edgeguard-native/internal/waf/engine.go

// Package waf implements the per-domain WAF engine for EdgeGuard.
// It wraps Coraza v3 (OWASP Core Rule Set) and exposes a simple
// hostname-keyed engine manager that the SPOE agent uses.
package waf

import (
	"fmt"
	"os"
	"path/filepath"
	"strings"

	"github.com/corazawaf/coraza/v3"

	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
)

const (
	DefaultCRSDir   = "/usr/share/edgeguard/waf/crs"
	DefaultSPOEAddr = "127.0.0.1:9000"
)

// BuildEngine creates a Coraza WAF instance for the given domain config.
// crsDir is the path to the OWASP CRS directory (may be empty — engine
// works without CRS, using only the basic Coraza core rules).
func BuildEngine(cfg models.WafConfig, crsDir string) (coraza.WAF, error) {
	directives := buildDirectives(cfg, crsDir)
	wafCfg := coraza.NewWAFConfig().
		WithRequestBodyAccess().
		WithDirectives(directives)
	return coraza.NewWAF(wafCfg)
}

// buildDirectives assembles the SecLang directives for a domain config.
func buildDirectives(cfg models.WafConfig, crsDir string) string {
	var sb strings.Builder

	sb.WriteString("SecRequestBodyAccess On\n")
	sb.WriteString("SecResponseBodyAccess Off\n")
	sb.WriteString("SecRequestBodyLimit 13107200\n")       // 12.5 MB
	sb.WriteString("SecRequestBodyInMemoryLimit 131072\n") // 128 KB

	fmt.Fprintf(&sb, "SecRuleEngine %s\n", ruleEngineMode(cfg.Mode))

	if crsDir != "" && crsAvailable(crsDir) {
		// Paranoia level MUST be set before CRS rules are included.
		pl := cfg.ParanoiaLevel
		if pl < 1 || pl > 4 {
			pl = 1
		}
		fmt.Fprintf(&sb, "SecAction \"id:900000,phase:1,nolog,pass,t:none,setvar:tx.paranoia_level=%d\"\n", pl)
		includeIfExists(&sb, filepath.Join(crsDir, "crs-setup.conf"))

		// CRS-App-Exclusion-Plugins: config + before laufen VOR den CRS-Rules
		// (setzen Enable-Vars + pfad-scoped ctl:ruleRemoveById), after DANACH —
		// exakt nach OWASP-CRS-Plugin-Spec. Es werden NUR die für DIESE Domain
		// gewählten Plugins inkludiert (per-Domain, nicht global).
		plugins := resolveCRSPlugins(cfg.CRSPlugins)
		for _, prefix := range plugins {
			includeIfExists(&sb, filepath.Join(crsDir, "plugins", prefix+"-config.conf"))
			includeIfExists(&sb, filepath.Join(crsDir, "plugins", prefix+"-before.conf"))
		}
		// rules/*.conf ist ein Glob (kein Stat) — crsAvailable() hat oben bereits
		// bestätigt, dass mind. eine .conf existiert.
		fmt.Fprintf(&sb, "Include %s\n", filepath.Join(crsDir, "rules", "*.conf"))
		for _, prefix := range plugins {
			includeIfExists(&sb, filepath.Join(crsDir, "plugins", prefix+"-after.conf"))
		}
	}

	// Rule exclusions (applied after CRS load so they override CRS).
	for _, id := range cfg.RuleExclusions {
		id = strings.TrimSpace(id)
		if id != "" {
			fmt.Fprintf(&sb, "SecRuleRemoveById %s\n", id)
		}
	}

	// Trusted proxies are NOT a SecLang directive — they are applied in the
	// SPOE agent (spoe.go): when the connection source is a trusted proxy,
	// the real client IP is taken from X-Forwarded-For before Coraza sees
	// it. (Previously this loop emitted a bogus, unrelated directive.)

	// Custom rules (appended last so they can override CRS).
	if strings.TrimSpace(cfg.CustomRules) != "" {
		sb.WriteString(cfg.CustomRules)
		sb.WriteString("\n")
	}

	return sb.String()
}

// KnownCRSPlugins mappt den kurzen Plugin-Namen (gespeichert in
// waf_configs.crs_plugins, im UI gewählt) auf sein Datei-Prefix in
// <crsDir>/plugins/. Nur diese werden paketiert (postinst) und akzeptiert.
var KnownCRSPlugins = map[string]string{
	"nextcloud": "nextcloud-rule-exclusions",
	"wordpress": "wordpress-rule-exclusions",
	"drupal":    "drupal-rule-exclusions",
}

// resolveCRSPlugins mappt gewählte Plugin-Namen auf ihre Datei-Prefixe und
// filtert unbekannte/leere raus — defensiv, nie ungültige Includes rendern.
func resolveCRSPlugins(names []string) []string {
	out := make([]string, 0, len(names))
	for _, n := range names {
		if prefix, ok := KnownCRSPlugins[strings.TrimSpace(n)]; ok {
			out = append(out, prefix)
		}
	}
	return out
}

// includeIfExists rendert eine Include-Zeile nur, wenn die Datei existiert — so
// bricht ein gewähltes-aber-nicht-installiertes Plugin die Config nicht.
func includeIfExists(sb *strings.Builder, path string) {
	if _, err := os.Stat(path); err == nil {
		fmt.Fprintf(sb, "Include %s\n", path)
	}
}

func ruleEngineMode(mode string) string {
	switch mode {
	case "blocking":
		return "On"
	default: // "detection"
		return "DetectionOnly"
	}
}

// crsAvailable returns true when the CRS rules directory exists and
// contains at least one .conf file.
func crsAvailable(crsDir string) bool {
	rulesDir := filepath.Join(crsDir, "rules")
	entries, err := os.ReadDir(rulesDir)
	if err != nil {
		return false
	}
	for _, e := range entries {
		if strings.HasSuffix(e.Name(), ".conf") {
			return true
		}
	}
	return false
}