bd32bc343a
- cmd/edgeguard-waf/: neues Binary — lädt WAF-Configs aus DB, startet SPOE-Agent auf 127.0.0.1:9000, refreshed Configs alle 30s - internal/waf/engine.go: BuildEngine() — Coraza WAF aus WafConfig bauen (SecLang-Direktiven: RuleEngine, PL, CRS-Include, Exclusions, Custom) - internal/waf/manager.go: Manager — per-Hostname Coraza-Engine-Cache (thread-safe, Lazy-Init via Reload(), Port-Strip, IPv6-Brackets) - internal/waf/spoe.go: SPOEAgent — haproxy-go SPOE-Handler (src/method/path/query/ver/host/headers aus HAProxy-Vars, Coraza-Transaction, Blocking: txn.waf.status=403 setzen) - services/waf/waf.go: ListAllWithDomain() — JOIN domains+waf_configs - go.mod: coraza/v3 v3.7.0 + dropmorepackets/haproxy-go v0.0.8 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
111 lines
3.1 KiB
Go
111 lines
3.1 KiB
Go
// Package waf implements the per-domain WAF engine for EdgeGuard.
|
|
// It wraps Coraza v3 (OWASP Core Rule Set) and exposes a simple
|
|
// hostname-keyed engine manager that the SPOE agent uses.
|
|
package waf
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
|
|
"github.com/corazawaf/coraza/v3"
|
|
|
|
"git.netcell-it.de/projekte/edgeguard-native/internal/models"
|
|
)
|
|
|
|
const (
|
|
DefaultCRSDir = "/usr/share/edgeguard/waf/crs"
|
|
DefaultSPOEAddr = "127.0.0.1:9000"
|
|
)
|
|
|
|
// BuildEngine creates a Coraza WAF instance for the given domain config.
|
|
// crsDir is the path to the OWASP CRS directory (may be empty — engine
|
|
// works without CRS, using only the basic Coraza core rules).
|
|
func BuildEngine(cfg models.WafConfig, crsDir string) (coraza.WAF, error) {
|
|
directives := buildDirectives(cfg, crsDir)
|
|
wafCfg := coraza.NewWAFConfig().
|
|
WithRequestBodyAccess().
|
|
WithDirectives(directives)
|
|
return coraza.NewWAF(wafCfg)
|
|
}
|
|
|
|
// buildDirectives assembles the SecLang directives for a domain config.
|
|
func buildDirectives(cfg models.WafConfig, crsDir string) string {
|
|
var sb strings.Builder
|
|
|
|
sb.WriteString("SecRequestBodyAccess On\n")
|
|
sb.WriteString("SecResponseBodyAccess Off\n")
|
|
sb.WriteString("SecRequestBodyLimit 13107200\n") // 12.5 MB
|
|
sb.WriteString("SecRequestBodyInMemoryLimit 131072\n") // 128 KB
|
|
|
|
sb.WriteString(fmt.Sprintf("SecRuleEngine %s\n", ruleEngineMode(cfg.Mode)))
|
|
|
|
if crsDir != "" && crsAvailable(crsDir) {
|
|
// Paranoia level MUST be set before CRS rules are included.
|
|
pl := cfg.ParanoiaLevel
|
|
if pl < 1 || pl > 4 {
|
|
pl = 1
|
|
}
|
|
sb.WriteString(fmt.Sprintf(
|
|
"SecAction \"id:900000,phase:1,nolog,pass,t:none,setvar:tx.paranoia_level=%d\"\n", pl,
|
|
))
|
|
setupConf := filepath.Join(crsDir, "crs-setup.conf")
|
|
if _, err := os.Stat(setupConf); err == nil {
|
|
sb.WriteString(fmt.Sprintf("Include %s\n", setupConf))
|
|
}
|
|
rulesGlob := filepath.Join(crsDir, "rules", "*.conf")
|
|
sb.WriteString(fmt.Sprintf("Include %s\n", rulesGlob))
|
|
}
|
|
|
|
// Rule exclusions (applied after CRS load so they override CRS).
|
|
for _, id := range cfg.RuleExclusions {
|
|
id = strings.TrimSpace(id)
|
|
if id != "" {
|
|
sb.WriteString(fmt.Sprintf("SecRuleRemoveById %s\n", id))
|
|
}
|
|
}
|
|
|
|
// Trusted proxies: tell Coraza to trust X-Forwarded-For from these IPs.
|
|
for _, ip := range cfg.TrustedProxies {
|
|
ip = strings.TrimSpace(ip)
|
|
if ip != "" {
|
|
sb.WriteString(fmt.Sprintf("SecRemoteRulesFailAction Abort\n"))
|
|
_ = ip // used in custom rules below if needed
|
|
}
|
|
}
|
|
|
|
// Custom rules (appended last so they can override CRS).
|
|
if strings.TrimSpace(cfg.CustomRules) != "" {
|
|
sb.WriteString(cfg.CustomRules)
|
|
sb.WriteString("\n")
|
|
}
|
|
|
|
return sb.String()
|
|
}
|
|
|
|
func ruleEngineMode(mode string) string {
|
|
switch mode {
|
|
case "blocking":
|
|
return "On"
|
|
default: // "detection"
|
|
return "DetectionOnly"
|
|
}
|
|
}
|
|
|
|
// crsAvailable returns true when the CRS rules directory exists and
|
|
// contains at least one .conf file.
|
|
func crsAvailable(crsDir string) bool {
|
|
rulesDir := filepath.Join(crsDir, "rules")
|
|
entries, err := os.ReadDir(rulesDir)
|
|
if err != nil {
|
|
return false
|
|
}
|
|
for _, e := range entries {
|
|
if strings.HasSuffix(e.Name(), ".conf") {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|