projekte/edgeguard-native
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(waf): HAProxy-Reload nach WAF-Config + cfg-file → config — v1.2.72

Browse Source 
- handlers/waf.go: Reloader-Func; nach Upsert wird HAProxy async
  neu gerendert (SPOE-Filter erscheint/verschwindet je nach enabled-Stand)
- main.go: haproxyReloader an NewWafHandler übergeben
- haproxy.cfg.tpl: cfg-file → config (HAProxy 3.0 kennt cfg-file nicht)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Debian
2026-06-02 22:10:55 +02:00
parent 4d81d31022
commit 05ac3344fa
4 changed files with 20 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
VERSION
View File

@@ -1 +1 @@
1.2.71 1.2.72

2
cmd/edgeguard-api/main.go
View File

@@ -384,7 +384,7 @@ func main() {
} }
handlers.NewFirewallHandler(fwZones, fwAddrObj, fwAddrGrp, fwSvc, fwSvcGrp, fwRules, fwNAT, auditRepo, nodeID, fwReloader, pool).Register(authed) handlers.NewFirewallHandler(fwZones, fwAddrObj, fwAddrGrp, fwSvc, fwSvcGrp, fwRules, fwNAT, auditRepo, nodeID, fwReloader, pool).Register(authed)
handlers.NewCrowdSecHandler(auditRepo, nodeID).Register(authed) handlers.NewCrowdSecHandler(auditRepo, nodeID).Register(authed)
handlers.NewWafHandler(wafsvc.New(pool), auditRepo, nodeID).Register(authed) handlers.NewWafHandler(wafsvc.New(pool), auditRepo, nodeID, haproxyReloader).Register(authed)
// withFW wraps a service-reloader so that AFTER the service is // withFW wraps a service-reloader so that AFTER the service is
// reloaded, the firewall is also re-rendered. Necessary for // reloaded, the firewall is also re-rendered. Necessary for

16
internal/handlers/waf.go
View File

@@ -1,7 +1,9 @@
package handlers package handlers
import ( import (
"context"
"errors" "errors"
"log/slog"
"net/http" "net/http"
"strconv" "strconv"
@@ -22,10 +24,11 @@ type WafHandler struct {
Repo *wafsvc.Repo Repo *wafsvc.Repo
Audit *audit.Repo Audit *audit.Repo
NodeID string NodeID string
Reloader func(ctx context.Context) error
} }
func NewWafHandler(repo *wafsvc.Repo, a *audit.Repo, nodeID string) *WafHandler { func NewWafHandler(repo *wafsvc.Repo, a *audit.Repo, nodeID string, reloader func(context.Context) error) *WafHandler {
return &WafHandler{Repo: repo, Audit: a, NodeID: nodeID} return &WafHandler{Repo: repo, Audit: a, NodeID: nodeID, Reloader: reloader}
} }
func (h *WafHandler) Register(rg *gin.RouterGroup) { func (h *WafHandler) Register(rg *gin.RouterGroup) {
@@ -119,6 +122,15 @@ func (h *WafHandler) Upsert(c *gin.Context) {
strconv.FormatInt(domainID, 10), strconv.FormatInt(domainID, 10),
gin.H{"enabled": body.Enabled, "mode": body.Mode, "paranoia_level": body.ParanoiaLevel}, gin.H{"enabled": body.Enabled, "mode": body.Mode, "paranoia_level": body.ParanoiaLevel},
h.NodeID) h.NodeID)
// Reload HAProxy so the SPOE filter is added/removed based on
// whether any domain now has WAF enabled.
if h.Reloader != nil {
go func() {
if err := h.Reloader(context.Background()); err != nil {
slog.Warn("waf: haproxy reload after config change failed", "error", err)
}
}()
}
c.JSON(http.StatusOK, gin.H{"config": result}) c.JSON(http.StatusOK, gin.H{"config": result})
} }

2
internal/haproxy/haproxy.cfg.tpl
View File

@@ -83,7 +83,7 @@ frontend public_https
{{- if .WAFEnabled}} {{- if .WAFEnabled}}
# WAF: SPOE-Filter — edgeguard-waf inspiziert jeden Request. # WAF: SPOE-Filter — edgeguard-waf inspiziert jeden Request.
# filter muss vor allen http-request/http-response-Direktiven stehen. # filter muss vor allen http-request/http-response-Direktiven stehen.
filter spoe engine edgeguard-waf cfg-file /etc/edgeguard/haproxy/coraza-spoe.cfg filter spoe engine edgeguard-waf config /etc/edgeguard/haproxy/coraza-spoe.cfg
{{- end}} {{- end}}
# Alt-Svc: signalisiert dass h3 auf demselben Port verfügbar ist. # Alt-Svc: signalisiert dass h3 auf demselben Port verfügbar ist.