Debian
|
bf16ce6666
|
feat(waf): Phase 3 — HAProxy SPOE-Integration — v1.2.68
- haproxy.cfg.tpl: filter spoe + deny_status 403 + spoe-edgeguard-waf
Backend (nur gerendert wenn WAFEnabled=true)
- haproxy.go: WAFEnabled in View; WafRepo.ListEnabled() prüft ob WAF
aktiv; SPOE-Config-File (coraza-spoe.cfg) wird bei WAFEnabled
atomar geschrieben; SPOEConfigPath konfigurierbar
- waf/spoe.go: uri statt path+query (HAProxy url-Sample = volle URI)
SPOE-Config definiert:
- Agent: edgeguard-waf-agent, var-prefix=waf, timeout processing 50ms
- Message: src, method, uri=url, ver=req.ver, headers=req.hdrs,
host=req.hdr(host)
- Backend: spoe-edgeguard-waf → 127.0.0.1:9000
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-06-02 15:53:07 +02:00 |
|
Debian
|
bd32bc343a
|
feat(waf): Phase 2 — edgeguard-waf Binary + SPOE + Coraza Engine — v1.2.67
- cmd/edgeguard-waf/: neues Binary — lädt WAF-Configs aus DB, startet
SPOE-Agent auf 127.0.0.1:9000, refreshed Configs alle 30s
- internal/waf/engine.go: BuildEngine() — Coraza WAF aus WafConfig bauen
(SecLang-Direktiven: RuleEngine, PL, CRS-Include, Exclusions, Custom)
- internal/waf/manager.go: Manager — per-Hostname Coraza-Engine-Cache
(thread-safe, Lazy-Init via Reload(), Port-Strip, IPv6-Brackets)
- internal/waf/spoe.go: SPOEAgent — haproxy-go SPOE-Handler
(src/method/path/query/ver/host/headers aus HAProxy-Vars,
Coraza-Transaction, Blocking: txn.waf.status=403 setzen)
- services/waf/waf.go: ListAllWithDomain() — JOIN domains+waf_configs
- go.mod: coraza/v3 v3.7.0 + dropmorepackets/haproxy-go v0.0.8
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
2026-06-02 15:43:15 +02:00 |
|