-
Notifications
You must be signed in to change notification settings - Fork 140
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[ASM] Suspicious attacker blocking (#6057)
## Summary of changes This PR adds the required code to support the suspicious attack functionality. It has added the required code to read the exclusion data from the RC. It also has modified the existing code regarding RC actions. Previously, if a configuration was received with an action, the configuration was stored and later sent to the WAF. If new values with an empty action array would come later, the previous action configurations would be deleted, but if a new array would come with a new action different than the previous one, we would report them both to the WAF. This behavior was making the suspicious attacker system tests fail because we would keep RC changes from previous tests. This change seems to be aligned with the behavior of other libraries. The file [AspNetBase.cs](https://github.com/DataDog/dd-trace-dotnet/pull/6057/files#diff-0faff2451113067d7669566ba9199908b720a3764914b00d6f33d4b376098d74) has been updated. Now, tests have more control over the used headers by allowing them to remove headers or replace previous values with new ones. ## Reason for change ## Implementation details ## Test coverage ## Other details <!-- Fixes #{issue} --> <!--⚠️ Note: where possible, please obtain 2 approvals prior to merging. Unless CODEOWNERS specifies otherwise, for external teams it is typically best to have one review from a team member, and one review from apm-dotnet. Trivial changes do not require 2 reviews. -->
- Loading branch information
1 parent
b637501
commit f93ed0a
Showing
7 changed files
with
188 additions
and
8 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
138 changes: 138 additions & 0 deletions
138
tracer/test/Datadog.Trace.Security.IntegrationTests/Rcm/AspNetCore5AsmAttackerBlocking.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,138 @@ | ||
| // <copyright file="AspNetCore5AsmAttackerBlocking.cs" company="Datadog"> | ||
| // Unless explicitly stated otherwise all files in this repository are licensed under the Apache 2 License. | ||
| // This product includes software developed at Datadog (https://www.datadoghq.com/). Copyright 2017 Datadog, Inc. | ||
| // </copyright> | ||
|
|
||
| #if NETCOREAPP3_0_OR_GREATER | ||
|
|
||
| using System; | ||
| using System.Collections.Generic; | ||
| using System.Net; | ||
| using System.Threading.Tasks; | ||
| using Datadog.Trace.AppSec; | ||
| using Datadog.Trace.AppSec.Rcm.Models.AsmFeatures; | ||
| using Datadog.Trace.Configuration; | ||
| using Datadog.Trace.TestHelpers; | ||
| using Datadog.Trace.Vendors.Newtonsoft.Json.Linq; | ||
| using FluentAssertions; | ||
| using Xunit; | ||
| using Xunit.Abstractions; | ||
| using Action = Datadog.Trace.AppSec.Rcm.Models.Asm.Action; | ||
|
|
||
| namespace Datadog.Trace.Security.IntegrationTests.Rcm; | ||
|
|
||
| public class AspNetCore5AsmAttackerBlocking : RcmBase | ||
| { | ||
| private const string AsmProduct = "ASM"; | ||
|
|
||
| public AspNetCore5AsmAttackerBlocking(AspNetCoreTestFixture fixture, ITestOutputHelper outputHelper) | ||
| : base(fixture, outputHelper, enableSecurity: true, testName: nameof(AspNetCore5AsmAttackerBlocking)) | ||
| { | ||
| SetEnvironmentVariable(ConfigurationKeys.DebugEnabled, "0"); | ||
| SetEnvironmentVariable("DD_APPSEC_WAF_DEBUG", "0"); | ||
| } | ||
|
|
||
| [Fact] | ||
| [Trait("RunOnWindows", "True")] | ||
| public async Task TestSuspiciousAttackerBlocking() | ||
| { | ||
| List<KeyValuePair<string, string>> headersAttacker = new() | ||
| { | ||
| new KeyValuePair<string, string>("http.client_ip", "34.65.27.85"), | ||
| new KeyValuePair<string, string>("X-Real-Ip", "34.65.27.85"), | ||
| new KeyValuePair<string, string>("accept-encoding", "identity"), | ||
| new KeyValuePair<string, string>("x-forwarded-for", null), | ||
| }; | ||
|
|
||
| List<KeyValuePair<string, string>> headersRegular = new() | ||
| { | ||
| new KeyValuePair<string, string>("X-Real-Ip", null), | ||
| new KeyValuePair<string, string>("accept-encoding", "identity"), | ||
| new KeyValuePair<string, string>("x-forwarded-for", null), | ||
| }; | ||
|
|
||
| var headersAttackerArachni = new List<KeyValuePair<string, string>>(headersAttacker) | ||
| { | ||
| new KeyValuePair<string, string>("User-Agent", "Arachni/v1"), | ||
| }; | ||
|
|
||
| var headersRegularArachni = new List<KeyValuePair<string, string>>(headersRegular) | ||
| { | ||
| new KeyValuePair<string, string>("User-Agent", "Arachni/v1"), | ||
| }; | ||
|
|
||
| var headersAttackerScanner = new List<KeyValuePair<string, string>>(headersAttacker) | ||
| { | ||
| new KeyValuePair<string, string>("User-Agent", "dd-test-scanner-log-block"), | ||
| }; | ||
|
|
||
| var headersRegularScanner = new List<KeyValuePair<string, string>>(headersRegular) | ||
| { | ||
| new KeyValuePair<string, string>("User-Agent", "dd-test-scanner-log-block"), | ||
| }; | ||
|
|
||
| string url = "/Health"; | ||
| IncludeAllHttpSpans = true; | ||
| await TryStartApp(); | ||
| var agent = Fixture.Agent; | ||
| var result = SubmitRequest(url, null, null, headers: headersAttackerScanner); | ||
| result.Result.StatusCode.Should().Be(HttpStatusCode.Forbidden); | ||
|
|
||
| var configurationInitial = new[] | ||
| { | ||
| ((object)new AppSec.Rcm.Models.Asm.Payload | ||
| { | ||
| Actions = new[] | ||
| { | ||
| new Action { Id = "block", Type = BlockingAction.BlockRequestType, Parameters = new AppSec.Rcm.Models.Asm.Parameter { StatusCode = 403, Type = "json" } } | ||
| }, | ||
| }, | ||
| AsmProduct, | ||
| nameof(TestSuspiciousAttackerBlocking)), | ||
| ((object)new AsmFeatures | ||
| { | ||
| Asm = new AsmFeature { Enabled = true }, | ||
| }, | ||
| "ASM_FEATURES", | ||
| nameof(TestSuspiciousAttackerBlocking)) | ||
| }; | ||
|
|
||
| await agent.SetupRcmAndWait(Output, configurationInitial); | ||
| result = SubmitRequest(url, null, null, headers: headersAttackerScanner); | ||
|
|
||
| var exclusions = "[{\"id\": \"exc-000-001\",\"on_match\": \"block_custom\",\"conditions\": [{\"operator\": \"ip_match\",\"parameters\": {\"data\": \"suspicious_ips_data_id\", \"inputs\": [{\"address\": \"http.client_ip\"}]}}]}]"; | ||
| var configuration = new[] | ||
| { | ||
| (new AppSec.Rcm.Models.Asm.Payload | ||
| { | ||
| Actions = new[] | ||
| { | ||
| new Action { Id = "block_custom", Type = BlockingAction.BlockRequestType, Parameters = new AppSec.Rcm.Models.Asm.Parameter { StatusCode = 405, Type = "auto" } } | ||
| }, | ||
| Exclusions = (JArray)JToken.Parse(exclusions) | ||
| }, | ||
| AsmProduct, | ||
| nameof(TestSuspiciousAttackerBlocking)), | ||
| ((object)new AppSec.Rcm.Models.AsmData.Payload | ||
| { | ||
| ExclusionsData = new[] | ||
| { | ||
| new AppSec.Rcm.Models.AsmData.RuleData { Id = "suspicious_ips_data_id", Type = "ip_with_expiration", Data = new AppSec.Rcm.Models.AsmData.Data[] { new() { Value = "34.65.27.85" } } } | ||
| }, | ||
| }, | ||
| "ASM_DATA", | ||
| nameof(TestSuspiciousAttackerBlocking)), | ||
| }; | ||
|
|
||
| await agent.SetupRcmAndWait(Output, configuration); | ||
| result = SubmitRequest(url + "?a=3", null, null, headers: headersAttackerScanner); | ||
| result.Result.StatusCode.Should().Be(HttpStatusCode.MethodNotAllowed); | ||
| result = SubmitRequest(url + "?a=4", null, null, headers: headersRegularScanner); | ||
| result.Result.StatusCode.Should().Be(HttpStatusCode.Forbidden); | ||
| result = SubmitRequest(url + "?a=5", null, null, headers: headersAttackerArachni); | ||
| result.Result.StatusCode.Should().Be(HttpStatusCode.MethodNotAllowed); | ||
| result = SubmitRequest(url + "?a=6", null, null, headers: headersRegularArachni); | ||
| result.Result.StatusCode.Should().Be(HttpStatusCode.OK); | ||
| } | ||
| } | ||
| #endif |