|
|
@@ -1,8 +1,6 @@
|
|
|
package appsecacquisition
|
|
|
|
|
|
import (
|
|
|
- "net/http"
|
|
|
- "net/url"
|
|
|
"testing"
|
|
|
"time"
|
|
|
|
|
|
@@ -12,15 +10,8 @@ import (
|
|
|
"github.com/davecgh/go-spew/spew"
|
|
|
"github.com/google/uuid"
|
|
|
log "github.com/sirupsen/logrus"
|
|
|
- "github.com/stretchr/testify/require"
|
|
|
)
|
|
|
|
|
|
-/*
|
|
|
-Missing tests (wip):
|
|
|
- - GenerateResponse
|
|
|
- - evt.Appsec and it's subobjects and methods
|
|
|
-*/
|
|
|
-
|
|
|
type appsecRuleTest struct {
|
|
|
name string
|
|
|
expected_load_ok bool
|
|
|
@@ -39,1251 +30,6 @@ type appsecRuleTest struct {
|
|
|
output_asserts func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int)
|
|
|
}
|
|
|
|
|
|
-func TestAppsecOnMatchHooks(t *testing.T) {
|
|
|
- tests := []appsecRuleTest{
|
|
|
- {
|
|
|
- name: "no rule : check return code",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule1",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Len(t, events, 2)
|
|
|
- require.Equal(t, types.APPSEC, events[0].Type)
|
|
|
- require.Equal(t, types.LOG, events[1].Type)
|
|
|
- require.Len(t, responses, 1)
|
|
|
- require.Equal(t, 403, responses[0].BouncerHTTPResponseCode)
|
|
|
- require.Equal(t, 403, responses[0].UserHTTPResponseCode)
|
|
|
- require.Equal(t, appsec.BanRemediation, responses[0].Action)
|
|
|
-
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "on_match: change return code",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule1",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- on_match: []appsec.Hook{
|
|
|
- {Filter: "IsInBand == true", Apply: []string{"SetReturnCode(413)"}},
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Len(t, events, 2)
|
|
|
- require.Equal(t, types.APPSEC, events[0].Type)
|
|
|
- require.Equal(t, types.LOG, events[1].Type)
|
|
|
- require.Len(t, responses, 1)
|
|
|
- require.Equal(t, 403, responses[0].BouncerHTTPResponseCode)
|
|
|
- require.Equal(t, 413, responses[0].UserHTTPResponseCode)
|
|
|
- require.Equal(t, appsec.BanRemediation, responses[0].Action)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "on_match: change action to a non standard one (log)",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule1",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- on_match: []appsec.Hook{
|
|
|
- {Filter: "IsInBand == true", Apply: []string{"SetRemediation('log')"}},
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Len(t, events, 2)
|
|
|
- require.Equal(t, types.APPSEC, events[0].Type)
|
|
|
- require.Equal(t, types.LOG, events[1].Type)
|
|
|
- require.Len(t, responses, 1)
|
|
|
- require.Equal(t, "log", responses[0].Action)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "on_match: change action to another standard one (allow)",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule1",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- on_match: []appsec.Hook{
|
|
|
- {Filter: "IsInBand == true", Apply: []string{"SetRemediation('allow')"}},
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Len(t, events, 2)
|
|
|
- require.Equal(t, types.APPSEC, events[0].Type)
|
|
|
- require.Equal(t, types.LOG, events[1].Type)
|
|
|
- require.Len(t, responses, 1)
|
|
|
- require.Equal(t, appsec.AllowRemediation, responses[0].Action)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "on_match: change action to another standard one (ban)",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule1",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- on_match: []appsec.Hook{
|
|
|
- {Filter: "IsInBand == true", Apply: []string{"SetRemediation('ban')"}},
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Len(t, responses, 1)
|
|
|
- //note: SetAction normalizes deny, ban and block to ban
|
|
|
- require.Equal(t, appsec.BanRemediation, responses[0].Action)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "on_match: change action to another standard one (captcha)",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule1",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- on_match: []appsec.Hook{
|
|
|
- {Filter: "IsInBand == true", Apply: []string{"SetRemediation('captcha')"}},
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Len(t, responses, 1)
|
|
|
- //note: SetAction normalizes deny, ban and block to ban
|
|
|
- require.Equal(t, appsec.CaptchaRemediation, responses[0].Action)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "on_match: change action to a non standard one",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule1",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- on_match: []appsec.Hook{
|
|
|
- {Filter: "IsInBand == true", Apply: []string{"SetRemediation('foobar')"}},
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Len(t, events, 2)
|
|
|
- require.Equal(t, types.APPSEC, events[0].Type)
|
|
|
- require.Equal(t, types.LOG, events[1].Type)
|
|
|
- require.Len(t, responses, 1)
|
|
|
- require.Equal(t, "foobar", responses[0].Action)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "on_match: cancel alert",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule42",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- on_match: []appsec.Hook{
|
|
|
- {Filter: "IsInBand == true && LogInfo('XX -> %s', evt.Appsec.MatchedRules.GetName())", Apply: []string{"CancelAlert()"}},
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Len(t, events, 1)
|
|
|
- require.Equal(t, types.LOG, events[0].Type)
|
|
|
- require.Len(t, responses, 1)
|
|
|
- require.Equal(t, appsec.BanRemediation, responses[0].Action)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "on_match: cancel event",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule42",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- on_match: []appsec.Hook{
|
|
|
- {Filter: "IsInBand == true", Apply: []string{"CancelEvent()"}},
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Len(t, events, 1)
|
|
|
- require.Equal(t, types.APPSEC, events[0].Type)
|
|
|
- require.Len(t, responses, 1)
|
|
|
- require.Equal(t, appsec.BanRemediation, responses[0].Action)
|
|
|
- },
|
|
|
- },
|
|
|
- }
|
|
|
- for _, test := range tests {
|
|
|
- t.Run(test.name, func(t *testing.T) {
|
|
|
- loadAppSecEngine(test, t)
|
|
|
- })
|
|
|
- }
|
|
|
-}
|
|
|
-
|
|
|
-func TestAppsecPreEvalHooks(t *testing.T) {
|
|
|
- /*
|
|
|
- [x] basic working hook
|
|
|
- [x] basic failing hook
|
|
|
- [ ] test the "OnSuccess" feature
|
|
|
- [ ] test multiple competing hooks
|
|
|
- [ ] test the variety of helpers
|
|
|
- */
|
|
|
- tests := []appsecRuleTest{
|
|
|
- {
|
|
|
- name: "Basic on_load hook to disable inband rule",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule1",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- pre_eval: []appsec.Hook{
|
|
|
- {Filter: "1 == 1", Apply: []string{"RemoveInBandRuleByName('rule1')"}},
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Empty(t, events)
|
|
|
- require.Len(t, responses, 1)
|
|
|
- require.False(t, responses[0].InBandInterrupt)
|
|
|
- require.False(t, responses[0].OutOfBandInterrupt)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "Basic on_load fails to disable rule",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule1",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- pre_eval: []appsec.Hook{
|
|
|
- {Filter: "1 ==2", Apply: []string{"RemoveInBandRuleByName('rule1')"}},
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Len(t, events, 2)
|
|
|
- require.Equal(t, types.APPSEC, events[0].Type)
|
|
|
-
|
|
|
- require.Equal(t, types.LOG, events[1].Type)
|
|
|
- require.True(t, events[1].Appsec.HasInBandMatches)
|
|
|
- require.Len(t, events[1].Appsec.MatchedRules, 1)
|
|
|
- require.Equal(t, "rule1", events[1].Appsec.MatchedRules[0]["msg"])
|
|
|
-
|
|
|
- require.Len(t, responses, 1)
|
|
|
- require.True(t, responses[0].InBandInterrupt)
|
|
|
-
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "on_load : disable inband by tag",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rulez",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- pre_eval: []appsec.Hook{
|
|
|
- {Apply: []string{"RemoveInBandRuleByTag('crowdsec-rulez')"}},
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Empty(t, events)
|
|
|
- require.Len(t, responses, 1)
|
|
|
- require.False(t, responses[0].InBandInterrupt)
|
|
|
- require.False(t, responses[0].OutOfBandInterrupt)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "on_load : disable inband by ID",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rulez",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- pre_eval: []appsec.Hook{
|
|
|
- {Apply: []string{"RemoveInBandRuleByID(1516470898)"}}, //rule ID is generated at runtime. If you change rule, it will break the test (:
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Empty(t, events)
|
|
|
- require.Len(t, responses, 1)
|
|
|
- require.False(t, responses[0].InBandInterrupt)
|
|
|
- require.False(t, responses[0].OutOfBandInterrupt)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "on_load : disable inband by name",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rulez",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- pre_eval: []appsec.Hook{
|
|
|
- {Apply: []string{"RemoveInBandRuleByName('rulez')"}},
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Empty(t, events)
|
|
|
- require.Len(t, responses, 1)
|
|
|
- require.False(t, responses[0].InBandInterrupt)
|
|
|
- require.False(t, responses[0].OutOfBandInterrupt)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "on_load : outofband default behavior",
|
|
|
- expected_load_ok: true,
|
|
|
- outofband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rulez",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Len(t, events, 1)
|
|
|
- require.Equal(t, types.LOG, events[0].Type)
|
|
|
- require.True(t, events[0].Appsec.HasOutBandMatches)
|
|
|
- require.False(t, events[0].Appsec.HasInBandMatches)
|
|
|
- require.Len(t, events[0].Appsec.MatchedRules, 1)
|
|
|
- require.Equal(t, "rulez", events[0].Appsec.MatchedRules[0]["msg"])
|
|
|
- //maybe surprising, but response won't mention OOB event, as it's sent as soon as the inband phase is over.
|
|
|
- require.Len(t, responses, 1)
|
|
|
- require.False(t, responses[0].InBandInterrupt)
|
|
|
- require.False(t, responses[0].OutOfBandInterrupt)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "on_load : set remediation by tag",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rulez",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- pre_eval: []appsec.Hook{
|
|
|
- {Apply: []string{"SetRemediationByTag('crowdsec-rulez', 'foobar')"}}, //rule ID is generated at runtime. If you change rule, it will break the test (:
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Len(t, events, 2)
|
|
|
- require.Len(t, responses, 1)
|
|
|
- require.Equal(t, "foobar", responses[0].Action)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "on_load : set remediation by name",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rulez",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- pre_eval: []appsec.Hook{
|
|
|
- {Apply: []string{"SetRemediationByName('rulez', 'foobar')"}}, //rule ID is generated at runtime. If you change rule, it will break the test (:
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Len(t, events, 2)
|
|
|
- require.Len(t, responses, 1)
|
|
|
- require.Equal(t, "foobar", responses[0].Action)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "on_load : set remediation by ID",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rulez",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- pre_eval: []appsec.Hook{
|
|
|
- {Apply: []string{"SetRemediationByID(1516470898, 'foobar')"}}, //rule ID is generated at runtime. If you change rule, it will break the test (:
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Len(t, events, 2)
|
|
|
- require.Len(t, responses, 1)
|
|
|
- require.Equal(t, "foobar", responses[0].Action)
|
|
|
- require.Equal(t, "foobar", appsecResponse.Action)
|
|
|
- require.Equal(t, http.StatusForbidden, appsecResponse.HTTPStatus)
|
|
|
- },
|
|
|
- },
|
|
|
- }
|
|
|
-
|
|
|
- for _, test := range tests {
|
|
|
- t.Run(test.name, func(t *testing.T) {
|
|
|
- loadAppSecEngine(test, t)
|
|
|
- })
|
|
|
- }
|
|
|
-}
|
|
|
-
|
|
|
-func TestAppsecRemediationConfigHooks(t *testing.T) {
|
|
|
-
|
|
|
- tests := []appsecRuleTest{
|
|
|
- {
|
|
|
- name: "Basic matching rule",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule1",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Equal(t, appsec.BanRemediation, responses[0].Action)
|
|
|
- require.Equal(t, http.StatusForbidden, statusCode)
|
|
|
- require.Equal(t, appsec.BanRemediation, appsecResponse.Action)
|
|
|
- require.Equal(t, http.StatusForbidden, appsecResponse.HTTPStatus)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "SetRemediation",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule1",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- on_match: []appsec.Hook{{Apply: []string{"SetRemediation('captcha')"}}}, //rule ID is generated at runtime. If you change rule, it will break the test (:
|
|
|
-
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Equal(t, appsec.CaptchaRemediation, responses[0].Action)
|
|
|
- require.Equal(t, http.StatusForbidden, statusCode)
|
|
|
- require.Equal(t, appsec.CaptchaRemediation, appsecResponse.Action)
|
|
|
- require.Equal(t, http.StatusForbidden, appsecResponse.HTTPStatus)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "SetRemediation",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule1",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- on_match: []appsec.Hook{{Apply: []string{"SetReturnCode(418)"}}}, //rule ID is generated at runtime. If you change rule, it will break the test (:
|
|
|
-
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Equal(t, appsec.BanRemediation, responses[0].Action)
|
|
|
- require.Equal(t, http.StatusForbidden, statusCode)
|
|
|
- require.Equal(t, appsec.BanRemediation, appsecResponse.Action)
|
|
|
- require.Equal(t, http.StatusTeapot, appsecResponse.HTTPStatus)
|
|
|
- },
|
|
|
- },
|
|
|
- }
|
|
|
-
|
|
|
- for _, test := range tests {
|
|
|
- t.Run(test.name, func(t *testing.T) {
|
|
|
- loadAppSecEngine(test, t)
|
|
|
- })
|
|
|
- }
|
|
|
-}
|
|
|
-func TestOnMatchRemediationHooks(t *testing.T) {
|
|
|
- tests := []appsecRuleTest{
|
|
|
- {
|
|
|
- name: "set remediation to allow with on_match hook",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule42",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- on_match: []appsec.Hook{
|
|
|
- {Filter: "IsInBand == true", Apply: []string{"SetRemediation('allow')"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Equal(t, appsec.AllowRemediation, appsecResponse.Action)
|
|
|
- require.Equal(t, http.StatusOK, appsecResponse.HTTPStatus)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "set remediation to captcha + custom user code with on_match hook",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule42",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- DefaultRemediation: appsec.AllowRemediation,
|
|
|
- on_match: []appsec.Hook{
|
|
|
- {Filter: "IsInBand == true", Apply: []string{"SetRemediation('captcha')", "SetReturnCode(418)"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- spew.Dump(responses)
|
|
|
- spew.Dump(appsecResponse)
|
|
|
-
|
|
|
- log.Errorf("http status : %d", statusCode)
|
|
|
- require.Equal(t, appsec.CaptchaRemediation, appsecResponse.Action)
|
|
|
- require.Equal(t, http.StatusTeapot, appsecResponse.HTTPStatus)
|
|
|
- require.Equal(t, http.StatusForbidden, statusCode)
|
|
|
- },
|
|
|
- },
|
|
|
- }
|
|
|
- for _, test := range tests {
|
|
|
- t.Run(test.name, func(t *testing.T) {
|
|
|
- loadAppSecEngine(test, t)
|
|
|
- })
|
|
|
- }
|
|
|
-}
|
|
|
-
|
|
|
-func TestAppsecDefaultPassRemediation(t *testing.T) {
|
|
|
-
|
|
|
- tests := []appsecRuleTest{
|
|
|
- {
|
|
|
- name: "Basic non-matching rule",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule1",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/",
|
|
|
- Args: url.Values{"foo": []string{"tutu"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Equal(t, appsec.AllowRemediation, responses[0].Action)
|
|
|
- require.Equal(t, http.StatusOK, statusCode)
|
|
|
- require.Equal(t, appsec.AllowRemediation, appsecResponse.Action)
|
|
|
- require.Equal(t, http.StatusOK, appsecResponse.HTTPStatus)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "DefaultPassAction: pass",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule1",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/",
|
|
|
- Args: url.Values{"foo": []string{"tutu"}},
|
|
|
- },
|
|
|
- DefaultPassAction: "allow",
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Equal(t, appsec.AllowRemediation, responses[0].Action)
|
|
|
- require.Equal(t, http.StatusOK, statusCode)
|
|
|
- require.Equal(t, appsec.AllowRemediation, appsecResponse.Action)
|
|
|
- require.Equal(t, http.StatusOK, appsecResponse.HTTPStatus)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "DefaultPassAction: captcha",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule1",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/",
|
|
|
- Args: url.Values{"foo": []string{"tutu"}},
|
|
|
- },
|
|
|
- DefaultPassAction: "captcha",
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Equal(t, appsec.CaptchaRemediation, responses[0].Action)
|
|
|
- require.Equal(t, http.StatusOK, statusCode) //@tko: body is captcha, but as it's 200, captcha won't be showed to user
|
|
|
- require.Equal(t, appsec.CaptchaRemediation, appsecResponse.Action)
|
|
|
- require.Equal(t, http.StatusOK, appsecResponse.HTTPStatus)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "DefaultPassHTTPCode: 200",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule1",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/",
|
|
|
- Args: url.Values{"foo": []string{"tutu"}},
|
|
|
- },
|
|
|
- UserPassedHTTPCode: 200,
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Equal(t, appsec.AllowRemediation, responses[0].Action)
|
|
|
- require.Equal(t, http.StatusOK, statusCode)
|
|
|
- require.Equal(t, appsec.AllowRemediation, appsecResponse.Action)
|
|
|
- require.Equal(t, http.StatusOK, appsecResponse.HTTPStatus)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "DefaultPassHTTPCode: 200",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule1",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/",
|
|
|
- Args: url.Values{"foo": []string{"tutu"}},
|
|
|
- },
|
|
|
- UserPassedHTTPCode: 418,
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Equal(t, appsec.AllowRemediation, responses[0].Action)
|
|
|
- require.Equal(t, http.StatusOK, statusCode)
|
|
|
- require.Equal(t, appsec.AllowRemediation, appsecResponse.Action)
|
|
|
- require.Equal(t, http.StatusTeapot, appsecResponse.HTTPStatus)
|
|
|
- },
|
|
|
- },
|
|
|
- }
|
|
|
- for _, test := range tests {
|
|
|
- t.Run(test.name, func(t *testing.T) {
|
|
|
- loadAppSecEngine(test, t)
|
|
|
- })
|
|
|
- }
|
|
|
-}
|
|
|
-
|
|
|
-func TestAppsecDefaultRemediation(t *testing.T) {
|
|
|
-
|
|
|
- tests := []appsecRuleTest{
|
|
|
- {
|
|
|
- name: "Basic matching rule",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule1",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Equal(t, appsec.BanRemediation, responses[0].Action)
|
|
|
- require.Equal(t, http.StatusForbidden, statusCode)
|
|
|
- require.Equal(t, appsec.BanRemediation, appsecResponse.Action)
|
|
|
- require.Equal(t, http.StatusForbidden, appsecResponse.HTTPStatus)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "default remediation to ban (default)",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule42",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- DefaultRemediation: "ban",
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Equal(t, appsec.BanRemediation, responses[0].Action)
|
|
|
- require.Equal(t, http.StatusForbidden, statusCode)
|
|
|
- require.Equal(t, appsec.BanRemediation, appsecResponse.Action)
|
|
|
- require.Equal(t, http.StatusForbidden, appsecResponse.HTTPStatus)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "default remediation to allow",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule42",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- DefaultRemediation: "allow",
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Equal(t, appsec.AllowRemediation, responses[0].Action)
|
|
|
- require.Equal(t, http.StatusOK, statusCode)
|
|
|
- require.Equal(t, appsec.AllowRemediation, appsecResponse.Action)
|
|
|
- require.Equal(t, http.StatusOK, appsecResponse.HTTPStatus)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "default remediation to captcha",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule42",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- DefaultRemediation: "captcha",
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Equal(t, appsec.CaptchaRemediation, responses[0].Action)
|
|
|
- require.Equal(t, http.StatusForbidden, statusCode)
|
|
|
- require.Equal(t, appsec.CaptchaRemediation, appsecResponse.Action)
|
|
|
- require.Equal(t, http.StatusForbidden, appsecResponse.HTTPStatus)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "custom user HTTP code",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule42",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- UserBlockedHTTPCode: 418,
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Equal(t, appsec.BanRemediation, responses[0].Action)
|
|
|
- require.Equal(t, http.StatusForbidden, statusCode)
|
|
|
- require.Equal(t, appsec.BanRemediation, appsecResponse.Action)
|
|
|
- require.Equal(t, http.StatusTeapot, appsecResponse.HTTPStatus)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "custom remediation + HTTP code",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule42",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- UserBlockedHTTPCode: 418,
|
|
|
- DefaultRemediation: "foobar",
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Equal(t, "foobar", responses[0].Action)
|
|
|
- require.Equal(t, http.StatusForbidden, statusCode)
|
|
|
- require.Equal(t, "foobar", appsecResponse.Action)
|
|
|
- require.Equal(t, http.StatusTeapot, appsecResponse.HTTPStatus)
|
|
|
- },
|
|
|
- },
|
|
|
- }
|
|
|
-
|
|
|
- for _, test := range tests {
|
|
|
- t.Run(test.name, func(t *testing.T) {
|
|
|
- loadAppSecEngine(test, t)
|
|
|
- })
|
|
|
- }
|
|
|
-}
|
|
|
-
|
|
|
-func TestAppsecRuleMatches(t *testing.T) {
|
|
|
-
|
|
|
- /*
|
|
|
- [x] basic matching rule
|
|
|
- [x] basic non-matching rule
|
|
|
- [ ] test the transformation
|
|
|
- [ ] ?
|
|
|
- */
|
|
|
- tests := []appsecRuleTest{
|
|
|
- {
|
|
|
- name: "Basic matching rule",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule1",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Len(t, events, 2)
|
|
|
- require.Equal(t, types.APPSEC, events[0].Type)
|
|
|
-
|
|
|
- require.Equal(t, types.LOG, events[1].Type)
|
|
|
- require.True(t, events[1].Appsec.HasInBandMatches)
|
|
|
- require.Len(t, events[1].Appsec.MatchedRules, 1)
|
|
|
- require.Equal(t, "rule1", events[1].Appsec.MatchedRules[0]["msg"])
|
|
|
-
|
|
|
- require.Len(t, responses, 1)
|
|
|
- require.True(t, responses[0].InBandInterrupt)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "Basic non-matching rule",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule1",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"tutu"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Empty(t, events)
|
|
|
- require.Len(t, responses, 1)
|
|
|
- require.False(t, responses[0].InBandInterrupt)
|
|
|
- require.False(t, responses[0].OutOfBandInterrupt)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "default remediation to allow",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule42",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- DefaultRemediation: "allow",
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Equal(t, appsec.AllowRemediation, responses[0].Action)
|
|
|
- require.Equal(t, http.StatusOK, statusCode)
|
|
|
- require.Equal(t, appsec.AllowRemediation, appsecResponse.Action)
|
|
|
- require.Equal(t, http.StatusOK, appsecResponse.HTTPStatus)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "default remediation to captcha",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule42",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- DefaultRemediation: "captcha",
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Equal(t, appsec.CaptchaRemediation, responses[0].Action)
|
|
|
- require.Equal(t, http.StatusForbidden, statusCode)
|
|
|
- require.Equal(t, appsec.CaptchaRemediation, appsecResponse.Action)
|
|
|
- require.Equal(t, http.StatusForbidden, appsecResponse.HTTPStatus)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "no default remediation / custom user HTTP code",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule42",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"toto"}},
|
|
|
- },
|
|
|
- UserBlockedHTTPCode: 418,
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Equal(t, appsec.BanRemediation, responses[0].Action)
|
|
|
- require.Equal(t, http.StatusForbidden, statusCode)
|
|
|
- require.Equal(t, appsec.BanRemediation, appsecResponse.Action)
|
|
|
- require.Equal(t, http.StatusTeapot, appsecResponse.HTTPStatus)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "no match but try to set remediation to captcha with on_match hook",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule42",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- on_match: []appsec.Hook{
|
|
|
- {Filter: "IsInBand == true", Apply: []string{"SetRemediation('captcha')"}},
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"bla"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Empty(t, events)
|
|
|
- require.Equal(t, http.StatusOK, statusCode)
|
|
|
- require.Equal(t, appsec.AllowRemediation, appsecResponse.Action)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "no match but try to set user HTTP code with on_match hook",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule42",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- on_match: []appsec.Hook{
|
|
|
- {Filter: "IsInBand == true", Apply: []string{"SetReturnCode(418)"}},
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"bla"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Empty(t, events)
|
|
|
- require.Equal(t, http.StatusOK, statusCode)
|
|
|
- require.Equal(t, appsec.AllowRemediation, appsecResponse.Action)
|
|
|
- },
|
|
|
- },
|
|
|
- {
|
|
|
- name: "no match but try to set remediation with pre_eval hook",
|
|
|
- expected_load_ok: true,
|
|
|
- inband_rules: []appsec_rule.CustomRule{
|
|
|
- {
|
|
|
- Name: "rule42",
|
|
|
- Zones: []string{"ARGS"},
|
|
|
- Variables: []string{"foo"},
|
|
|
- Match: appsec_rule.Match{Type: "regex", Value: "^toto"},
|
|
|
- Transform: []string{"lowercase"},
|
|
|
- },
|
|
|
- },
|
|
|
- pre_eval: []appsec.Hook{
|
|
|
- {Filter: "IsInBand == true", Apply: []string{"SetRemediationByName('rule42', 'captcha')"}},
|
|
|
- },
|
|
|
- input_request: appsec.ParsedRequest{
|
|
|
- RemoteAddr: "1.2.3.4",
|
|
|
- Method: "GET",
|
|
|
- URI: "/urllll",
|
|
|
- Args: url.Values{"foo": []string{"bla"}},
|
|
|
- },
|
|
|
- output_asserts: func(events []types.Event, responses []appsec.AppsecTempResponse, appsecResponse appsec.BodyResponse, statusCode int) {
|
|
|
- require.Empty(t, events)
|
|
|
- require.Equal(t, http.StatusOK, statusCode)
|
|
|
- require.Equal(t, appsec.AllowRemediation, appsecResponse.Action)
|
|
|
- },
|
|
|
- },
|
|
|
- }
|
|
|
-
|
|
|
- for _, test := range tests {
|
|
|
- t.Run(test.name, func(t *testing.T) {
|
|
|
- loadAppSecEngine(test, t)
|
|
|
- })
|
|
|
- }
|
|
|
-}
|
|
|
-
|
|
|
func loadAppSecEngine(test appsecRuleTest, t *testing.T) {
|
|
|
if testing.Verbose() {
|
|
|
log.SetLevel(log.TraceLevel)
|
Sebastien Blot