caddy_waf_t1k

README

About this repo

This is a WAF plugin for Caddy Server using Chaitin SafeLine as backend engine.

How to use

(waf) {
	route {
		waf_chaitin {
			waf_engine_addr 169.254.0.5:8000
			pool_size 10
			timeout 1000
		}
	}
}

:8000 {
	import waf
	respond / "Hello, world!"
}

How to build

xcaddy build --with github.com/W0n9/caddy_waf_t1k

TODO

• Detection and Interception
• Pass the remote_addr to the Engine
• Multi backend engine instances support, include Load Balance and High Availability

Documentation

Index

• type CaddyWAF
  • func (CaddyWAF) CaddyModule() caddy.ModuleInfo
  • func (m CaddyWAF) Cleanup() error
  • func (m *CaddyWAF) Provision(ctx caddy.Context) error
  • func (m CaddyWAF) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyhttp.Handler) error
  • func (m *CaddyWAF) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

Types

type CaddyWAF

type CaddyWAF struct {
	WafEngineAddr string `json:"waf_engine_addr,omitempty"` // WAF Engine address, expects a URL or IP address

	InitialCap  int           `json:"initial_cap,omitempty"`  // InitialCap is the initial capacity of the pool
	MaxIdle     int           `json:"max_idle,omitempty"`     // MaxIdle is the maximum number of idle connections in the pool
	MaxCap      int           `json:"max_cap,omitempty"`      // MaxCap is the maximum capacity of the pool
	IdleTimeout time.Duration `json:"idle_timeout,omitempty"` // IdleTimeout is the duration after which an idle connection is closed
	// contains filtered or unexported fields
}

CaddyWAF implements an HTTP handler for WAF.

func (CaddyWAF) CaddyModule

func (CaddyWAF) CaddyModule() caddy.ModuleInfo

CaddyModule returns the Caddy module information.

func (CaddyWAF) Cleanup

func (m CaddyWAF) Cleanup() error

Cleans up the WAF plugin instance by closing the WAF engine and logging the cleanup process.

func (*CaddyWAF) Provision

func (m *CaddyWAF) Provision(ctx caddy.Context) error

Provision sets up the WAF module.

func (CaddyWAF) ServeHTTP

func (m CaddyWAF) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyhttp.Handler) error

ServeHTTP processes incoming HTTP requests by utilizing the Caddy WAF engine to detect potential threats. If a request is identified as malicious, it redirects the request to an intercept handler. Otherwise, it passes the request to the next handler in the chain. The method handles detection errors and enforces a timeout for the detection process, logging relevant information in each case.

func (*CaddyWAF) UnmarshalCaddyfile

func (m *CaddyWAF) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

UnmarshalCaddyfile implements caddyfile.Unmarshaler.