caddy_waf_t1k

README

About this repo

This is a WAF plugin for Caddy Server using Chaitin SafeLine as backend engine.

How to use

(waf) {
	route {
		waf_chaitin {
			waf_engine_addr 169.254.0.5:8000 169.254.0.6:8000 169.254.0.7:8000
			initial_cap 1 # initial connection of the engine
			max_idle 16 # max idle connections
			max_cap 32 # max connections
			idle_timeout 30 # connections idle timeout
		}
	}
}

:8000 {
	import waf
	respond / "Hello, world!"
}

How to build

xcaddy build --with github.com/W0n9/caddy_waf_t1k

TODO

• Detection and Interception
• Pass the remote_addr to the Engine
• Multi backend engine instances support, include Load Balance and High Availability

Documentation

Index

• type CaddyWAF
  • func (CaddyWAF) CaddyModule() caddy.ModuleInfo
  • func (m CaddyWAF) Cleanup() error
  • func (m *CaddyWAF) Provision(ctx caddy.Context) error
  • func (m CaddyWAF) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyhttp.Handler) error
  • func (m *CaddyWAF) UnmarshalCaddyfile(d *caddyfile.Dispenser) error
• type EnginePool
• type LoadBalancing
• type RandomSelection
  • func (RandomSelection) CaddyModule() caddy.ModuleInfo
  • func (r RandomSelection) Select(pool EnginePool, request *http.Request, _ http.ResponseWriter) *t1k.ChannelPool
  • func (r *RandomSelection) UnmarshalCaddyfile(d *caddyfile.Dispenser) error
• type RoundRobinSelection
  • func (RoundRobinSelection) CaddyModule() caddy.ModuleInfo
  • func (r *RoundRobinSelection) Select(pool EnginePool, _ *http.Request, _ http.ResponseWriter) *t1k.ChannelPool
  • func (r *RoundRobinSelection) UnmarshalCaddyfile(d *caddyfile.Dispenser) error
• type Selector

Types

type CaddyWAF

type CaddyWAF struct {
	WafEngineAddrs []string `json:"waf_engine_addrs,omitempty"` // WAF Engine address, expects a URL or IP address

	// Multiple WAF engine pools
	Engines EnginePool

	// Load balancing distributes load/requests between backends.
	LoadBalancing *LoadBalancing `json:"load_balancing,omitempty"`

	InitialCap  int           `json:"initial_cap,omitempty"`  // InitialCap is the initial capacity of the pool
	MaxIdle     int           `json:"max_idle,omitempty"`     // MaxIdle is the maximum number of idle connections in the pool
	MaxCap      int           `json:"max_cap,omitempty"`      // MaxCap is the maximum capacity of the pool
	IdleTimeout time.Duration `json:"idle_timeout,omitempty"` // IdleTimeout is the duration after which an idle connection is closed
	// contains filtered or unexported fields
}

CaddyWAF implements an HTTP handler for WAF.

func (CaddyWAF) CaddyModule

func (CaddyWAF) CaddyModule() caddy.ModuleInfo

CaddyModule returns the Caddy module information.

func (CaddyWAF) Cleanup

func (m CaddyWAF) Cleanup() error

Cleans up the WAF plugin instance by closing the WAF engine and logging the cleanup process.

func (*CaddyWAF) Provision

func (m *CaddyWAF) Provision(ctx caddy.Context) error

Provision sets up the WAF module.

func (CaddyWAF) ServeHTTP

func (m CaddyWAF) ServeHTTP(w http.ResponseWriter, r *http.Request, next caddyhttp.Handler) error

ServeHTTP processes incoming HTTP requests by utilizing the Caddy WAF engine to detect potential threats. If a request is identified as malicious, it redirects the request to an intercept handler. Otherwise, it passes the request to the next handler in the chain. The method handles detection errors and enforces a timeout for the detection process, logging relevant information in each case.

func (*CaddyWAF) UnmarshalCaddyfile

func (m *CaddyWAF) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

UnmarshalCaddyfile implements caddyfile.Unmarshaler.

type EnginePool

type EnginePool []*t1k.ChannelPool

type LoadBalancing

type LoadBalancing struct {
	// A selection policy is how to choose an available backend.
	// The default policy is random selection.
	SelectionPolicyRaw json.RawMessage `json:"selection_policy,omitempty" caddy:"namespace=http.waf_chaitin.selection_policies inline_key=policy"`

	SelectionPolicy Selector `json:"-"`
}

LoadBalancing has parameters related to load balancing.

type RandomSelection

type RandomSelection struct{}

RandomSelection is a policy that selects an available host at random.

func (RandomSelection) CaddyModule

func (RandomSelection) CaddyModule() caddy.ModuleInfo

CaddyModule returns the Caddy module information.

func (RandomSelection) Select

func (r RandomSelection) Select(pool EnginePool, request *http.Request, _ http.ResponseWriter) *t1k.ChannelPool

Select returns an available host, if any.

func (*RandomSelection) UnmarshalCaddyfile

func (r *RandomSelection) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

UnmarshalCaddyfile sets up the module from Caddyfile tokens.

type RoundRobinSelection

type RoundRobinSelection struct {
	// contains filtered or unexported fields
}

RoundRobinSelection is a policy that selects a host based on round-robin ordering.

func (RoundRobinSelection) CaddyModule

func (RoundRobinSelection) CaddyModule() caddy.ModuleInfo

CaddyModule returns the Caddy module information.

func (*RoundRobinSelection) Select

func (r *RoundRobinSelection) Select(pool EnginePool, _ *http.Request, _ http.ResponseWriter) *t1k.ChannelPool

Select returns an available host, if any.

func (*RoundRobinSelection) UnmarshalCaddyfile

func (r *RoundRobinSelection) UnmarshalCaddyfile(d *caddyfile.Dispenser) error

UnmarshalCaddyfile sets up the module from Caddyfile tokens.

type Selector

type Selector interface {
	Select(EnginePool, *http.Request, http.ResponseWriter) *t1k.ChannelPool
}

Selector selects an available upstream from the pool.