Skip to content

Commit f30c137

Browse files
mehakseedat63mehakseedat63
authored
Merge pull request #1876 from alphadev4/Azure/Ag-Request-Body-Size
Azure/AG-Request-Body-Size
2 parents fcd3d6e + 6d9d672 commit f30c137

File tree

3 files changed

+186
-0
lines changed

3 files changed

+186
-0
lines changed

‎exports.js

+1
Original file line numberDiff line numberDiff line change
@@ -1024,6 +1024,7 @@ module.exports = {
10241024
'agSslPolicy' : require(__dirname + '/plugins/azure/applicationGateway/agSslPolicy'),
10251025
'agPreventionModeEnabled' : require(__dirname + '/plugins/azure/applicationGateway/agPreventionModeEnabled.js'),
10261026
'agRequestBodyInspection' : require(__dirname + '/plugins/azure/applicationGateway/agRequestBodyInspection'),
1027+
'agRequestBodySize' : require(__dirname + '/plugins/azure/applicationGateway/agRequestBodySize.js'),
10271028

10281029
'subscriptionHasTags' : require(__dirname + '/plugins/azure/subscription/subscriptionHasTags.js'),
10291030

‎plugins/azure/applicationGateway/agRequestBodySize.js

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
const async = require('async');
2+
const helpers = require('../../../helpers/azure');
3+
4+
module.exports = {
5+
title: 'Application Gateway Request Body Size',
6+
category: 'Application Gateway',
7+
domain: 'Network Access Control',
8+
description: 'Ensures that Application Gateway WAF policy have desired request body size configured.',
9+
more_info: 'Application Gateway WAF policy includes a maximum request body size field, specified in kilobytes. This setting controls the overall request size limit, excluding any file uploads. Configuring an appropriate value for this field is crucial for optimizing security and performance.',
10+
recommended_action: 'Modify application gateway WAF policy and set the max body size to desired value.',
11+
link: 'https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-request-size-limits',
12+
apis: ['wafPolicies:listAll'],
13+
settings: {
14+
max_request_body_size: {
15+
name: 'Max Request Body Size',
16+
description: 'The default value for request body size is 128 KB. The setting checks for request body size and produces pass result if it is greater than or equal to the desired value.',
17+
regex: '^(12[8-9]|1[3-9]{1,2}|2000)$',
18+
default: '128',
19+
},
20+
},
21+
realtime_triggers: ['microsoftnetwork:applicationgatewaywebapplicationfirewallpolicies:write', 'microsoftnetwork:applicationgatewaywebapplicationfirewallpolicies:delete'],
22+
23+
run: function(cache, settings, callback) {
24+
const results = [];
25+
const source = {};
26+
const locations = helpers.locations(settings.govcloud);
27+
var config = {
28+
max_request_body_size: settings.max_request_body_size || this.settings.max_request_body_size.default,
29+
};
30+
31+
async.each(locations.wafPolicies, (location, rcb) => {
32+
33+
var wafPolicies = helpers.addSource(cache, source,
34+
['wafPolicies', 'listAll', location]);
35+
36+
if (!wafPolicies) return rcb();
37+
38+
if (wafPolicies.err || !wafPolicies.data) {
39+
helpers.addResult(results, 3, 'Unable to query for Application Gateway WAF policies: ' + helpers.addError(wafPolicies), location);
40+
return rcb();
41+
}
42+
if (!wafPolicies.data.length) {
43+
helpers.addResult(results, 0, 'No existing WAF policies found', location);
44+
return rcb();
45+
}
46+
47+
for (let policy of wafPolicies.data) {
48+
if (!policy.id) continue;
49+
var maxRequestBodySize = config.max_request_body_size;
50+
if (policy.policySettings && policy.policySettings.maxRequestBodySizeInKb && policy.policySettings.maxRequestBodySizeInKb <= maxRequestBodySize) {
51+
helpers.addResult(results, 0, `Application gateway WAF policy has max request body size of ${policy.policySettings.maxRequestBodySizeInKb} which is less than or equal to ${maxRequestBodySize}`, location, policy.id);
52+
} else {
53+
helpers.addResult(results, 2, `Application gateway WAF policy has max request body size of ${policy.policySettings.maxRequestBodySizeInKb} which is greater than ${maxRequestBodySize}`, location, policy.id);
54+
}
55+
}
56+
57+
rcb();
58+
}, function() {
59+
callback(null, results, source);
60+
});
61+
}
62+
};

‎plugins/azure/applicationGateway/agRequestBodySize.spec.js

+123
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
var expect = require('chai').expect;
2+
var agRequestBodySize = require('./agRequestBodySize.js');
3+
4+
const wafPolicy = [
5+
{
6+
"name": 'test-vnet',
7+
"id": '/subscriptions/123/resourceGroups/aqua-resource-group/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies',
8+
"type": 'Microsoft.Network/waf',
9+
"tags": { "key": "value" },
10+
"location": 'eastus',
11+
"provisioningState": 'Succeeded',
12+
"virtualNetworkPeerings": [],
13+
"enableDdosProtection": true,
14+
"policySettings":{
15+
"mode": "prevention",
16+
"requestBodyCheck": true,
17+
"maxRequestBodySizeInKb": 128
18+
}
19+
},
20+
{
21+
"name": 'test-vnet',
22+
"id": '/subscriptions/123/resourceGroups/aqua-resource-group/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies',
23+
"type": 'Microsoft.Network/waf',
24+
"tags": {},
25+
"location": 'eastus',
26+
"provisioningState": 'Succeeded',
27+
"virtualNetworkPeerings": [],
28+
"enableDdosProtection": false,
29+
"policySettings":{
30+
"mode": "prevention",
31+
"requestBodyCheck": true,
32+
"maxRequestBodySizeInKb": 800
33+
34+
}
35+
},
36+
{
37+
"name": 'test-vnet',
38+
"id": '/subscriptions/123/resourceGroups/aqua-resource-group/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies',
39+
"type": 'Microsoft.Network/waf',
40+
"tags": {},
41+
"location": 'eastus',
42+
"provisioningState": 'Succeeded',
43+
"virtualNetworkPeerings": [],
44+
"enableDdosProtection": false,
45+
"policySettings":{
46+
"mode": "prevention",
47+
"requestBodyCheck": false,
48+
"maxRequestBodySizeInKb": 128
49+
50+
}
51+
},
52+
];
53+
54+
const createCache = (waf) => {
55+
return {
56+
wafPolicies: {
57+
listAll: {
58+
'eastus': {
59+
data: waf
60+
}
61+
}
62+
}
63+
};
64+
};
65+
66+
const createErrorCache = () => {
67+
return {
68+
wafPolicies: {
69+
listAll: {
70+
'eastus': {}
71+
}
72+
}
73+
};
74+
};
75+
76+
describe('agRequestBodySize', function() {
77+
describe('run', function() {
78+
it('should give passing result if no WAF policy found', function(done) {
79+
const cache = createCache([]);
80+
agRequestBodySize.run(cache, {}, (err, results) => {
81+
expect(results.length).to.equal(1);
82+
expect(results[0].status).to.equal(0);
83+
expect(results[0].message).to.include('No existing WAF policies found');
84+
expect(results[0].region).to.equal('eastus');
85+
done();
86+
});
87+
});
88+
89+
it('should give unknown result if Unable to query for WAF policy', function(done) {
90+
const cache = createErrorCache();
91+
agRequestBodySize.run(cache, {}, (err, results) => {
92+
expect(results.length).to.equal(1);
93+
expect(results[0].status).to.equal(3);
94+
expect(results[0].message).to.include('Unable to query for Application Gateway WAF policies');
95+
expect(results[0].region).to.equal('eastus');
96+
done();
97+
});
98+
});
99+
100+
it('should give passing result if Application gateway WAF policy has max request body size of 128 - without setting', function(done) {
101+
const cache = createCache([wafPolicy[0]]);
102+
agRequestBodySize.run(cache, {}, (err, results) => {
103+
expect(results.length).to.equal(1);
104+
expect(results[0].status).to.equal(0);
105+
expect(results[0].message).to.include('Application gateway WAF policy has max request body size of 128 which is less than or equal to 128');
106+
expect(results[0].region).to.equal('eastus');
107+
done();
108+
});
109+
});
110+
111+
it('should give failing result if Application gateway WAF policy has max request body size greater than 500 - with setting', function(done) {
112+
const cache = createCache([wafPolicy[1]]);
113+
agRequestBodySize.run(cache, {max_request_body_size: 500}, (err, results) => {
114+
expect(results.length).to.equal(1);
115+
expect(results[0].status).to.equal(2);
116+
expect(results[0].message).to.include('Application gateway WAF policy has max request body size of 800 which is greater than 500');
117+
expect(results[0].region).to.equal('eastus');
118+
done();
119+
});
120+
});
121+
122+
});
123+
});

0 commit comments

Comments
 (0)