caddy_waf_t1k

README

About this repo

This is a WAF plugin for Caddy Server using Chaitin SafeLine as backend engine.

How to use

(waf) {
	route {
		waf_chaitin {
			waf_engine_addr 169.254.0.5:8000
			pool_size 10
			timeout 1000
		}
	}
}

:8000 {
	import waf
	respond / "Hello, world!"
}

How to build

xcaddy build --with github.com/W0n9/caddy_waf_t1k

TODO

• Detection and Interception
• Pass the remote_addr to the Engine
• Multi backend engine instances support, include Load Balance and High Availability

Documentation

Index

• type CaddyWAF
  • func (CaddyWAF) CaddyModule() caddy.ModuleInfo
  • func (m CaddyWAF) Cleanup() error
  • func (m *CaddyWAF) Provision(ctx caddy.Context) error
  • func (m CaddyWAF) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyhttp.Handler) error
  • func (m *CaddyWAF) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

Types

type CaddyWAF

type CaddyWAF struct {
	WafEngineAddr string `json:"waf_engine_addr,omitempty"` // WAF Engine address, expects a URL or IP address

	PoolSize int           `json:"pool_size,omitempty"` // Pool size determines the number of concurrent connections the WAF engine can handle
	Timeout  time.Duration `json:"timeout,omitempty"`   // Timeout for WAF detection to process an HTTP request
	// contains filtered or unexported fields
}

CaddyWAF implements an HTTP handler for WAF.

func (CaddyWAF) CaddyModule

func (CaddyWAF) CaddyModule() caddy.ModuleInfo

CaddyModule returns the Caddy module information.

func (CaddyWAF) Cleanup

func (m CaddyWAF) Cleanup() error

Cleans up the WAF plugin instance by closing the WAF engine and logging the cleanup process.

func (*CaddyWAF) Provision

func (m *CaddyWAF) Provision(ctx caddy.Context) error

Provision sets up the WAF module.

func (CaddyWAF) ServeHTTP

func (m CaddyWAF) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyhttp.Handler) error

ServeHTTP processes incoming HTTP requests by utilizing the Caddy WAF engine to detect potential threats. If a request is identified as malicious, it redirects the request to an intercept handler. Otherwise, it passes the request to the next handler in the chain. The method handles detection errors and enforces a timeout for the detection process, logging relevant information in each case.

func (*CaddyWAF) UnmarshalCaddyfile

func (m *CaddyWAF) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

UnmarshalCaddyfile implements caddyfile.Unmarshaler.