update netacea_integration.json to 5.13.0

[mizdebski-netacea]

No description provided.

[mizdebski-netacea]

Previous PR: #747

[rswalkden]

@harmony7 could you review and merge this when you have a moment? Thanks 🙂

[harmony7]

-if (!is_path_ignored() && !req.is_purge) {
+if (!is_path_ignored() && !req.is_purge && req.http.x-netacea:fail_open != "true") {

-    if (var.integration_mode == "INJECT" || req.http.X-Netacea-Compile-JSON == "requested") {
+    if (var.integration_mode == "INJECT" || req.http.X-Netacea-Compile-JSON == "requested" || resp.http.X-Netacea-Mitigate == "4") {

-    set req.http.host = req.http.netacea_origin_host;
-    set req.url = req.http.netacea_origin_url;
-    set req.method = req.http.netacea_origin_method;
-    unset req.http.netacea_origin_url;
-    unset req.http.netacea_origin_host;
-    unset req.http.netacea_origin_method;
+    set req.http.host = req.http.x-netacea:origin_host;
+    set req.url = req.http.x-netacea:origin_url;
+    set req.method = req.http.x-netacea:origin_method;

[rswalkden]

@harmony7 Thanks for taking the time to look at this. Could you elaborate a little on what you are spotting here? I think the changes we have proposed are intentional

[harmony7]

I'm just making a list of everything that has changed, so that I can look at them.

[harmony7]

   "captcha_path": "{{netacea_captcha_path}}",
   "captcha_header": "{{netacea_captcha_header}}",
+  "cookie_attributes": "{{netacea_cookie_attributes}}",
+  "captcha_cookie_attributes": "{{netacea_captcha_cookie_attributes}}",
   "enable_captcha_content_negotiation": "{{netacea_enable_ccn}}"
 }

 }
 sub get_netacea_config_integration_version STRING {
-  return "5.10.7";
+  return "5.13.0";
 }
 sub get_netacea_config_api_key STRING {

   return table.lookup(Netacea_Config, "integration_mode", "");
 }
+sub get_netacea_config_cookie_attributes STRING {
+  if (req.http.x-netacea:edge_config_key_prefix) {
+    return table.lookup(netacea_edge_config, req.http.x-netacea:edge_config_key_prefix + "cookie_attributes");
+  }
+  return table.lookup(Netacea_Config, "cookie_attributes", "");
+}
+sub get_netacea_config_captcha_cookie_attributes STRING {
+  if (req.http.x-netacea:edge_config_key_prefix) {
+    return table.lookup(netacea_edge_config, req.http.x-netacea:edge_config_key_prefix + "captcha_cookie_attributes");
+  }
+  return table.lookup(Netacea_Config, "captcha_cookie_attributes", "");
+}
 sub get_netacea_config_ignore_list STRING {
   if (req.http.x-netacea:edge_config_key_prefix) {

   }
   return "_mitatacaptcha";
+}
+sub get_netacea_session_cookie_domain STRING {
+  set req.http.get_netacea_session_cookie_domain = get_netacea_config_cookie_attributes();
+  declare local var.domain_to_return STRING;
+  set var.domain_to_return = subfield(req.http.get_netacea_session_cookie_domain, "Domain", ";");
+  unset req.http.get_netacea_session_cookie_domain;
+  return var.domain_to_return;
+}
+sub get_netacea_captcha_cookie_domain STRING {
+  set req.http.get_netacea_captcha_cookie_domain = get_netacea_config_captcha_cookie_attributes();
+  declare local var.domain_to_return STRING;
+  set var.domain_to_return = subfield(req.http.get_netacea_captcha_cookie_domain, "Domain", ";");
+  unset req.http.get_netacea_captcha_cookie_domain;
+  return var.domain_to_return;
+}
+sub get_sanitised_netacea_config_cookie_attributes (STRING var.cookie_type) STRING {
+  declare local var.attributes_to_return STRING;
+  declare local var.cookie_domain STRING;
+  declare local var.alternative_cookie_domain STRING;
+  if(var.cookie_type == "session") {
+    set req.http.netacea_cookie_attributes = get_netacea_config_cookie_attributes();
+    set var.cookie_domain = get_netacea_session_cookie_domain();
+    set var.alternative_cookie_domain = get_netacea_captcha_cookie_domain();
+  } else {
+    set req.http.netacea_cookie_attributes = get_netacea_config_captcha_cookie_attributes();
+    set var.alternative_cookie_domain = get_netacea_session_cookie_domain();
+    if (std.strlen(var.alternative_cookie_domain) == 0) {
+      set var.cookie_domain = get_netacea_captcha_cookie_domain();
+    }
+  }
+  set req.http.netacea_cookie_attributes = regsuball(req.http.netacea_cookie_attributes, "(?i)(^|; ?)Domain=[^;]*", "");
+  if (std.strlen(var.cookie_domain) > 0) {
+    set req.http.netacea_cookie_attributes = req.http.netacea_cookie_attributes + "; Domain=" + var.cookie_domain;
+  } else if (std.strlen(var.alternative_cookie_domain) > 0) {
+    set req.http.netacea_cookie_attributes = req.http.netacea_cookie_attributes + "; Domain=" + var.alternative_cookie_domain;
+  }
+  if (!subfield(req.http.netacea_cookie_attributes, "Max-Age", ";")) {
+    set req.http.netacea_cookie_attributes = req.http.netacea_cookie_attributes + "; Max-Age=86400";
+  }
+  if (!subfield(req.http.netacea_cookie_attributes, "Path", ";")) {
+    set req.http.netacea_cookie_attributes = req.http.netacea_cookie_attributes + "; Path=/";
+  }
+  set var.attributes_to_return = req.http.netacea_cookie_attributes;
+  unset req.http.netacea_cookie_attributes;
+  return regsub(var.attributes_to_return, "^; ?", ""); 
 }
 table Netacea_Match_Dict {

   "1": "blocked",
   "2": "allow",
-  "3": "hardblocked"
+  "3": "hardblocked",
+  "4": "flagged"
 }
 table Netacea_Best_Mitigations_Dict {

   "1": "block",
   "2": "allow",
-  "3": "block"
+  "3": "block",
+  "4": "flag"
 }
 table Netacea_Best_Mitigations_Captcha_Dict {

   return var.json_weight > var.html_weight;
 }
-sub netacea_hide_response_headers {
-  unset resp.http.X-Netacea-Captcha;
-  unset resp.http.X-Netacea-Event-ID;
-  unset resp.http.X-Netacea-Match;
-  unset resp.http.X-Netacea-MitATA-Expiry;
-  unset resp.http.X-Netacea-MitATA-Value;
-  unset resp.http.X-Netacea-Mitigate;
-}
 sub set_netacea_captcha_header {
   declare local var.captcha_header_name STRING;

     set var.ignored = setcookie.delete_by_name(resp, "_mitatacaptcha");
     declare local var.netacea_captcha_cookie_name STRING;
+    declare local var.netacea_captcha_cookie_attributes STRING;
     set var.netacea_captcha_cookie_name = get_sanitised_netacea_config_captcha_cookie_name();
+    set var.netacea_captcha_cookie_attributes = get_sanitised_netacea_config_cookie_attributes("captcha");
     set var.netacea_mitSvc_secret = get_netacea_config_secret_key();
     set var.netacea_encryption_key = get_netacea_config_encryption_key();

         set var.netacea_iv_trimmed = std.replaceall(var.netacea_iv, "-", "");
         set var.netacea_mitata_captcha_cookie_value_encrypted = crypto.encrypt_hex(aes256, ctr, nopad, var.netacea_encryption_key, var.netacea_iv_trimmed, var.netacea_mitata_captcha_cookie_value_hex);
+        if (fastly.error) {
+          call netacea_fail_open;
+        }
         set var.netacea_sig = digest.hmac_sha256(var.netacea_mitSvc_secret, var.netacea_mitata_captcha_cookie_value_encrypted);
         set var.netacea_mitata_captcha_cookie_final_value = var.netacea_iv_trimmed + "." + var.netacea_mitata_captcha_cookie_value_encrypted + "." + var.netacea_sig;
-        add resp.http.Set-Cookie = var.netacea_captcha_cookie_name + "=" + var.netacea_mitata_captcha_cookie_final_value + "; Max-Age=" + req.http.netacea_mitata_captcha_cookie_expiry + "; Path=/;";
+        add resp.http.Set-Cookie = var.netacea_captcha_cookie_name + "=" + var.netacea_mitata_captcha_cookie_final_value + "; " + var.netacea_captcha_cookie_attributes;
       }
       if (var.netacea_encryption_key !~ ".") {
-        add resp.http.Set-Cookie = var.netacea_captcha_cookie_name + "=" + req.http.netacea_mitata_captcha_cookie_value + "; Max-Age=" + req.http.netacea_mitata_captcha_cookie_expiry + "; Path=/;";
+        add resp.http.Set-Cookie = var.netacea_captcha_cookie_name + "=" + req.http.netacea_mitata_captcha_cookie_value + "; " + var.netacea_captcha_cookie_attributes;
       }
     }

     declare local var.netacea_client_ip_time_ua_hash STRING;
     declare local var.netacea_cookie_name STRING;
+    declare local var.netacea_cookie_attributes STRING;
     set var.netacea_mitigation_code = req.http.netacea_best_mitigation_code;
     set var.netacea_mitSvc_userId = req.http.X-Netacea-UserId;
     set var.netacea_cookie_name = get_sanitised_netacea_config_cookie_name();
+    set var.netacea_cookie_attributes = get_sanitised_netacea_config_cookie_attributes("session");
     if (req.http.netacea_require_revalidation == "1") {
       set var.netacea_mitSvc_exp = time.units("s", time.sub(now, 1m));

       set var.netacea_iv_trimmed = std.replaceall(var.netacea_iv, "-", "");
       set var.netacea_mitata_cookie_full_value_encrypted = crypto.encrypt_hex(aes256, ctr, nopad, var.netacea_encryption_key, var.netacea_iv_trimmed, var.netacea_mitata_cookie_full_value_hex);
+      if (fastly.error) {
+        call netacea_fail_open;
+      }
       set var.netacea_sig = digest.hmac_sha256(var.netacea_mitSvc_secret, var.netacea_mitata_cookie_full_value_encrypted);
       set var.netacea_mitata_cookie_final_value = var.netacea_iv_trimmed + "." + var.netacea_mitata_cookie_full_value_encrypted + "." + var.netacea_sig;
-      add resp.http.Set-Cookie = var.netacea_cookie_name + "=" + var.netacea_mitata_cookie_final_value + "; Max-Age=" + time.units("s", 1d) + "; Path=/;";
+      add resp.http.Set-Cookie = var.netacea_cookie_name + "=" + var.netacea_mitata_cookie_final_value + ";" + var.netacea_cookie_attributes;
     }
     if (var.netacea_encryption_key !~ ".") {
-      add resp.http.Set-Cookie = var.netacea_cookie_name + "=" + var.netacea_mitata_cookie_full_value+ "; Max-Age=" + time.units("s", 1d) + "; Path=/;";
+      add resp.http.Set-Cookie = var.netacea_cookie_name + "=" + var.netacea_mitata_cookie_full_value + ";" + var.netacea_cookie_attributes;
     }
     set req.http.mitigation_user_id = var.netacea_mitSvc_userId;

     return;
   }
+  unset req.http.x-netacea;
+  unset req.http.x-netacea-*;
+  unset req.http.netacea_*;
+  unset req.http.mitigation_user_id;
+  unset req.http.integration_version;
+  unset req.http.integration_type;
   set req.http.netacea_best_mitigation_code = "000";
   set req.http.netacea_match = "0";
   set req.http.netacea_mitigate = "0";
   set req.http.netacea_captcha = "0";
-  unset req.http.mit_status;
-  unset req.http.netacea_bctype_string;
-  unset req.http.netacea_best_mitigation;
-  unset req.http.netacea_cookies;
-  unset req.http.netacea_mitata_captcha_cookie_expiry;
-  unset req.http.netacea_mitata_captcha_cookie_value;
-  unset req.http.netacea_mitata_must_reauthenticate;
-  unset req.http.netacea_require_revalidation;
-  unset req.http.netacea_set_cookies;
-  unset req.http.X-Netacea-Match;
-  unset req.http.X-Netacea-Mitigate;
-  unset req.http.X-Netacea-Captcha;
-  unset req.http.X-Netacea-Event-ID;
-  unset req.http.X-Netacea-Api-Key;
-  unset req.http.X-Netacea-Captcha-Status;
-  unset req.http.X-Netacea-UserId;
-  unset req.http.X-Netacea-Compile-JSON;
-  unset req.http.x-netacea;
+}
+sub netacea_hide_response_headers {
+  unset resp.http.X-Netacea-*;
+}
+sub cleanup_netacea_bereq_headers {
+  unset bereq.http.x-netacea;
+  unset bereq.http.netacea_*;
+  unset bereq.http.mitigation_user_id;
+  unset bereq.http.integration_version;
+  unset bereq.http.integration_type;
 }
+sub prepare_netacea_protector_api_call {
+  set bereq.http.X-Netacea-Request-ID = req.http.x-netacea:request_id;
+  set bereq.url = querystring.add(req.url, "netaceaHeaders", "request-id");
+}
+sub netacea_fail_open {
+  set req.http.host = if(req.http.x-netacea:origin_host, req.http.x-netacea:origin_host, req.http.host);
+  set req.method = if(req.http.x-netacea:origin_method, req.http.x-netacea:origin_method, req.method);
+  set req.url = if(req.http.x-netacea:origin_url, req.http.x-netacea:origin_url, req.url);
+  set req.http.x-netacea:fail_open = "true";
+  set req.http.netacea_bctype_string = "error_open";
+  restart;
+}
 sub netacea_check_req {
-  if (req.is_purge) {
+  if (req.is_purge || req.http.x-netacea:fail_open == "true") {
     return;
   }

   if (req.restarts == 0) {
     call set_netacea_ip_header;
+    set req.http.integration_type = get_netacea_config_integration_type();
+    set req.http.integration_version = get_netacea_config_integration_version();
+    if (!req.http.x-netacea:request_id) {
+      set req.http.x-netacea:request_id = uuid.version7() + "-" + req.xid;
+    }
     if (req.http.x-netacea:integration_mode != "BYPASS") {
       set var.netacea_mitSvc_authenticate = true;

     set req.http.x-netacea:mit_svc_start_time = time.elapsed.msec;
     if (req.backend.healthy) {
-      set req.http.netacea_origin_method = "GET";
+      set req.http.x-netacea:origin_method = "GET";
       set req.http.netacea_processed = "1";
       set req.http.netacea_captcha_path = "1";
-      set req.http.netacea_origin_host = req.http.host;
-      set req.http.netacea_origin_url = req.url;
+      set req.http.x-netacea:origin_host = req.http.host;
+      set req.http.x-netacea:origin_url = req.url;
       set req.url = "/captcha?" + req.url.qs;
       set req.http.X-Netacea-Api-Key = var.netacea_mitSvc_apiKey;

   }
   set req.http.mitigation_user_id = req.http.X-Netacea-UserId;
-  set req.http.integration_type = get_netacea_config_integration_type();
-  set req.http.integration_version = get_netacea_config_integration_version();
   if (var.netacea_mitSvc_authenticate) {
     set req.http.netacea_set_cookies = "1";
   } else {
-    if (req.http.x-netacea:integration_mode == "INJECT" && req.restarts == 0) {
+    if ((req.http.x-netacea:integration_mode == "INJECT" && req.restarts == 0) || req.http.netacea_mitigate == "4") {
       set req.http.X-Netacea-Match = req.http.netacea_match;
       set req.http.X-Netacea-Mitigate = req.http.netacea_mitigate;

       unset req.http.netacea_captcha;
       unset req.http.Cookie:_mitata;
-      set req.http.netacea_origin_method = req.method;
+      set req.http.x-netacea:origin_method = req.method;
       set req.http.netacea_processed = "1";
-      set req.http.netacea_origin_host = req.http.host;
-      set req.http.netacea_origin_url = req.url;
+      set req.http.x-netacea:origin_host = req.http.host;
+      set req.http.x-netacea:origin_url = req.url;
       if (req.url != "/AtaVerifyCaptcha") {
         set req.method = "GET";

[rcaril]

@rswalkden - can you please provide us with a detailed changelog so we can better understand the goals of this change?

[rcaril]

Changelog provided by @rswalkden:

5.10.8 introduces netacea_pass and netacea_miss to sanitise bereq headers of Netacea headers, and also x-sigsci-no-inspection to avoid our Protector API requests from being blocked by WAF.
5.10.9 Error handling for cookie encryption key configuration.
5.10.10 Better clean-up of x-netacea-* headers from response.
5.11.0 All for attributes set on Netacea Session and Captcha cookies to be configured.
5.12.0 Allows the integration to "Flag" requests, & set the x-netacea-mitate header to 4, based on the Protector API response.
5.13.0 Generate and log a unique ID for each request.

[rcaril]

Updates look good to me.