = addr;
     int fullBytes = prefixLength / 8;
     int remainingBits = prefixLength % 8;
-    uint8_t partialByte = maskedAddr.s6_addr[fullBytes];
 
     // Mask full bytes
     for (int i = fullBytes; i < 16; ++i) {
@@ -51,7 +50,7 @@ static in6_addr applyMaskV6(const in6_addr& addr, uint8_t prefixLength) {
     // Mask remaining bits
     if (remainingBits > 0) {
         uint8_t mask = ~((1 << (8 - remainingBits)) - 1);
-        maskedAddr.s6_addr[fullBytes] = partialByte & mask;
+        maskedAddr.s6_addr[fullBytes] &= mask;
     }
 
     return maskedAddr;

components/security_apps/waap/waap_clib/Waf2Engine.cc

@@ -1093,9 +1093,12 @@ void Waf2Transaction::add_request_hdr(const char* name, int name_len, const char
 void Waf2Transaction::end_request_hdrs() {
     dbgFlow(D_WAAP) << "[transaction:" << this << "] end_request_hdrs";
     m_isScanningRequired = setCurrentAssetContext();
-
-    extractEnvSourceIdentifier();
-
+    if (m_siteConfig != NULL)
+    {
+        // getOverrideState also extracts the source identifier and populates m_source_identifier
+        // but the State itself is not needed now
+        Waap::Override::State overrideState = getOverrideState(m_siteConfig);
+    }
     m_pWaapAssetState->m_requestsMonitor->logSourceHit(m_source_identifier);
     IdentifiersEvent ids(m_source_identifier, m_pWaapAssetState->m_assetId);
     ids.notify();

components/security_apps/waap/waap_clib/Waf2EngineGetters.cc

@@ -594,6 +594,8 @@ Waap::Override::State Waf2Transaction::getOverrideState(IWaapConfig* sitePolicy)
         overrideState.applyOverride(*overridePolicy, WaapOverrideFunctor(*this), m_matchedOverrideIds, true);
     }
 
+    extractEnvSourceIdentifier();
+
     if (overridePolicy) { // later we will run response overrides
         m_overrideState.applyOverride(*overridePolicy, WaapOverrideFunctor(*this), m_matchedOverrideIds, false);
     }

components/utils/generic_rulebase/evaluators/http_transaction_data_eval.cc

@@ -103,35 +103,6 @@ WildcardHost::evalVariable() const
     return lower_host_ctx == lower_host;
 }
 
-EqualWafTag::EqualWafTag(const vector<string> &params)
-{
-    if (params.size() != 1) reportWrongNumberOfParams("EqualWafTag", params.size(), 1, 1);
-    waf_tag = params[0];
-}
-
-Maybe<bool, Context::Error>
-EqualWafTag::evalVariable() const
-{
-    I_Environment *env = Singleton::Consume<I_Environment>::by<EqualWafTag>();
-    auto maybe_waf_tag_ctx = env->get<string>(HttpTransactionData::waf_tag_ctx);
-
-    if (!maybe_waf_tag_ctx.ok())
-    {
-        dbgTrace(D_RULEBASE_CONFIG) << "didnt find waf tag in current context";
-        return false;
-    }
-
-    auto waf_tag_ctx = maybe_waf_tag_ctx.unpack();
-
-    dbgTrace(D_RULEBASE_CONFIG)
-        << "trying to match waf tag context with its corresponding waf tag: "
-        << waf_tag_ctx
-        << ". Matcher waf tag: "
-        << waf_tag;
-
-    return waf_tag_ctx == waf_tag;
-}
-
 EqualListeningIP::EqualListeningIP(const vector<string> &params)
 {
     if (params.size() != 1) reportWrongNumberOfParams("EqualListeningIP", params.size(), 1, 1);

components/utils/generic_rulebase/generic_rulebase.cc

@@ -80,7 +80,6 @@ GenericRulebase::Impl::preload()
     addMatcher<IpProtocolMatcher>();
     addMatcher<UrlMatcher>();
     addMatcher<EqualHost>();
-    addMatcher<EqualWafTag>();
     addMatcher<WildcardHost>();
     addMatcher<EqualListeningIP>();
     addMatcher<EqualListeningPort>();

components/utils/http_transaction_data/http_transaction_data.cc

@@ -53,7 +53,6 @@ const string HttpTransactionData::req_body           = "transaction_request_body
 const string HttpTransactionData::source_identifier  = "sourceIdentifiers";
 const string HttpTransactionData::proxy_ip_ctx       = "proxy_ip";
 const string HttpTransactionData::xff_vals_ctx       = "xff_vals";
-const string HttpTransactionData::waf_tag_ctx       = "waf_tag";
 
 const CompressionType HttpTransactionData::default_response_content_encoding = CompressionType::NO_COMPRESSION;
 

components/utils/utilities/nginx_conf_collector/nginx_conf_collector.cc

@@ -1,5 +1,5 @@
 // Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
- 
+
 // Licensed under the Apache License, Version 2.0 (the "License");
 // You may obtain a copy of the License at
 //
@@ -13,11 +13,9 @@
 
 #include <iostream>
 #include <unistd.h>
-#include <sstream>
 
 #include "agent_core_utilities.h"
 #include "debug.h"
-#include "getopt.h"
 #include "internal/shell_cmd.h"
 #include "mainloop.h"
 #include "nginx_utils.h"
@@ -45,7 +43,6 @@ public:
         environment.fini();
         time_proxy.fini();
     }
-
 private:
     ShellCmd shell_cmd;
     MainloopComponent mainloop;
@@ -53,153 +50,6 @@ private:
     TimeProxyComponent time_proxy;
 };
 
-class FogConnection
-{
-public:
-    FogConnection(const std::string& token, const std::string& fog)
-        : var_token(token), var_fog(fog) {}
-
-    bool registerAgent() {
-        std::string curl_cmd = "curl -s --noproxy \"*\" "
-                            "--header \"User-Agent: Infinity Next (a7030abf93a4c13)\" "
-                            "--header \"Content-Type: application/json\" "
-                            "--request POST "
-                            "--data '{\"authenticationData\": [{\"authenticationMethod\": \"token\", \"data\": \""
-                            + var_token + "\"}], "
-                            "\"metaData\": {\"agentName\": \"ConfCollector\", \"agentType\":"
-                            "\"Embedded\", \"platform\": \"linux\", "
-                            "\"architecture\": \"x86\", \"additionalMetaData\": {\"agentVendor\": \"python\"}}}' "
-                            + var_fog + "/agents";
-
-        std::string response = executeCommand(curl_cmd);
-
-        std::string error_check = "echo '" + response + "' | grep referenceId";
-        std::string error_result = executeCommand(error_check);
-        if (!error_result.empty()) {
-            std::cerr << "Couldn't register to the FOG" << std::endl;
-            return false;
-        }
-
-        agent_id = extractJsonValue(response, "agentId");
-        clientId = extractJsonValue(response, "clientId");
-        clientSecret = extractJsonValue(response, "clientSecret");
-        tenant_id = extractJsonValue(response, "tenantId");
-        profile_id = extractJsonValue(response, "profileId");
-
-        removeNewlines(agent_id);
-        removeNewlines(clientId);
-        removeNewlines(clientSecret);
-        removeNewlines(tenant_id);
-        removeNewlines(profile_id);
-
-        return true;
-    }
-
-    bool getJWT() {
-        std::string curl_cmd = "curl -s --noproxy \"*\" "
-                            "--header \"User-Agent: Infinity Next (a7030abf93a4c13)\" "
-                            "--header \"Content-Type: application/json\" "
-                            "-d '{\"login\":\"" + clientId + "\", \"password\":\"" + clientSecret + "\"}' "
-                            "--user \"" + clientId + ":" + clientSecret + "\" "
-                            "--request POST "
-                            "--data '{}' "
-                            + var_fog + "/oauth/token?grant_type=client_credentials";
-
-        std::string response = executeCommand(curl_cmd);
-
-        std::string error_check = "echo '" + response + "' | grep referenceId";
-        std::string error_result = executeCommand(error_check);
-        if (!error_result.empty()) {
-            std::cerr << "Couldn't receive JWT" << std::endl;
-            return false;
-        }
-
-        ra_token = extractJsonValue(response, "access_token");
-        removeNewlines(ra_token);
-
-        return true;
-    }
-
-    bool uploadNginxConfig(const std::string& config_file_path)
-    {
-        if (tenant_id.empty() || profile_id.empty() || ra_token.empty()) {
-            std::cerr << "Missing required data for upload (tenant_id, profile_id, or JWT token)" << std::endl;
-            return false;
-        }
-
-        std::ifstream file_check(config_file_path);
-        if (!file_check.is_open()) {
-            std::cerr << "Cannot open config file for upload: " << config_file_path << std::endl;
-            return false;
-        }
-        file_check.close();
-
-        std::string upload_url = var_fog + "/agents-core/storage/" + tenant_id + "/" + "nginx/" + profile_id +
-            "/1/nginx.conf";
-
-        std::string curl_cmd = "curl -s --noproxy \"*\" "
-                            "--header \"User-Agent: Infinity Next (a7030abf93a4c13)\" "
-                            "--header \"Authorization: Bearer " + ra_token + "\" "
-                            "--header \"Content-Type: text/plain\" "
-                            "--request PUT "
-                            "--data-binary @" + config_file_path + " "
-                            "-w \"%{http_code}\" "
-                            + upload_url;
-
-        std::string response = executeCommand(curl_cmd);
-
-        std::string status_code = "";
-        if (response.length() >= 3) {
-            status_code = response.substr(response.length() - 3);
-            response = response.substr(0, response.length() - 3);
-        }
-
-        if (status_code.empty() || status_code[0] != '2') {
-            std::cerr << "Upload failed with HTTP status code: " << status_code << std::endl;
-            return false;
-        }
-
-        std::cout << "Successfully uploaded nginx config to: " << upload_url << " (HTTP " << status_code << ")"
-            << std::endl;
-        return true;
-    }
-
-private:
-    std::string var_token;
-    std::string var_fog;
-    std::string agent_id;
-    std::string tenant_id;
-    std::string profile_id;
-    std::string ra_token;
-    std::string clientId;
-    std::string clientSecret;
-
-    std::string executeCommand(const std::string& command) {
-        std::string result;
-        FILE* pipe = popen(command.c_str(), "r");
-        if (!pipe) {
-            throw std::runtime_error("popen() failed!");
-        }
- 
-        char buffer[128];
-        while (fgets(buffer, sizeof(buffer), pipe) != nullptr) {
-            result += buffer;
-        }
-        pclose(pipe);
-        return result;
-    }
-
-    std::string extractJsonValue(const std::string& response, const std::string& key) {
-        std::string command = "echo '" + response + "' | grep -o '\"" + key + "\":\"[^\"]*' | grep -o '[^\"]*$'";
-        return executeCommand(command);
-    }
-
-    void removeNewlines(std::string& str) {
-        str.erase(std::remove(str.begin(), str.end(), '\n'), str.end());
-        str.erase(std::remove(str.begin(), str.end(), '\r'), str.end());
-    }
-};
-
 void
 printVersion()
 {
@@ -213,16 +63,12 @@ printVersion()
 void
 printUsage(const char *prog_name)
 {
-    cout << "Usage: " << prog_name << " [-v] [-i /path/to/nginx.conf] [-o /path/to/output.conf]" <<
-        "[--upload --token <token> [--fog <address>]]" << '\n';
+    cout << "Usage: " << prog_name << " [-v] [-i /path/to/nginx.conf] [-o /path/to/output.conf]" << '\n';
     cout << "  -V              Print version" << '\n';
     cout << "  -v              Enable verbose output" << '\n';
     cout << "  -i input_file   Specify input file (default is /etc/nginx/nginx.conf)" << '\n';
     cout << "  -o output_file  Specify output file (default is ./full_nginx.conf)" << '\n';
     cout << "  -h              Print this help message" << '\n';
-    cout << "  --upload        Upload configuration to FOG (requires --token)" << '\n';
-    cout << "  --token <token> profile token for FOG upload" << '\n';
-    cout << "  --fog <address> FOG server address (default: inext-agents.cloud.ngen.checkpoint.com)" << '\n';
 }
 
 int
@@ -230,19 +76,9 @@ main(int argc, char *argv[])
 {
     string nginx_input_file = "/etc/nginx/nginx.conf";
     string nginx_output_file = "full_nginx.conf";
-    string fog_address = "inext-agents.cloud.ngen.checkpoint.com";
-    string token;
-    bool upload_flag = false;
+
     int opt;
-
-    static struct option long_options[] = {
-        {"upload", no_argument, 0, 'u'},
-        {"token", required_argument, 0, 1001},
-        {"fog", required_argument, 0, 1002},
-        {0, 0, 0, 0}
-    };
-
-    while ((opt = getopt_long(argc, argv, "Vvhi:o:", long_options, nullptr)) != -1) {
+    while ((opt = getopt(argc, argv, "Vvhi:o:h")) != -1) {
         switch (opt) {
             case 'V':
                 printVersion();
@@ -259,33 +95,18 @@ main(int argc, char *argv[])
             case 'h':
                 printUsage(argv[0]);
                 return 0;
-            case 'u':
-                upload_flag = true;
-                break;
-            case 1001: // --token
-                token = optarg;
-                break;
-            case 1002: // --fog
-                fog_address = optarg;
-                break;
             default:
                 printUsage(argv[0]);
                 return 1;
         }
     }
 
-    for (int i = optind; i < argc; i++) {
+    for (int i = optind; i < argc;) {
         cerr << "Unknown argument: " << argv[i] << '\n';
         printUsage(argv[0]);
         return 1;
     }
 
-    if (upload_flag && token.empty()) {
-        cerr << "Error: --upload requires --token to be specified" << '\n';
-        printUsage(argv[0]);
-        return 1;
-    }
-
     dbgTrace(D_NGINX_MANAGER) << "Starting nginx configuration collector";
 
     MainComponent main_component;
@@ -323,30 +144,5 @@ main(int argc, char *argv[])
 
     cout << "Full nginx configuration file was successfully generated: " << result.unpack() << '\n';
 
-    if (upload_flag) {
-        cout << "Uploading configuration to FOG server: " << fog_address << '\n';
-
-        string full_fog_url = fog_address;
-        if (fog_address.find("http://") != 0 && fog_address.find("https://") != 0) {
-            full_fog_url = "https://" + fog_address;
-        }
-
-        FogConnection fog_connection(token, full_fog_url);
-        if (!fog_connection.registerAgent()) {
-            cerr << "Failed to register agent with the FOG." << '\n';
-            return 1;
-        }
-
-        if (!fog_connection.getJWT()) {
-            cerr << "Failed to get JWT token." << '\n';
-            return 1;
-        }
-
-        if (!fog_connection.uploadNginxConfig(result.unpack())) {
-            cerr << "Failed to upload nginx config file to FOG." << '\n';
-            return 1;
-        }
-    }
-
     return 0;
-}
+}

config/linux/v1beta1/schema/schema_v1beta1.yaml

@@ -1,434 +0,0 @@
-ype: object
-properties:
-  policies:
-    type: object
-    properties:
-      default:
-        type: object
-        properties:
-          custom-response:
-            type: string
-          exceptions:
-            items:
-              type: string
-            type: array
-          mode:
-            enum:
-              - prevent-learn
-              - detect-learn
-              - prevent
-              - detect
-              - inactive
-            type: string
-          practices:
-            items:
-              type: string
-            type: array
-          source-identifiers:
-            type: string
-          triggers:
-            items:
-              type: string
-            type: array
-          trusted-sources:
-            type: string
-        required:
-          - mode
-          - practices
-          - triggers
-      specific-rules:
-        type: array
-        items:
-          properties:
-            host:
-              type: string
-            custom-response:
-              type: string
-            exceptions:
-              items:
-                type: string
-              type: array
-            mode:
-              enum:
-                - prevent-learn
-                - detect-learn
-                - prevent
-                - detect
-                - inactive
-              type: string
-            practices:
-              items:
-                type: string
-              type: array
-            source-identifiers:
-              type: string
-            triggers:
-              items:
-                type: string
-              type: array
-            trusted-sources:
-              type: string
-          required:
-            - mode
-            - host
-            - practices
-            - triggers
-          type: object
-  practices:
-    type: array
-    items:
-      properties:
-        name:
-          type: string
-        anti-bot:
-          properties:
-            injected-URIs:
-              items:
-                properties:
-                  uri:
-                    type: string
-                type: object
-              type: array
-            override-mode:
-              enum:
-                - prevent-learn
-                - detect-learn
-                - prevent
-                - detect
-                - inactive
-                - as-top-level
-              type: string
-              default: "inactive"
-            validated-URIs:
-              items:
-                properties:
-                  uri:
-                    type: string
-                type: object
-              type: array
-          type: object
-        openapi-schema-validation:
-          properties:
-            files:
-              items:
-                type: string
-              type: array
-            override-mode:
-              enum:
-                - prevent-learn
-                - detect-learn
-                - prevent
-                - detect
-                - inactive
-                - as-top-level
-              type: string
-          type: object
-        snort-signatures:
-          properties:
-            files:
-              items:
-                type: string
-              type: array
-            override-mode:
-              enum:
-                - prevent-learn
-                - detect-learn
-                - prevent
-                - detect
-                - inactive
-                - as-top-level
-              type: string
-          type: object
-        web-attacks:
-          properties:
-            max-body-size-kb:
-              type: integer
-            max-header-size-bytes:
-              type: integer
-            max-object-depth:
-              type: integer
-            max-url-size-bytes:
-              type: integer
-            minimum-confidence:
-              enum:
-                - medium
-                - high
-                - critical
-              type: string
-            override-mode:
-              enum:
-                - prevent-learn
-                - detect-learn
-                - prevent
-                - detect
-                - inactive
-                - as-top-level
-              type: string
-            protections:
-              properties:
-                csrf-enabled:
-                  enum:
-                    - prevent-learn
-                    - detect-learn
-                    - prevent
-                    - detect
-                    - inactive
-                  type: string
-                error-disclosure-enabled:
-                  enum:
-                    - prevent-learn
-                    - detect-learn
-                    - prevent
-                    - detect
-                    - inactive
-                  type: string
-                non-valid-http-methods:
-                  type: boolean
-                open-redirect-enabled:
-                  enum:
-                    - prevent-learn
-                    - detect-learn
-                    - prevent
-                    - detect
-                    - inactive
-                  type: string
-              type: object
-          type: object
-      required:
-        - name
-  custom-responses:
-    type: array
-    minItems: 0
-    items:
-      type: object
-      properties:
-        name:
-          type: string
-        http-response-code:
-          maximum: 599
-          minimum: 100
-          default: 403
-          type: integer
-        message-body:
-          type: string
-          default: "Attack blocked by web application protection"
-        message-title:
-          type: string
-          default: "Openappsec's <b>Application Security</b> has detected an attack and blocked it."
-        mode:
-          enum:
-            - block-page
-            - response-code-only
-          type: string
-      required:
-        - name
-  log-triggers:
-    type: array
-    minItems: 0
-    items:
-      type: object
-      properties:
-        name:
-          type: string
-        access-control-logging:
-          properties:
-            allow-events:
-              type: boolean
-              default: false
-            drop-events:
-              type: boolean
-              default: false
-          type: object
-        additional-suspicious-events-logging:
-          properties:
-            enabled:
-              type: boolean
-              default true:
-            minimum-severity:
-              enum:
-                - high
-                - critical
-              type: string
-              default: "high"
-            response-body:
-              type: boolean
-              default: false
-            response-code:
-              type: boolean
-              default: true
-          type: object
-        appsec-logging:
-          properties:
-            all-web-requests:
-              type: boolean
-              default: false
-            detect-events:
-              type: boolean
-              default: false
-            prevent-events:
-              type: boolean
-              default: true
-          type: object
-        extended-logging:
-          properties:
-            http-headers:
-              type: boolean
-              default: false
-            request-body:
-              type: boolean
-              default: false
-            url-path:
-              type: boolean
-              default: false
-            url-query:
-              type: boolean
-              default: false
-          type: object
-        log-destination:
-          properties:
-            cef-service:
-              minItems: 0
-              items:
-                properties:
-                  address:
-                    type: string
-                  port:
-                    type: integer
-                  proto:
-                    enum:
-                      - tcp
-                      - udp
-                    type: string
-                type: object
-              type: array
-            cloud:
-              type: boolean
-              default: false
-            stdout:
-              properties:
-                format:
-                  enum:
-                    - json
-                    - json-formatted
-                  type: string
-                  default: json
-              type: object
-            syslog-service:
-              minItems: 0
-              items:
-                properties:
-                  address:
-                    type: string
-                  port:
-                    type: integer
-                type: object
-              type: array
-          type: object
-      required:
-        - name
-  exceptions:
-    type: array
-    minItems: 0
-    items:
-      type: object
-      properties:
-        name:
-          type: string
-        action:
-          enum:
-            - skip
-            - accept
-            - drop
-            - suppressLog
-          type: string
-        comment:
-          type: string
-        countryCode:
-          items:
-            type: string
-          type: array
-        countryName:
-          items:
-            type: string
-          type: array
-        hostName:
-          items:
-            type: string
-          type: array
-        paramName:
-          items:
-            type: string
-          type: array
-        paramValue:
-          items:
-            type: string
-          type: array
-        protectionName:
-          items:
-            type: string
-          type: array
-        sourceIdentifier:
-          items:
-            type: string
-          type: array
-        sourceIp:
-          items:
-            type: string
-          type: array
-        url:
-          items:
-            type: string
-          type: array
-      required:
-        - name
-        - action
-  trusted-sources:
-    type: array
-    minItems: 0
-    items:
-      type: object
-      properties:
-        name:
-          type: string
-        minNumOfSources:
-          type: integer
-          minimum: 1
-          default: 3
-        sources-identifiers:
-          items:
-            type: string
-          type: array
-      required:
-        - name
-        - sources-identifiers
-  source-identifiers:
-    type: array
-    minItems: 0
-    items:
-      type: object
-      properties:
-        name:
-          type: string
-        identifiers:
-          type: array
-          minItems: 1
-          items:
-            type: object
-            source-identifier:
-              enum:
-                - headerkey
-                - JWTKey
-                - cookie
-                - sourceip
-                - x-forwarded-for
-              type: string
-            value:
-              items:
-                type: string
-              type: array
-          required:
-            - source-identifier
-      required:
-        - name
-        - identifiers
-additionalProperties: false

config/linux/v1beta2/schema/schema_v1beta2.yaml

@@ -1,752 +0,0 @@
-type: object
-properties:
-  apiVersion:
-    type: string
-    enum:
-    - v1beta1
-    - v1beta2
-  policies:
-    type: object
-    properties:
-      appsecClassName:
-        type: string
-      default:
-        type: object
-        required:
-        - mode
-        - threatPreventionPractices
-        - accessControlPractices
-        properties:
-          mode:
-            type: string
-            enum:
-            - prevent-learn
-            - detect-learn
-            - prevent
-            - detect
-            - inactive
-            default: detect-learn
-          threatPreventionPractices:
-            type: array
-            items:
-              type: string
-          accessControlPractices:
-            type: array
-            items:
-              type: string
-          customResponse:
-            type: string
-            default: "403"
-          triggers:
-            type: array
-            items:
-              type: string
-          sourceIdentifiers:
-            type: string
-          trustedSources:
-            type: string
-          exceptions:
-            type: array
-            items:
-              type: string
-      specificRules:
-        type: array
-        items:
-          type: object
-          properties:
-            name:
-              type: string
-            host:
-              type: string
-            mode:
-              type: string
-              enum:
-              - prevent-learn
-              - detect-learn
-              - prevent
-              - detect
-              - inactive
-              default: detect-learn
-            threatPreventionPractices:
-              type: array
-              items:
-                type: string
-            accessControlPractices:
-              type: array
-              items:
-                type: string
-            triggers:
-              type: array
-              items:
-                type: string
-            customResponse:
-              type: string
-            sourceIdentifiers:
-              type: string
-            trustedSources:
-              type: string
-            exceptions:
-              type: array
-              items:
-                type: string
-  logTriggers:
-    type: array
-    items:
-      type: object
-      required:
-      - accessControlLogging
-      - appsecLogging
-      - additionalSuspiciousEventsLogging
-      - extendedLogging
-      - logDestination
-      properties:
-        appsecClassName:
-          type: string
-        name:
-          type: string
-        accessControlLogging:
-          type: object
-          properties:
-            allowEvents:
-              type: boolean
-              default: false
-            dropEvents:
-              type: boolean
-              default: true
-        appsecLogging:
-          type: object
-          properties:
-            detectEvents:
-              type: boolean
-              default: true
-            preventEvents:
-              type: boolean
-              default: true
-            allWebRequests:
-              type: boolean
-              default: false
-        additionalSuspiciousEventsLogging:
-          type: object
-          properties:
-            enabled:
-              type: boolean
-              default: true
-            minSeverity:
-              type: string
-              enum:
-              - high
-              - critical
-              default: high
-            responseBody:
-              type: boolean
-              default: false
-            responseCode:
-              type: boolean
-              default: true
-        extendedLogging:
-          type: object
-          properties:
-            urlPath:
-              type: boolean
-              default: false
-            urlQuery:
-              type: boolean
-              default: false
-            httpHeaders:
-              type: boolean
-              default: false
-            requestBody:
-              type: boolean
-              default: false
-        logDestination:
-          type: object
-          properties:
-            cloud:
-              type: boolean
-              default: false
-            local-tuning:
-              type: boolean
-              default: false
-            syslogService:
-              type: array
-              items:
-                type: object
-                properties:
-                  address:
-                    type: string
-                  port:
-                    type: integer
-            logToAgent:
-              type: boolean
-              default: true
-            stdout:
-              type: object
-              properties:
-                format:
-                  type: string
-                  enum:
-                  - json
-                  - json-formatted
-                  default: json
-            cefService:
-              type: array
-              items:
-                type: object
-                properties:
-                  address:
-                    type: string
-                  port:
-                    type: integer
-                  proto:
-                    type: string
-                    enum:
-                    - tcp
-                    - udp
-  threatPreventionPractices:
-    type: array
-    items:
-      type: object
-      required:
-      - webAttacks
-      - intrusionPrevention
-      - fileSecurity
-      - snortSignatures
-      properties:
-        appsecClassName:
-          type: string
-        name:
-          type: string
-        practiceMode:
-          type: string
-          enum:
-          - inherited
-          - prevent-learn
-          - detect-learn
-          - prevent
-          - detect
-          - inactive
-          default: inherited
-        webAttacks:
-          type: object
-          required:
-          - overrideMode
-          properties:
-            overrideMode:
-              type: string
-              enum:
-              - prevent-learn
-              - detect-learn
-              - prevent
-              - detect
-              - inactive
-              - inherited
-              default: inactive
-            minimumConfidence:
-              type: string
-              enum:
-              - medium
-              - high
-              - critical
-              default: high
-            maxUrlSizeBytes:
-              type: integer
-              default: 32768
-            maxObjectDepth:
-              type: integer
-              default: 40
-            maxBodySizeKb:
-              type: integer
-              default: 1000000
-            maxHeaderSizeBytes:
-              type: integer
-              default: 102400
-            protections:
-              type: object
-              properties:
-                csrfProtection:
-                  type: string
-                  enum:
-                  - prevent-learn
-                  - detect-learn
-                  - prevent
-                  - detect
-                  - inactive
-                  - inherited
-                  default: inactive
-                errorDisclosure:
-                  type: string
-                  enum:
-                  - prevent-learn
-                  - detect-learn
-                  - prevent
-                  - detect
-                  - inactive
-                  - inherited
-                  default: inactive
-                openRedirect:
-                  type: string
-                  enum:
-                  - prevent-learn
-                  - detect-learn
-                  - prevent
-                  - detect
-                  - inactive
-                  - inherited
-                  default: inactive
-                nonValidHttpMethods:
-                  type: boolean
-                  default: false
-        antiBot:
-          type: object
-          required:
-          - overrideMode
-          properties:
-            overrideMode:
-              type: string
-              enum:
-              - prevent-learn
-              - detect-learn
-              - prevent
-              - detect
-              - inactive
-              - inherited
-              default: inactive
-            injectedUris:
-              type: array
-              items:
-                type: object
-                properties:
-                  uri:
-                    type: string
-            validatedUris:
-              type: array
-              items:
-                type: object
-                properties:
-                  uri:
-                    type: string
-        snortSignatures:
-          type: object
-          required:
-          - overrideMode
-          properties:
-            overrideMode:
-              type: string
-              enum:
-              - prevent-learn
-              - detect-learn
-              - prevent
-              - detect
-              - inactive
-              - inherited
-              default: inactive
-            configmap:
-              type: array
-              items:
-                type: string
-            files:
-              type: array
-              items:
-                type: string
-        schemaValidation:
-          type: object
-          required:
-          - overrideMode
-          properties:
-            overrideMode:
-              type: string
-              enum:
-              - prevent-learn
-              - detect-learn
-              - prevent
-              - detect
-              - inactive
-              - inherited
-              default: inactive
-            enforcementLevel:
-              type: string
-            configmap:
-              type: array
-              items:
-                type: string
-            files:
-              type: array
-              items:
-                type: string
-        intrusionPrevention:
-          type: object
-          required:
-          - overrideMode
-          properties:
-            overrideMode:
-              type: string
-              enum:
-              - prevent-learn
-              - detect-learn
-              - prevent
-              - detect
-              - inactive
-              - inherited
-              default: inactive
-            maxPerformanceImpact:
-              type: string
-              enum:
-              - low
-              - medium
-              - high
-              default: medium
-            minSeverityLevel:
-              type: string
-              enum:
-              - low
-              - medium
-              - high
-              - critical
-              default: medium
-            minCveYear:
-              type: integer
-              default: 2016
-            highConfidenceEventAction:
-              type: string
-              enum:
-              - prevent
-              - detect
-              - inactive
-              - inherited
-              default: inherited
-            mediumConfidenceEventAction:
-              type: string
-              enum:
-              - prevent
-              - detect
-              - inactive
-              - inherited
-              default: inherited
-            lowConfidenceEventAction:
-              type: string
-              enum:
-              - prevent
-              - detect
-              - inactive
-              - inherited
-              default: detect
-        fileSecurity:
-          type: object
-          required:
-          - overrideMode
-          properties:
-            overrideMode:
-              type: string
-              enum:
-              - prevent-learn
-              - detect-learn
-              - prevent
-              - detect
-              - inactive
-              - inherited
-              default: inactive
-            minSeverityLevel:
-              type: string
-              enum:
-              - low
-              - medium
-              - high
-              - critical
-              default: medium
-            highConfidenceEventAction:
-              type: string
-              enum:
-              - prevent
-              - detect
-              - inactive
-              - inherited
-              default: inherited
-            mediumConfidenceEventAction:
-              type: string
-              enum:
-              - prevent
-              - detect
-              - inactive
-              - inherited
-              default: inherited
-            lowConfidenceEventAction:
-              type: string
-              enum:
-              - prevent
-              - detect
-              - inactive
-              - inherited
-              default: detect
-            archiveInspection:
-              type: object
-              properties:
-                extractArchiveFiles:
-                  type: boolean
-                  default: false
-                scanMaxFileSize:
-                  type: integer
-                  default: 10
-                scanMaxFileSizeUnit:
-                  type: string
-                  enum:
-                  - bytes
-                  - KB
-                  - MB
-                  - GB
-                  default: MB
-                archivedFilesWithinArchivedFiles:
-                  type: string
-                  enum:
-                  - prevent
-                  - detect
-                  - inactive
-                  - inherited #as set in overrideMode for fileSecurity
-                  default: inherited
-                archivedFilesWhereContentExtractionFailed:
-                  type: string
-                  enum:
-                  - prevent
-                  - detect
-                  - inactive
-                  - inherited #as set in overrideMode for fileSecurity
-                  default: inherited
-            largeFileInspection:
-              type: object
-              properties:
-                fileSizeLimit:
-                  type: integer
-                  default: 10
-                fileSizeLimitUnit:
-                  type: string
-                  enum:
-                  - bytes
-                  - KB
-                  - MB
-                  - GB
-                  default: MB
-                filesExceedingSizeLimitAction:
-                  type: string
-                  enum:
-                  - prevent
-                  - detect
-                  - inactive
-                  - inherited #as set in overrideMode for fileSecurity
-                  default: inherited
-            unnamedFilesAction:
-              type: string
-              enum:
-              - prevent
-              - detect
-              - inactive
-              - inherited #as set in overrideMode for fileSecurity
-              default: inherited
-            threatEmulationEnabled:
-              type: boolean
-              default: false
-  accessControlPractices:
-    type: array
-    items:
-      type: object
-      required:
-      - rateLimit
-      properties:
-        appsecClassName:
-          type: string
-        name:
-          type: string
-        practiceMode:
-          type: string
-          enum:
-          - inherited #inherited from mode set in policy
-          - prevent
-          - detect
-          - inactive
-          default: inherited
-        rateLimit:
-          type: object
-          required:
-          - overrideMode
-          properties:
-            overrideMode:
-              type: string
-              enum:
-              - prevent
-              - detect
-              - inactive
-              - inherited
-              default: inactive
-            rules:
-              type: array
-              items:
-                type: object
-                properties:
-                  action: # currently not supported
-                    type: string
-                    enum:
-                    - inherited
-                    - prevent
-                    - detect
-                    default: inherited
-                  condition: # currently not supported
-                    type: array
-                    items:
-                      type: object
-                      required:
-                      - key
-                      - value
-                      properties:
-                        key:
-                          type: string
-                        value:
-                          type: string
-                  uri:
-                    type: string
-                  limit:
-                    type: integer
-                  unit:
-                    type: string
-                    enum:
-                    - minute
-                    - second
-                    default: minute
-                  triggers:
-                    type: array
-                    items:
-                      type: string
-                  comment:
-                    type: string
-  customResponses:
-    type: array
-    items:
-      type: object
-      required:
-      - mode
-      properties:
-        appsecClassName:
-          type: string
-        name:
-          type: string
-        mode:
-          type: string
-          enum:
-          - block-page
-          - redirect
-          - response-code-only
-          default: response-code-only
-        messageTitle:
-          type: string
-        messageBody:
-          type: string
-        httpResponseCode:
-          type: integer
-          minimum: 100
-          maximum: 599
-          default: 403
-        redirectUrl:
-          type: string
-        redirectAddXEventId:
-          type: boolean
-          default: false
-  sourcesIdentifiers:
-    type: array
-    items:
-      type: object
-      required:
-      - sourcesIdentifiers
-      properties:
-        name:
-          type: string
-        sourcesIdentifiers:
-          type: array
-          items:
-            type: object
-            required:
-            - identifier
-            properties:
-              identifier:
-                type: string
-                enum:
-                - headerkey
-                - JWTKey
-                - cookie
-                - sourceip
-                - x-forwarded-for
-                default: sourceip
-              value:
-                type: array
-                items:
-                  type: string
-  exceptions:
-    type: array
-    items:
-      type: object
-      required:
-      - action
-      - condition
-      properties:
-        appsecClassName:
-          type: string
-        name:
-          type: string
-        action:
-          type: string
-          enum:
-          - skip
-          - accept
-          - drop
-          - suppressLog
-          default: accept
-        condition:
-          type: array
-          items:
-            type: object
-            required:
-            - key
-            - value
-            properties:
-              key:
-                type: string
-              value:
-                type: string
-  trustedSources:
-    type: array
-    items:
-      type: object
-      required:
-      - minNumOfSources
-      - sourcesIdentifiers
-      properties:
-        appsecClassName:
-          type: string
-        name:
-          type: string
-        minNumOfSources:
-          type: integer
-          default: 3
-        sourcesIdentifiers:
-          type: array
-          items:
-            type: string
-  policyActivations:
-    type: array
-    items:
-      type: object
-      properties:
-        appsecClassName:
-          type: string
-        enabledPolicies:
-          type: array
-          items:
-            type: object
-            properties:
-              name:
-                type: string
-              hosts:
-                type: array
-                items:
-                  type: string
-            required:
-            - hosts
-      required:
-      - enabledPolicies
-additionalProperties: false