plugins

Documentation

Index

• func RegisterAction(name string, a ActionFactory)
• func RegisterAuditLogFormatter(name string, f func(plugintypes.AuditLog) ([]byte, error))
• func RegisterAuditLogWriter(name string, writerFactory func() plugintypes.AuditLogWriter)
• func RegisterBodyProcessor(name string, fn func() plugintypes.BodyProcessor)
• func RegisterOperator(name string, op plugintypes.OperatorFactory)
• func RegisterTransformation(name string, trans plugintypes.Transformation)
• type ActionFactory

Examples

• RegisterAuditLogFormatter
• RegisterAuditLogWriter

Functions

func RegisterAction

func RegisterAction(name string, a ActionFactory)

RegisterAction registers a new RuleAction If you register an action with an existing name, it will be overwritten.

func RegisterAuditLogFormatter

func RegisterAuditLogFormatter(name string, f func(plugintypes.AuditLog) ([]byte, error))

RegisterAuditLogFormatter registers a new audit log formatter.

Example

ExampleRegisterAuditLogFormatter shows how to register a custom audit log formatter and tests the output of the formatter.

plugins.RegisterAuditLogFormatter("txid", func(al plugintypes.AuditLog) ([]byte, error) {
	return []byte(al.Transaction().ID()), nil
})

w, err := coraza.NewWAF(
	coraza.NewWAFConfig().
		WithDirectives(`
				SecAuditEngine On
				SecAuditLogParts ABCFHZ
				SecAuditLog /dev/stdout
				SecAuditLogFormat txid
				SecAuditLogType serial
			`),
)
if err != nil {
	panic(err)
}

tx := w.NewTransactionWithID("abc123")
tx.ProcessLogging()
tx.Close()

Output:

abc123

func RegisterAuditLogWriter

func RegisterAuditLogWriter(name string, writerFactory func() plugintypes.AuditLogWriter)

RegisterAuditLogWriter registers a new audit log writer.

Example

ExampleRegisterAuditLogWriter shows how to register a custom audit log writer and tests the output of the writer.

//go:build !tinygo
// +build !tinygo

package main

import (
	"fmt"
	"io"
	"net/http"
	"net/http/httptest"
	"strings"

	"github.com/corazawaf/coraza/v3"
	"github.com/corazawaf/coraza/v3/experimental/plugins"
	"github.com/corazawaf/coraza/v3/experimental/plugins/plugintypes"
)

type urlWriter struct {
	url string
}

func (s *urlWriter) Init(cfg plugintypes.AuditLogConfig) error {
	s.url = cfg.Target
	return nil
}

func (s *urlWriter) Write(al plugintypes.AuditLog) error {
	res, err := http.DefaultClient.Post(s.url, "application/json", strings.NewReader(al.Transaction().ID()))
	if err != nil {
		return err
	}
	res.Body.Close()
	_, err = io.Copy(io.Discard, res.Body)
	return err
}

func (s *urlWriter) Close() error { return nil }

// ExampleRegisterAuditLogWriter shows how to register a custom audit log writer
// and tests the output of the writer.
func main() {
	plugins.RegisterAuditLogWriter("url", func() plugintypes.AuditLogWriter {
		return &urlWriter{}
	})

	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		b, _ := io.ReadAll(r.Body)
		fmt.Println(string(b))
	}))
	defer srv.Close()

	w, err := coraza.NewWAF(
		coraza.NewWAFConfig().
			WithDirectives(`
				SecAuditEngine On
				SecAuditLogParts ABCFHZ
				SecAuditLog ` + srv.URL + `
				SecAuditLogType url
			`),
	)
	if err != nil {
		panic(err)
	}

	tx := w.NewTransactionWithID("xyz456")
	tx.ProcessLogging()
	tx.Close()

}

Output:

xyz456

func RegisterBodyProcessor

func RegisterBodyProcessor(name string, fn func() plugintypes.BodyProcessor)

RegisterBodyProcessor registers a body processor by name. If the body processor is already registered, it will be overwritten

func RegisterOperator

func RegisterOperator(name string, op plugintypes.OperatorFactory)

RegisterOperator registers a new operator If the operator already exists it will be overwritten

func RegisterTransformation

func RegisterTransformation(name string, trans plugintypes.Transformation)

RegisterTransformation registers a transformation by name If the transformation is already registered, it will be overwritten

Types

type ActionFactory

type ActionFactory = func() plugintypes.Action

ActionFactory is used to wrap a RuleAction so that it can be registered and recreated on each call