053b38e46c
#15 waf/alerts.go: AlertWriter.Close() flusht gepufferte Alerts + stoppt die Goroutine (stop/done-Channels, sync.Once, atomic closed; Kanal wird NIE geschlossen → Send racet ohne Panic). Wiring in cmd/edgeguard-waf nach ListenAndServe (graceful shutdown). -race-Test alerts_test.go. #19 handlers/cluster_rollingupdate.go: (a) RollingUpdateStatus mutiert State nicht mehr beim GET — terminale Zustände altern in readRollingUpdateState nach 10 min aus (kein verlorenes 'done' bei parallelen Pollern). (b) State-File via sync.Mutex + configgen.AtomicWrite (kein partieller Read / Race zwischen Handler & Goroutine). (c) Version-Flip wird gegen die VORHER erfasste Secondary-Baseline geprüft statt gegen die Primary-Version (verhindert sofort-/nie-Flip). Bewusst belassen: geteilter upgrade.sh-Pfad ist deterministischer Inhalt + an exakte sudoers-Zeile gebunden → Überschreib-Race benign; MST-Timestamp-Parse locale (Server laufen C-Locale). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
108 lines
2.7 KiB
Go
108 lines
2.7 KiB
Go
// Command edgeguard-waf is the per-domain WAF SPOE agent for EdgeGuard.
|
|
// HAProxy connects to it via the SPOE protocol (127.0.0.1:9000).
|
|
// It loads per-domain WAF configs from PostgreSQL and uses Coraza v3
|
|
// with the OWASP Core Rule Set to inspect HTTP requests.
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"log/slog"
|
|
"os"
|
|
"os/signal"
|
|
"syscall"
|
|
"time"
|
|
|
|
"git.netcell-it.de/projekte/edgeguard-native/internal/database"
|
|
"git.netcell-it.de/projekte/edgeguard-native/internal/models"
|
|
"git.netcell-it.de/projekte/edgeguard-native/internal/services/waf"
|
|
intwaf "git.netcell-it.de/projekte/edgeguard-native/internal/waf"
|
|
)
|
|
|
|
func main() {
|
|
ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
|
|
defer stop()
|
|
|
|
dsn := database.ConnStringFromEnv()
|
|
pool, err := database.Open(ctx, dsn)
|
|
if err != nil {
|
|
slog.Error("waf: db connect", "error", err)
|
|
os.Exit(1)
|
|
}
|
|
defer pool.Close()
|
|
|
|
if err := database.Migrate(ctx, ""); err != nil {
|
|
slog.Error("waf: migrate", "error", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
repo := waf.New(pool)
|
|
|
|
crsDir := os.Getenv("EDGEGUARD_WAF_CRS_DIR")
|
|
if crsDir == "" {
|
|
crsDir = intwaf.DefaultCRSDir
|
|
}
|
|
spoeAddr := os.Getenv("EDGEGUARD_WAF_ADDR")
|
|
if spoeAddr == "" {
|
|
spoeAddr = intwaf.DefaultSPOEAddr
|
|
}
|
|
|
|
mgr := intwaf.NewManager(crsDir)
|
|
|
|
// Initial load.
|
|
if err := reload(ctx, repo, mgr); err != nil {
|
|
slog.Error("waf: initial load", "error", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
// Periodic config refresh every 30 seconds.
|
|
go func() {
|
|
t := time.NewTicker(30 * time.Second)
|
|
defer t.Stop()
|
|
for {
|
|
select {
|
|
case <-ctx.Done():
|
|
return
|
|
case <-t.C:
|
|
if err := reload(ctx, repo, mgr); err != nil {
|
|
slog.Warn("waf: reload", "error", err)
|
|
}
|
|
}
|
|
}
|
|
}()
|
|
|
|
alertWriter := intwaf.NewAlertWriter(pool, 2048)
|
|
|
|
agent := intwaf.SPOEAgent{
|
|
Manager: mgr,
|
|
AlertWriter: alertWriter,
|
|
Addr: spoeAddr,
|
|
}
|
|
|
|
slog.Info("waf: SPOE agent starting", "addr", spoeAddr, "crs", crsDir)
|
|
if err := agent.ListenAndServe(ctx); err != nil && ctx.Err() == nil {
|
|
slog.Error("waf: SPOE agent stopped", "error", err)
|
|
os.Exit(1)
|
|
}
|
|
// Graceful shutdown (ctx cancelled): gepufferte Alerts flushen.
|
|
alertWriter.Close()
|
|
}
|
|
|
|
// reload fetches all domain+waf_config pairs from DB and rebuilds engines.
|
|
func reload(ctx context.Context, repo *waf.Repo, mgr *intwaf.Manager) error {
|
|
configs, err := repo.ListAllWithDomain(ctx)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
domains := make([]intwaf.DomainConfig, 0, len(configs))
|
|
for _, c := range configs {
|
|
domains = append(domains, intwaf.DomainConfig{
|
|
Hostname: c.Hostname,
|
|
Config: c.Config,
|
|
})
|
|
}
|
|
return mgr.Reload(domains)
|
|
}
|
|
|
|
// Ensure models package is used (imported transitively via services/waf).
|
|
var _ = models.WafConfig{}
|