HTTP Endpoint Fingerprint Processor

cmake/objects.cmake

@@ -45,6 +45,7 @@ set(LIBDDWAF_SOURCE
     ${libddwaf_SOURCE_DIR}/src/parser/scanner_parser.cpp
     ${libddwaf_SOURCE_DIR}/src/parser/exclusion_parser.cpp
     ${libddwaf_SOURCE_DIR}/src/processor/extract_schema.cpp
+    ${libddwaf_SOURCE_DIR}/src/processor/fingerprint.cpp
     ${libddwaf_SOURCE_DIR}/src/condition/lfi_detector.cpp
     ${libddwaf_SOURCE_DIR}/src/condition/sqli_detector.cpp
     ${libddwaf_SOURCE_DIR}/src/condition/ssrf_detector.cpp

src/builder/processor_builder.cpp

@@ -8,6 +8,7 @@
 
 #include "builder/processor_builder.hpp"
 #include "processor/extract_schema.hpp"
+#include "processor/fingerprint.hpp"
 
 namespace ddwaf {
 
@@ -42,6 +43,14 @@ template <> struct typed_processor_builder<extract_schema> {
     }
 };
 
+template <> struct typed_processor_builder<http_endpoint_fingerprint> {
+    std::shared_ptr<base_processor> build(const auto &spec)
+    {
+        return std::make_shared<http_endpoint_fingerprint>(
+            spec.id, spec.expr, spec.mappings, spec.evaluate, spec.output);
+    }
+};
+
 template <typename T, typename Spec, typename Scanners>
 concept has_build_with_scanners =
     requires(typed_processor_builder<T> b, Spec spec, Scanners scanners) {
@@ -70,6 +79,8 @@ template <typename T>
     switch (type) {
     case processor_type::extract_schema:
         return build_with_type<extract_schema>(*this, scanners);
+    case processor_type::http_endpoint_fingerprint:
+        return build_with_type<http_endpoint_fingerprint>(*this, scanners);
     default:
         break;
     }

src/builder/processor_builder.hpp

@@ -19,10 +19,10 @@ namespace ddwaf {
 enum class processor_type : unsigned {
     extract_schema,
     // Reserved
-    http_fingerprint,
+    http_endpoint_fingerprint,
+    http_network_fingerprint,
+    http_header_fingerprint,
     session_fingerprint,
-    network_fingerprint,
-    header_fingerprint,
 };
 
 struct processor_builder {

src/obfuscator.hpp

@@ -29,7 +29,7 @@ class obfuscator {
     static constexpr std::string_view redaction_msg{"<Redacted>"};
 
     static constexpr std::string_view default_key_regex_str{
-        R"((?i)(?:p(?:ass)?w(?:or)?d|pass(?:[_-]?phrase)?|secret(?:[_-]?key)?|(?:(?:api|private|public|access)[_-]?)key)|(?:(?:auth|access|id|refresh)[_-]?)?token|consumer[_-]?(?:id|key|secret)|sign(?:ed|ature)|bearer|authorization|jsessionid|phpsessid|asp\.net[_-]sessionid|sid|jwt)"};
+        R"((?i)pass|pw(?:or)?d|secret|(?:api|private|public|access)[_-]?key|token|consumer[_-]?(?:id|key|secret)|sign(?:ed|ature)|bearer|authorization|jsessionid|phpsessid|asp\.net[_-]sessionid|sid|jwt)"};
 
 protected:
     std::unique_ptr<re2::RE2> key_regex{nullptr};

src/parser/processor_parser.cpp

@@ -8,11 +8,14 @@
 #include "parser/common.hpp"
 #include "parser/parser.hpp"
 #include "processor/base.hpp"
+#include "processor/extract_schema.hpp"
+#include "processor/fingerprint.hpp"
 #include <vector>
 
 namespace ddwaf::parser::v2 {
 
 namespace {
+template <typename T>
 std::vector<processor_mapping> parse_processor_mappings(
     const parameter::vector &root, address_container &addresses)
 {
@@ -24,22 +27,26 @@ std::vector<processor_mapping> parse_processor_mappings(
     for (const auto &node : root) {
         auto mapping = static_cast<parameter::map>(node);
 
-        // TODO support n:1 mappings and key paths
-        auto inputs = at<parameter::vector>(mapping, "inputs");
-        if (inputs.empty()) {
-            throw ddwaf::parsing_error("empty processor input mapping");
-        }
+        std::vector<processor_parameter> parameters;
+        for (const auto &param : T::param_names) {
+            // TODO support n:1 mappings and key paths
+            auto inputs = at<parameter::vector>(mapping, param);
+            if (inputs.empty()) {
+                throw ddwaf::parsing_error("empty processor input mapping");
+            }
 
-        auto input = static_cast<parameter::map>(inputs[0]);
-        auto input_address = at<std::string>(input, "address");
-        auto output = at<std::string>(mapping, "output");
+            auto input = static_cast<parameter::map>(inputs[0]);
+            auto input_address = at<std::string>(input, "address");
 
-        addresses.optional.emplace(input_address);
+            addresses.optional.emplace(input_address);
 
+            parameters.emplace_back(processor_parameter{
+                {processor_target{get_target_index(input_address), std::move(input_address), {}}}});
+        }
+
+        auto output = at<std::string>(mapping, "output");
         mappings.emplace_back(processor_mapping{
-            {processor_parameter{
-                {processor_target{get_target_index(input_address), std::move(input_address), {}}}}},
-            {get_target_index(output), std::move(output), {}}});
+            std::move(parameters), {get_target_index(output), std::move(output), {}}});
     }
 
     return mappings;
@@ -71,6 +78,20 @@ processor_container parse_processors(
             auto generator_id = at<std::string>(node, "generator");
             if (generator_id == "extract_schema") {
                 type = processor_type::extract_schema;
+            } else if (generator_id == "http_endpoint_fingerprint") {
+                type = processor_type::http_endpoint_fingerprint;
+            } else if (generator_id == "http_network_fingerprint") {
+                type = processor_type::http_network_fingerprint;
+                // Skip for now
+                continue;
+            } else if (generator_id == "http_header_fingerprint") {
+                type = processor_type::http_header_fingerprint;
+                // Skip for now
+                continue;
+            } else if (generator_id == "session_fingerprint") {
+                type = processor_type::session_fingerprint;
+                // Skip for now
+                continue;
             } else {
                 DDWAF_WARN("Unknown generator: {}", generator_id);
                 info.add_failed(id, "unknown generator '" + generator_id + "'");
@@ -82,7 +103,13 @@ processor_container parse_processors(
 
             auto params = at<parameter::map>(node, "parameters");
             auto mappings_vec = at<parameter::vector>(params, "mappings");
-            auto mappings = parse_processor_mappings(mappings_vec, addresses);
+            std::vector<processor_mapping> mappings;
+            if (type == processor_type::extract_schema) {
+                mappings = parse_processor_mappings<extract_schema>(mappings_vec, addresses);
+            } else {
+                mappings =
+                    parse_processor_mappings<http_endpoint_fingerprint>(mappings_vec, addresses);
+            }
 
             std::vector<reference_spec> scanners;
             auto scanners_ref_array = at<parameter::vector>(params, "scanners", {});