feat(appsec): add fingerprints

appsec/src/helper/subscriber/waf.cpp

@@ -233,9 +233,10 @@ void instance::listener::call(dds::parameter_view &data, event &event)
     // NOLINTNEXTLINE
     total_runtime_ += res.total_runtime / 1000.0;
 
-    const parameter_view schemas{res.derivatives};
-    for (const auto &schema : schemas) {
-        schemas_.emplace(schema.key(), std::move(parameter_to_json(schema)));
+    const parameter_view derivatives{res.derivatives};
+    for (const auto &derivative : derivatives) {
+        derivatives_.emplace(
+            derivative.key(), std::move(parameter_to_json(derivative)));
     }
 
     switch (code) {
@@ -264,17 +265,19 @@ void instance::listener::get_meta_and_metrics(
     meta[std::string(tag::event_rules_version)] = ruleset_version_;
     metrics[tag::waf_duration] = total_runtime_;
 
-    for (const auto &[key, value] : schemas_) {
-        std::string schema = value;
-        if (value.length() > max_plain_schema_allowed) {
-            auto encoded = compress(schema);
+    for (const auto &[key, value] : derivatives_) {
+        std::string derivative = value;
+        if (value.length() > max_plain_schema_allowed &&
+            key.starts_with("_dd.appsec.s")) {
+
+            auto encoded = compress(derivative);
             if (encoded) {
-                schema = base64_encode(encoded.value(), false);
+                derivative = base64_encode(encoded.value(), false);
             }
         }
 
-        if (schema.length() <= max_schema_size) {
-            meta.emplace(key, std::move(schema));
+        if (derivative.length() <= max_schema_size) {
+            meta.emplace(key, std::move(derivative));
         }
     }
 }

appsec/src/helper/subscriber/waf.hpp

@@ -46,7 +46,7 @@ class instance : public dds::subscriber {
         std::chrono::microseconds waf_timeout_;
         double total_runtime_{0.0};
         std::string_view ruleset_version_;
-        std::map<std::string, std::string> schemas_;
+        std::map<std::string, std::string> derivatives_;
     };
 
     // NOLINTNEXTLINE(google-runtime-references)

appsec/tests/helper/client_test.cpp

@@ -4,9 +4,12 @@
 // This product includes software developed at Datadog
 // (https://www.datadoghq.com/). Copyright 2021 Datadog, Inc.
 #include "common.hpp"
+#include "parameter.hpp"
 #include <base64.h>
 #include <client.hpp>
 #include <compression.hpp>
+#include <cstring>
+#include <gtest/gtest.h>
 #include <json_helper.hpp>
 #include <network/broker.hpp>
 #include <rapidjson/document.h>
@@ -103,9 +106,6 @@ void request_init(mock::broker *broker, client &c)
 {
     network::request_init::request msg;
     msg.data = parameter::map();
-    msg.data.add(
-        "server.request.headers.no_cookies", parameter::string("Arachni"sv));
-    msg.data.add("server.request.body", parameter::string("asdfds"sv));
 
     network::request req(std::move(msg));
 
@@ -786,6 +786,8 @@ TEST(ClientTest, RequestShutdown)
         network::request_shutdown::request msg;
         msg.data = parameter::map();
         msg.data.add("server.response.code", parameter::string("1991"sv));
+        msg.data.add("server.request.headers.no_cookies",
+            parameter::string("Arachni"sv));
 
         network::request req(std::move(msg));
 
@@ -1763,6 +1765,252 @@ TEST(ClientTest, RequestExecWithAttack)
     }
 }
 
+TEST(ClientTest, RequestInitWithFingerprint)
+{
+    auto smanager = std::make_shared<service_manager>();
+    auto broker = new mock::broker();
+
+    client c(smanager, std::unique_ptr<mock::broker>(broker));
+
+    network::client_init::request msg = get_default_client_init_msg();
+    msg.engine_settings.rules_file = create_sample_rules_ok_with_fingerprint();
+    msg.enabled_configuration = EXTENSION_CONFIGURATION_ENABLED;
+
+    send_client_init(broker, c, std::move(msg));
+
+    // Request Init
+    {
+        network::request_init::request msg;
+
+        msg.data = parameter::map();
+        msg.data.add("http.client_ip", parameter::string("192.168.1.1"sv));
+
+        // Endpoint Fingerprint inputs
+        auto query = parameter::map();
+        query.add("query", parameter::string("asdfds"sv));
+        msg.data.add("server.request.uri.raw", parameter::string("asdfds"sv));
+        msg.data.add("server.request.method", parameter::string("GET"sv));
+        msg.data.add("server.request.query", std::move(query));
+
+        // Network and Headers Fingerprint inputs
+        msg.data.add(
+            "server.request.headers.no_cookies", parameter::string(""sv));
+
+        // Session Fingerprint inputs
+        msg.data.add("server.request.cookies", parameter::string("asdfds"sv));
+        msg.data.add("usr.session_id", parameter::string("asdfds"sv));
+        msg.data.add("usr.id", parameter::string("asdfds"sv));
+
+        network::request req(std::move(msg));
+
+        std::shared_ptr<network::base_response> res;
+        EXPECT_CALL(*broker, recv(_)).WillOnce(Return(req));
+        EXPECT_CALL(*broker,
+            send(
+                testing::An<const std::shared_ptr<network::base_response> &>()))
+            .WillOnce(DoAll(testing::SaveArg<0>(&res), Return(true)));
+
+        EXPECT_TRUE(c.run_request());
+        auto msg_res =
+            dynamic_cast<network::request_init::response *>(res.get());
+        EXPECT_STREQ(msg_res->actions[0].verdict.c_str(), "block");
+    }
+
+    // Request Shutdown
+    {
+        network::request_shutdown::request msg;
+        msg.data = parameter::map();
+
+        network::request req(std::move(msg));
+
+        std::shared_ptr<network::base_response> res;
+        EXPECT_CALL(*broker, recv(_)).WillOnce(Return(req));
+        EXPECT_CALL(*broker,
+            send(
+                testing::An<const std::shared_ptr<network::base_response> &>()))
+            .WillOnce(DoAll(testing::SaveArg<0>(&res), Return(true)));
+
+        EXPECT_TRUE(c.run_request());
+        auto msg_res =
+            dynamic_cast<network::request_shutdown::response *>(res.get());
+        EXPECT_STREQ(msg_res->actions[0].verdict.c_str(), "ok");
+        EXPECT_EQ(msg_res->triggers.size(), 0);
+
+        EXPECT_TRUE(std::regex_match(
+            msg_res->meta["_dd.appsec.fp.http.endpoint"].c_str(),
+            std::regex("\"http-get(-[A-Za-z0-9]*){3}\"")));
+
+        EXPECT_TRUE(std::regex_match(
+            msg_res->meta["_dd.appsec.fp.http.network"].c_str(),
+            std::regex("\"net-[0-9]*-[a-zA-Z0-9]*\"")));
+
+        EXPECT_TRUE(
+            std::regex_match(msg_res->meta["_dd.appsec.fp.http.header"].c_str(),
+                std::regex("\"hdr(-[0-9]*-[a-zA-Z0-9]*){2}\"")));
+
+        EXPECT_TRUE(
+            std::regex_match(msg_res->meta["_dd.appsec.fp.session"].c_str(),
+                std::regex("\"ssn(-[a-zA-Z0-9]*){4}\"")));
+    }
+}
+
+TEST(ClientTest, RequestExecWithFingerprint)
+{
+    auto smanager = std::make_shared<service_manager>();
+    auto broker = new mock::broker();
+
+    client c(smanager, std::unique_ptr<mock::broker>(broker));
+
+    network::client_init::request msg = get_default_client_init_msg();
+    msg.engine_settings.rules_file = create_sample_rules_ok_with_fingerprint();
+    msg.enabled_configuration = EXTENSION_CONFIGURATION_ENABLED;
+
+    send_client_init(broker, c, std::move(msg));
+    request_init(broker, c);
+
+    // Request Exec
+    {
+        network::request_exec::request msg;
+        msg.data = parameter::map();
+        msg.data.add("http.client_ip", parameter::string("192.168.1.1"sv));
+
+        // Endpoint Fingerprint inputs
+        auto query = parameter::map();
+        query.add("query", parameter::string("asdfds"sv));
+        msg.data.add("server.request.uri.raw", parameter::string("asdfds"sv));
+        msg.data.add("server.request.method", parameter::string("GET"sv));
+        msg.data.add("server.request.query", std::move(query));
+
+        // Network and Headers Fingerprint inputs
+        msg.data.add(
+            "server.request.headers.no_cookies", parameter::string(""sv));
+
+        // Session Fingerprint inputs
+        msg.data.add("server.request.cookies", parameter::string("asdfds"sv));
+        msg.data.add("usr.session_id", parameter::string("asdfds"sv));
+        msg.data.add("usr.id", parameter::string("asdfds"sv));
+
+        network::request req(std::move(msg));
+
+        std::shared_ptr<network::base_response> res;
+        EXPECT_CALL(*broker, recv(_)).WillOnce(Return(req));
+        EXPECT_CALL(*broker,
+            send(
+                testing::An<const std::shared_ptr<network::base_response> &>()))
+            .WillOnce(DoAll(testing::SaveArg<0>(&res), Return(true)));
+
+        EXPECT_TRUE(c.run_request());
+        auto msg_res =
+            dynamic_cast<network::request_exec::response *>(res.get());
+        EXPECT_STREQ(msg_res->actions[0].verdict.c_str(), "block");
+    }
+
+    // Request Shutdown
+    {
+        network::request_shutdown::request msg;
+        msg.data = parameter::map();
+
+        network::request req(std::move(msg));
+
+        std::shared_ptr<network::base_response> res;
+        EXPECT_CALL(*broker, recv(_)).WillOnce(Return(req));
+        EXPECT_CALL(*broker,
+            send(
+                testing::An<const std::shared_ptr<network::base_response> &>()))
+            .WillOnce(DoAll(testing::SaveArg<0>(&res), Return(true)));
+
+        EXPECT_TRUE(c.run_request());
+        auto msg_res =
+            dynamic_cast<network::request_shutdown::response *>(res.get());
+        EXPECT_STREQ(msg_res->actions[0].verdict.c_str(), "ok");
+
+        EXPECT_TRUE(std::regex_match(
+            msg_res->meta["_dd.appsec.fp.http.endpoint"].c_str(),
+            std::regex("\"http-get(-[A-Za-z0-9]*){3}\"")));
+
+        EXPECT_TRUE(std::regex_match(
+            msg_res->meta["_dd.appsec.fp.http.network"].c_str(),
+            std::regex("\"net-[0-9]*-[a-zA-Z0-9]*\"")));
+
+        EXPECT_TRUE(
+            std::regex_match(msg_res->meta["_dd.appsec.fp.http.header"].c_str(),
+                std::regex("\"hdr(-[0-9]*-[a-zA-Z0-9]*){2}\"")));
+
+        EXPECT_TRUE(
+            std::regex_match(msg_res->meta["_dd.appsec.fp.session"].c_str(),
+                std::regex("\"ssn(-[a-zA-Z0-9]*){4}\"")));
+    }
+}
+
+TEST(ClientTest, RequestShutdownWithFingerprint)
+{
+    auto smanager = std::make_shared<service_manager>();
+    auto broker = new mock::broker();
+
+    client c(smanager, std::unique_ptr<mock::broker>(broker));
+
+    network::client_init::request msg = get_default_client_init_msg();
+    msg.engine_settings.rules_file = create_sample_rules_ok_with_fingerprint();
+    msg.enabled_configuration = EXTENSION_CONFIGURATION_ENABLED;
+
+    send_client_init(broker, c, std::move(msg));
+    request_init(broker, c);
+
+    // Request Shutdown
+    {
+        network::request_shutdown::request msg;
+
+        msg.data = parameter::map();
+        msg.data.add("http.client_ip", parameter::string("192.168.1.1"sv));
+
+        // Endpoint Fingerprint inputs
+        auto query = parameter::map();
+        query.add("query", parameter::string("asdfds"sv));
+        msg.data.add("server.request.uri.raw", parameter::string("asdfds"sv));
+        msg.data.add("server.request.method", parameter::string("GET"sv));
+        msg.data.add("server.request.query", std::move(query));
+
+        // Network and Headers Fingerprint inputs
+        msg.data.add(
+            "server.request.headers.no_cookies", parameter::string(""sv));
+
+        // Session Fingerprint inputs
+        msg.data.add("server.request.cookies", parameter::string("asdfds"sv));
+        msg.data.add("usr.session_id", parameter::string("asdfds"sv));
+        msg.data.add("usr.id", parameter::string("asdfds"sv));
+
+        network::request req(std::move(msg));
+
+        std::shared_ptr<network::base_response> res;
+        EXPECT_CALL(*broker, recv(_)).WillOnce(Return(req));
+        EXPECT_CALL(*broker,
+            send(
+                testing::An<const std::shared_ptr<network::base_response> &>()))
+            .WillOnce(DoAll(testing::SaveArg<0>(&res), Return(true)));
+
+        EXPECT_TRUE(c.run_request());
+        auto msg_res =
+            dynamic_cast<network::request_shutdown::response *>(res.get());
+        EXPECT_STREQ(msg_res->actions[0].verdict.c_str(), "block");
+
+        EXPECT_TRUE(std::regex_match(
+            msg_res->meta["_dd.appsec.fp.http.endpoint"].c_str(),
+            std::regex("\"http-get(-[A-Za-z0-9]*){3}\"")));
+
+        EXPECT_TRUE(std::regex_match(
+            msg_res->meta["_dd.appsec.fp.http.network"].c_str(),
+            std::regex("\"net-[0-9]*-[a-zA-Z0-9]*\"")));
+
+        EXPECT_TRUE(
+            std::regex_match(msg_res->meta["_dd.appsec.fp.http.header"].c_str(),
+                std::regex("\"hdr(-[0-9]*-[a-zA-Z0-9]*){2}\"")));
+
+        EXPECT_TRUE(
+            std::regex_match(msg_res->meta["_dd.appsec.fp.session"].c_str(),
+                std::regex("\"ssn(-[a-zA-Z0-9]*){4}\"")));
+    }
+}
+
 TEST(ClientTest, RequestExecWithoutClientInit)
 {
     auto smanager = std::make_shared<service_manager>();

appsec/tests/helper/common.hpp

@@ -32,4 +32,5 @@ using namespace std::literals;
 using namespace std::chrono_literals;
 
 std::string create_sample_rules_ok();
+std::string create_sample_rules_ok_with_fingerprint();
 std::string create_sample_rules_invalid();