diff --git a/src/extensions/nginx-app-protect/monitoring/processor/nap.go b/src/extensions/nginx-app-protect/monitoring/processor/nap.go index 6397f3a80f..e810866964 100644 --- a/src/extensions/nginx-app-protect/monitoring/processor/nap.go +++ b/src/extensions/nginx-app-protect/monitoring/processor/nap.go @@ -30,6 +30,10 @@ const ( cookieCtx = "cookie" defaultBlockedRespCode = "0" defaultBlockedRespValue = "Blocked" + + spaceCharacter = ' ' + paramsSeparator = '?' + uriStartCharacter = '/' ) // NGINX App Protect Logging Directives @@ -104,6 +108,7 @@ var ( clientApplicationVersion, transportProtocol, httpURI, + request, } ) @@ -450,11 +455,6 @@ func parseNAP(logEntry string, logger *logrus.Entry) (*NAPConfig, error) { } } - err := setValue(&waf, request, strings.Join(values[len(logFormatKeys):], ","), logger) - if err != nil { - return &NAPConfig{}, err - } - return &waf, nil } @@ -506,13 +506,13 @@ func setValue(napConfig *NAPConfig, key, value string, logger *logrus.Entry) err case httpServerPort: napConfig.HTTPServerPort = value case httpURI: - napConfig.HTTPURI = value + napConfig.HTTPURI = strings.ReplaceAll(value, "%2C", ",") case isTruncated: napConfig.IsTruncated = value case policyName: napConfig.PolicyName = value case request: - napConfig.Request = value + napConfig.Request = strings.ReplaceAll(value, "%2C", ",") case requestOutcome: napConfig.RequestOutcome = value case requestOutcomeReason: diff --git a/src/plugins/nap_monitoring.go b/src/plugins/nap_monitoring.go index fdead45ee6..d09a338580 100644 --- a/src/plugins/nap_monitoring.go +++ b/src/plugins/nap_monitoring.go @@ -55,7 +55,7 @@ func NewNAPMonitoring(env core.Environment, cfg *config.Config) (*NAPMonitoring, log.Warnf("NAP Monitoring report count must be between %v and %v. Defaulting to %v", minReportCountDelimiter, maxReportCountDelimiter, - config.Defaults.NAPMonitoring.ReportInterval) + config.Defaults.NAPMonitoring.ReportCount) cfg.NAPMonitoring.ReportCount = config.Defaults.NAPMonitoring.ReportCount }