google / google/stellar-engine

[Feature Request] Set default max size of cloud armor package payloads to be 8KB.

Open
#29 0 comments 0 reactions 0 assignees View on GitHub
enhancement security
Dominant language
HCL
Stars
49
Forks
20
Avg merge
3d 14h
Merged PRs (30d)
28

Description

## Feature Description
Set default max size of cloud armor package payloads to be 8KB.

## Use Case
When a preconfigured WAF rule is evaluated in a Cloud Armor security policy, up to the first 64 kB (either 8 kB, 16 kB, 32 kB, 48 kB, or 64 kB) of a request body is inspected for signature matches against the WAF rules. After these limits, the payload is no longer inspected.

## Proposed Solution
Block requests larger than 8KB by default:
```
gcloud compute security-policies rules create 10 \
--security-policy my-policy \
--expression "int(request.headers['content-length']) > 8192" \
--action deny-403 \
--description "Block requests greater than 8 kB"
```

## Additional Context
* [Cloud Docs Source](https://docs.cloud.google.com/armor/docs/security-policy-overview#request-body)
* [Cloud Docs Mitigation Reccomendation](https://docs.cloud.google.com/armor/docs/configure-waf#request-body)
* [Article on known exploit](https://kloudle.com/blog/piercing-the-cloud-armor-the-8kb-bypass-in-google-cloud-platform-waf/)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.