envoyproxy / envoyproxy/envoy

Parsing args in URIs and request body and matching them in the Generic Matching Engine

Open
#24,615 5 comments 0 reactions 0 assignees View on GitHub
area/matching help wanted
Dominant language
C++
Stars
28.9k
Forks
5.6k
Avg merge
1d 20h
Merged PRs (30d)
437

Description

The Ability to Parse Args Is Essential for a WAF

We, [Curiefense](https://www.curiefense.io/) maintainers, willing to extend Generic Matching so it can act as de-facto Native WAF for Envoy users.

The vision is simple: Curiefense users will be able to activate the security policy in a given runnign environemtn, using generic-matching, since the rules will be renderd as such.

We have work on a PoC that already has the capabilitied to do so (attached yaml), yet, without the ability to parse and match entries in the queryString and request body, the WAF cannot be considered useful.

The table below describe the current capabilities and the missing ones, and tagged them with their priority (P1..P4)
#### Capabilities map

| Function | y/n | Remarks |
|-------------------|-----|--------------------------------|
| Match headers | Yes | |
| Match CIDR | Yes | |
| Query string args | No | **P1** |
| Body args | No | **P1** form-url-encoded and multipart |
| JSON body | No | **P2** nested structures |
| GraphQL body | No | **P3** |
| XML body | No | **P4** |
| Geo, ASN, IP INfo | No | Require [MaxMind integration](https://github.com/envoyproxy/envoy/issues/17153) |

So far, we have added support for the following Curiefense policy generation
* WAF rules (signatures)
* Global filters tagging
* ACL

Curiefense team involved:
* [aguinet](https://github.com/aguinet)
* [xavier](https://github.com/xavier-rbz)
* [bartavelle](https://github.com/bartavelle)
* [tzuryby](https://github.com/tzuryby)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.