02096c8ad8
Erster Schritt des golangci-lint-Rollouts (non-blocking): 44 misspell + 4 staticcheck automatisch behoben (32 Dateien, nur Tippfehler/mechanisch). build+test grün. Kein Runtime-Change → kein Deploy. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
105 lines
3.0 KiB
Go
105 lines
3.0 KiB
Go
// Package waf implements the per-domain WAF engine for EdgeGuard.
|
|
// It wraps Coraza v3 (OWASP Core Rule Set) and exposes a simple
|
|
// hostname-keyed engine manager that the SPOE agent uses.
|
|
package waf
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
|
|
"github.com/corazawaf/coraza/v3"
|
|
|
|
"git.netcell-it.de/projekte/edgeguard-native/internal/models"
|
|
)
|
|
|
|
const (
|
|
DefaultCRSDir = "/usr/share/edgeguard/waf/crs"
|
|
DefaultSPOEAddr = "127.0.0.1:9000"
|
|
)
|
|
|
|
// BuildEngine creates a Coraza WAF instance for the given domain config.
|
|
// crsDir is the path to the OWASP CRS directory (may be empty — engine
|
|
// works without CRS, using only the basic Coraza core rules).
|
|
func BuildEngine(cfg models.WafConfig, crsDir string) (coraza.WAF, error) {
|
|
directives := buildDirectives(cfg, crsDir)
|
|
wafCfg := coraza.NewWAFConfig().
|
|
WithRequestBodyAccess().
|
|
WithDirectives(directives)
|
|
return coraza.NewWAF(wafCfg)
|
|
}
|
|
|
|
// buildDirectives assembles the SecLang directives for a domain config.
|
|
func buildDirectives(cfg models.WafConfig, crsDir string) string {
|
|
var sb strings.Builder
|
|
|
|
sb.WriteString("SecRequestBodyAccess On\n")
|
|
sb.WriteString("SecResponseBodyAccess Off\n")
|
|
sb.WriteString("SecRequestBodyLimit 13107200\n") // 12.5 MB
|
|
sb.WriteString("SecRequestBodyInMemoryLimit 131072\n") // 128 KB
|
|
|
|
fmt.Fprintf(&sb, "SecRuleEngine %s\n", ruleEngineMode(cfg.Mode))
|
|
|
|
if crsDir != "" && crsAvailable(crsDir) {
|
|
// Paranoia level MUST be set before CRS rules are included.
|
|
pl := cfg.ParanoiaLevel
|
|
if pl < 1 || pl > 4 {
|
|
pl = 1
|
|
}
|
|
fmt.Fprintf(&sb, "SecAction \"id:900000,phase:1,nolog,pass,t:none,setvar:tx.paranoia_level=%d\"\n", pl)
|
|
setupConf := filepath.Join(crsDir, "crs-setup.conf")
|
|
if _, err := os.Stat(setupConf); err == nil {
|
|
fmt.Fprintf(&sb, "Include %s\n", setupConf)
|
|
}
|
|
rulesGlob := filepath.Join(crsDir, "rules", "*.conf")
|
|
fmt.Fprintf(&sb, "Include %s\n", rulesGlob)
|
|
}
|
|
|
|
// Rule exclusions (applied after CRS load so they override CRS).
|
|
for _, id := range cfg.RuleExclusions {
|
|
id = strings.TrimSpace(id)
|
|
if id != "" {
|
|
fmt.Fprintf(&sb, "SecRuleRemoveById %s\n", id)
|
|
}
|
|
}
|
|
|
|
// Trusted proxies are NOT a SecLang directive — they are applied in the
|
|
// SPOE agent (spoe.go): when the connection source is a trusted proxy,
|
|
// the real client IP is taken from X-Forwarded-For before Coraza sees
|
|
// it. (Previously this loop emitted a bogus, unrelated directive.)
|
|
|
|
// Custom rules (appended last so they can override CRS).
|
|
if strings.TrimSpace(cfg.CustomRules) != "" {
|
|
sb.WriteString(cfg.CustomRules)
|
|
sb.WriteString("\n")
|
|
}
|
|
|
|
return sb.String()
|
|
}
|
|
|
|
func ruleEngineMode(mode string) string {
|
|
switch mode {
|
|
case "blocking":
|
|
return "On"
|
|
default: // "detection"
|
|
return "DetectionOnly"
|
|
}
|
|
}
|
|
|
|
// crsAvailable returns true when the CRS rules directory exists and
|
|
// contains at least one .conf file.
|
|
func crsAvailable(crsDir string) bool {
|
|
rulesDir := filepath.Join(crsDir, "rules")
|
|
entries, err := os.ReadDir(rulesDir)
|
|
if err != nil {
|
|
return false
|
|
}
|
|
for _, e := range entries {
|
|
if strings.HasSuffix(e.Name(), ".conf") {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|