feat(fastly_waf): remove invalid underscores in two waf headers (#446)

Author: Tibap

google_fastly_waf/logging/bq_format.txt

@@ -1 +1 @@
-{ "timestamp":"%{strftime(\{"%Y-%m-%dT%H:%M:%S"\}, time.start)}V", "url":"%{json.escape(req.url)}V", "request_method":"%{json.escape(req.method)}V", "request_protocol":"%{json.escape(req.proto)}V", "request_referer":"%{json.escape(req.http.referer)}V", "request_user_agent":"%{json.escape(req.http.User-Agent)}V", "response_state":"%{json.escape(fastly_info.state)}V", "response_status":%{resp.status}V, "response_reason":%{if(resp.response, "%22"+json.escape(resp.response)+"%22", "null")}V, "waf_executed": %{if(waf.executed, "true", "false")}V, "ngwaf_agentresponse": "%{if(fastly.ff.visits_this_service == 0, req.http.x-sigsci-agentresponse, resp.http.x-sigsci-agentresponse)}V", "ngwaf_decision_ms": "%{if(fastly.ff.visits_this_service == 0, req.http.x-sigsci-decision-ms, resp.http.x-sigsci-decision-ms)}V", "ngwaf_signals": "%{if(fastly.ff.visits_this_service == 0, req.http.x-sigsci-tags, resp.http.x-sigsci-tags)}V", "response_bytes_written": "%{resp.bytes_written}V", "ja3": "%{tls.client.ja3_md5}V", "ja4": "%{tls.client.ja4}V", "request_client_ip": "%{req.http.Fastly-Client-IP}V", "h2fp":"%{json.escape(req.http.h2fp)}V", "asn":"%{json.escape(req.http.asn)}V", "proxy_desc":"%{json.escape(req.http.proxy_desc)}V", "proxy_type":"%{json.escape(req.http.proxy_type)}V", "ohfp":"%{json.escape(req.http.ohfp)}V", "fastly_request_id":"%{json.escape(req.http.x-fastly-ngwaf:requestid)}V" }
+{ "timestamp":"%{strftime(\{"%Y-%m-%dT%H:%M:%S"\}, time.start)}V", "url":"%{json.escape(req.url)}V", "request_method":"%{json.escape(req.method)}V", "request_protocol":"%{json.escape(req.proto)}V", "request_referer":"%{json.escape(req.http.referer)}V", "request_user_agent":"%{json.escape(req.http.User-Agent)}V", "response_state":"%{json.escape(fastly_info.state)}V", "response_status":%{resp.status}V, "response_reason":%{if(resp.response, "%22"+json.escape(resp.response)+"%22", "null")}V, "waf_executed": %{if(waf.executed, "true", "false")}V, "ngwaf_agentresponse": "%{if(fastly.ff.visits_this_service == 0, req.http.x-sigsci-agentresponse, resp.http.x-sigsci-agentresponse)}V", "ngwaf_decision_ms": "%{if(fastly.ff.visits_this_service == 0, req.http.x-sigsci-decision-ms, resp.http.x-sigsci-decision-ms)}V", "ngwaf_signals": "%{if(fastly.ff.visits_this_service == 0, req.http.x-sigsci-tags, resp.http.x-sigsci-tags)}V", "response_bytes_written": "%{resp.bytes_written}V", "ja3": "%{tls.client.ja3_md5}V", "ja4": "%{tls.client.ja4}V", "request_client_ip": "%{req.http.Fastly-Client-IP}V", "h2fp":"%{json.escape(req.http.h2fp)}V", "asn":"%{json.escape(req.http.asn)}V", "proxy_desc":"%{json.escape(req.http.proxy-desc)}V", "proxy_type":"%{json.escape(req.http.proxy-type)}V", "ohfp":"%{json.escape(req.http.ohfp)}V", "fastly_request_id":"%{json.escape(req.http.x-fastly-ngwaf:requestid)}V" }

google_fastly_waf/vcl/main.vcl.tftpl

@@ -21,8 +21,8 @@ if (fastly.ff.visits_this_service == 0 && req.restarts == 0) {
   set req.http.Client-JA3 = tls.client.ja3_md5;
   set req.http.Client-JA4 = tls.client.ja4;
   set req.http.asn = client.as.number;
-  set req.http.proxy_type = client.geo.proxy_type;
-  set req.http.proxy_desc = client.geo.proxy_description;
+  set req.http.proxy-type = client.geo.proxy_type;
+  set req.http.proxy-desc = client.geo.proxy_description;
   set req.http.X-Sigsci-Response-Headers = "true";
   set req.http.h2fp = fastly_info.h2.fingerprint;
   set req.http.ohfp = fastly_info.oh_fingerprint;