Understanding Conditions

Input JSON Document Structure

When evaluating JMESPath expressions, WAF provides an input JSON document, which includes the details of the HTTP request or HTTP response that triggered the evaluation. The input JSON document is always a JSON object.

Example

For an HTTP request with the following details:

• Source IP address and port: 129.146.10.1:48152

• Country code that the source IP address belongs to: US

• ASN that the source IP address belongs to: 31898

• Destination IP address and port: 205.147.88.0:80

• Destination host: example.com

• Protocol: HTTP/1.1

GET /test/path/img.jpg?param1=a&m2=b HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cookie: cookie1=A; cookie2=B; cookie3=3C; cookie3=3D
Host: example.com
User-Agent: HTTPie/2.4.0

The following JSON input document is generated and passed to JMESPath expressions:

{
  "connection": {
    "source": {
      "address": "129.146.10.1",
      "port": 49152,
      "geo": {
        "countryCode": "US"
      },
      "routing": {
        "asn": 31898
      }
    },
    "destination": {
      "address": "205.147.88.0",
      "port": 80
    },
    "protocol": "http"
  },
  "http": {
    "request": {
      "host": "www.example.com",
      "method": "GET",
      "version": "1.1",
      "url": {
        "path": "/test/path/img.jpg",
        "query": "param1=a&param2=b",
        "queryParameters": {
          "param1": ["a"],
          "param2": ["b"]
        },
        "queryPrefix": "?"
      },
      "headers": {
        "accept": ["*/*"],
        "accept-encoding": ["gzip, deflate"],
        "connection": ["keep-alive"],
        "cookie": [
          "cookie1=A; cookie2=B; cookie3=3C; cookie3=3D"
        ],
        "host": ["www.example.com"],
        "user-agent": ["HTTPie/2.4.0"]
      },
      "cookies": {
        "cookie1": ["A"],
        "cookie2": ["B"],
        "cookie3": ["3C", "3D"]
      }
    }
  }
}

Reference

{
  "param1": ["a"],
  "param2": ["b"],
  "param3": ["c"]
}

{
  "multi": ["one","two", "3"],
  "encoded key": ["two words"]
}

Accept: application/json, text/csv
Accept: */*
Accept-Encoding: gzip
Accept-Encoding: deflate
Connection: keep-alive
Content-Language: en, fr
Content-Type: application/json
Host: www.example.com
User-Agent: HTTPie/2.2.0

{
  "accept":           ["application/json, text/csv", "*/*"],
  "accept-encoding":  ["gzip", "deflate"],
  "connection":       ["keep-alive"],
  "content-language": ["en, fr"],
  "content-type":     ["application/json"],
  "host":             ["www.example.com"],
  "user-agent":       ["HTTPie/2.2.0"]
}
}

cookie1=A; cookie2=B; cookie3=3C; cookie3=3D

{
  "cookie1": ["A"],
  "cookie2": ["B"],
  "cookie3": ["3C", "3D"]
}

Cache-Control: no-cache
Cache-Control: must-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8

{
  "cache-control":    ["no-cache", "must-revalidate"],
  "connection":       ["keep-alive"],
  "content-encoding": ["gzip"],
  "content-type":     ["text/html;charset=UTF-8"]
}

Case-Insensitive String Matching

In addition to string matching functions supported by default in JMESPath, WAF adds support for four functions that can match strings case-insensitively:

• i_equals (case-insensitive variant of the == operator);
• i_contains (case-insensitive variant of the contains function);
• i_starts_with (case-insensitive variant of the starts_with function);
• i_ends_with (case-insensitive variant of the ends_with function).

i_equals

boolean i_equals(string $left, string $right)

i_contains

boolean i_contains(array|string $subject, any $search)

If the provided $subject is a string, this function returns true if the string contains the provided $search argument, when compared case-insensitively (both $left and $right strings are converted to lower case, only English letters are converted to lower case). Otherwise, this function returns false.

If $subject is an array, this function returns true if at least one of the elements in the array is equal to the provided $search value, otherwise it returns false.

If $search is a string - comparison is done using the same logic as in i_equals() function: case-insensitive comparison (both the individual $subject array element and $search strings are converted to lower case, only English letters are converted to lower case).

If $search isn't a string - comparison is done using the standard == operator.

i_starts_with

boolean i_starts_with(string $subject, string $prefix)

i_ends_with

boolean i_ends_with(string $subject, string $suffix)

IP Address Matching

WAF adds support for multiple functions that can match an IP address against a list of CIDR ranges or WAF Network Address List resources:

• address_in (matches an IP address against a list of CIDR ranges);

• address_in_network_address_list (matches an IP address against a WAF Network Address List resource);

• vcn_address_in_network_address_list (matches an IP address with a VCN ID against a WAF Network Address List resource).

address_in

boolean address_in(string $ip_address, array[string] $cidr_subnets)

Returns true if the given $ip_address is contained in at least one of the CIDR subnets specified in $cidr_subnets. Otherwise, returns false.

$ip_address must be a string containing an IP address.

$cidr_subnets must be an array of strings containing one CIDR subnet each.

{
  "connection": {
    "source": {
      "address": "1.1.1.1"
    }
  }
}

address_in_network_address_list

boolean address_in_network_address_list(string $ip_address, array[string] $nal_ids)

$ip_address must be a string containing an IP address.

$nal_id arguments must be an array of strings, referencing WAF NetworkAddressList resources by ID. All referenced NetworkAddressLists must be of type: "ADDRESSES".

Example 1

{
  "connection": {
    "source": {
      "address": "1.1.1.1"
    }
  }
}

{
  "connection": {
    "source": {
      "address": "1.1.1.1"
    }
  }
}

vcn_address_in_network_address_list

boolean vcn_address_in_network_address_list(string $ip_address, string $vcn_id, array[string] $nal_ids)

$ip_address must be a string containing an IP address.

$vcn_id must be a string containing an OCID of a VCN.

$nal_ids must be an array of strings, referencing WAF NetworkAddressList resources by ID. All referenced NetworkAddressLists must be of type: "VCN_ADDRESSES".

{
  "connection": {
    "source": {
      "address": "10.0.0.1"
    }
  },
  "paResource": {
    "vcnOcid": "ocid1.vcn...a"
  }
}

vcn_address_in_network_address_list(
  connection.source.address,
  connection.paResource.vcnOcid,
  ['ocid1.webappfirewallnetworkaddresslist...a']
)

{
  "connection": {
    "source": {
      "address": "10.0.0.1"
    }
  },
  "paResource": {
    "vcnOcid": "ocid1.vcn...a"
  }
}