edgeguard-native/internal/waf/engine.go

// Package waf implements the per-domain WAF engine for EdgeGuard.
// It wraps Coraza v3 (OWASP Core Rule Set) and exposes a simple
// hostname-keyed engine manager that the SPOE agent uses.
package waf

import (
	"fmt"
	"os"
	"path/filepath"
	"strings"

	"github.com/corazawaf/coraza/v3"

	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
)

const (
	DefaultCRSDir   = "/usr/share/edgeguard/waf/crs"
	DefaultSPOEAddr = "127.0.0.1:9000"
)

// BuildEngine creates a Coraza WAF instance for the given domain config.
// crsDir is the path to the OWASP CRS directory (may be empty — engine
// works without CRS, using only the basic Coraza core rules).
func BuildEngine(cfg models.WafConfig, crsDir string) (coraza.WAF, error) {
	directives := buildDirectives(cfg, crsDir)
	wafCfg := coraza.NewWAFConfig().
		WithRequestBodyAccess().
		WithDirectives(directives)
	return coraza.NewWAF(wafCfg)
}

// buildDirectives assembles the SecLang directives for a domain config.
func buildDirectives(cfg models.WafConfig, crsDir string) string {
	var sb strings.Builder

	sb.WriteString("SecRequestBodyAccess On\n")
	sb.WriteString("SecResponseBodyAccess Off\n")
	sb.WriteString("SecRequestBodyLimit 13107200\n")   // 12.5 MB
	sb.WriteString("SecRequestBodyInMemoryLimit 131072\n") // 128 KB

	sb.WriteString(fmt.Sprintf("SecRuleEngine %s\n", ruleEngineMode(cfg.Mode)))

	if crsDir != "" && crsAvailable(crsDir) {
		// Paranoia level MUST be set before CRS rules are included.
		pl := cfg.ParanoiaLevel
		if pl < 1 || pl > 4 {
			pl = 1
		}
		sb.WriteString(fmt.Sprintf(
			"SecAction \"id:900000,phase:1,nolog,pass,t:none,setvar:tx.paranoia_level=%d\"\n", pl,
		))
		setupConf := filepath.Join(crsDir, "crs-setup.conf")
		if _, err := os.Stat(setupConf); err == nil {
			sb.WriteString(fmt.Sprintf("Include %s\n", setupConf))
		}
		rulesGlob := filepath.Join(crsDir, "rules", "*.conf")
		sb.WriteString(fmt.Sprintf("Include %s\n", rulesGlob))
	}

	// Rule exclusions (applied after CRS load so they override CRS).
	for _, id := range cfg.RuleExclusions {
		id = strings.TrimSpace(id)
		if id != "" {
			sb.WriteString(fmt.Sprintf("SecRuleRemoveById %s\n", id))
		}
	}

	// Trusted proxies are NOT a SecLang directive — they are applied in the
	// SPOE agent (spoe.go): when the connection source is a trusted proxy,
	// the real client IP is taken from X-Forwarded-For before Coraza sees
	// it. (Previously this loop emitted a bogus, unrelated directive.)

	// Custom rules (appended last so they can override CRS).
	if strings.TrimSpace(cfg.CustomRules) != "" {
		sb.WriteString(cfg.CustomRules)
		sb.WriteString("\n")
	}

	return sb.String()
}

func ruleEngineMode(mode string) string {
	switch mode {
	case "blocking":
		return "On"
	default: // "detection"
		return "DetectionOnly"
	}
}

// crsAvailable returns true when the CRS rules directory exists and
// contains at least one .conf file.
func crsAvailable(crsDir string) bool {
	rulesDir := filepath.Join(crsDir, "rules")
	entries, err := os.ReadDir(rulesDir)
	if err != nil {
		return false
	}
	for _, e := range entries {
		if strings.HasSuffix(e.Name(), ".conf") {
			return true
		}
	}
	return false
}