google / google/stellar-engine
[Feature Request] Set default max size of cloud armor package payloads to be 8KB.
- Dominant language
- HCL
- Stars
- 49
- Forks
- 20
- Avg merge
- 3d 14h
- Merged PRs (30d)
- 28
Description
## Feature Description
Set default max size of cloud armor package payloads to be 8KB.
## Use Case
When a preconfigured WAF rule is evaluated in a Cloud Armor security policy, up to the first 64 kB (either 8 kB, 16 kB, 32 kB, 48 kB, or 64 kB) of a request body is inspected for signature matches against the WAF rules. After these limits, the payload is no longer inspected.
## Proposed Solution
Block requests larger than 8KB by default:
```
gcloud compute security-policies rules create 10 \
--security-policy my-policy \
--expression "int(request.headers['content-length']) > 8192" \
--action deny-403 \
--description "Block requests greater than 8 kB"
```
## Additional Context
* [Cloud Docs Source](https://docs.cloud.google.com/armor/docs/security-policy-overview#request-body)
* [Cloud Docs Mitigation Reccomendation](https://docs.cloud.google.com/armor/docs/configure-waf#request-body)
* [Article on known exploit](https://kloudle.com/blog/piercing-the-cloud-armor-the-8kb-bypass-in-google-cloud-platform-waf/)
Contributor guide
Assessment
This issue has not been assessed yet.