bgwaf/ansible/roles/waf_config/defaults/main.yml

# Defaults
waf_config_owasp_crs_version: "4.21.0"

# Required unless not site.custom_cert
waf_config_email: null

# Required if site.bot_barrier
waf_config_bot_barrier_secret: null

# Optionnal
waf_config_local_ca_name: null
waf_config_ca_root: null

waf_config_sites: []
# - name: ""
#   site: ""
#   paths:
#     - path: "*"
#       addrs:
#         - ""
#   blacklist:
#     - ""
#   aliases:
#     - ""
#   plugins:     FIXME:TODO
#     - ""
#   exceptions:
#     before_request:
#       - ""
#     after_response:
#       - ""

waf_config_defaults:
  redirect_from_aliases: true
  custom_cert: true
  custom_cert_file: ""
  custom_key_file: ""

  rate_events: 1000
  rate_window: "1m"

  bot_barrier: false

  # CRS defaults
  log_only: false
  paranoia_level: 1
  detection_paranoia_level: null
  enforce_bodyproc_urlencoded: 1
  critical_anomaly_score: 5
  error_anomaly_score: 4
  warning_anomaly_score: 3
  notice_anomaly_score: 2
  inbound_anomaly_score_threshold: 5
  outbound_anomaly_score_threshold: 4
  reporting_level: 4
  max_num_args: 255
  arg_name_length: 100
  arg_length: 1000
  total_arg_length: 64000
  max_file_size: 10485760        # 10 Mo
  combined_file_sizes: 20970520  # 20 Mo
  sampling_percentage: 100
  allowed_methods:
    - "GET"
    - "HEAD"
    - "POST"
    - "OPTIONS"
  allowed_request_content_type:
    - "|application/x-www-form-urlencoded|"
    - "|multipart/form-data|"
    - "|text/xml|"
    - "|application/xml|"
    - "|application/soap+xml|"
    - "|application/json|"
    - "|application/reports+json|"
    - "|application/csp-report|"
  restricted_extensions:
    - ".ani/"
    - ".asa/"
    - ".asax/"
    - ".ascx/"
    - ".back/"
    - ".backup/"
    - ".bak/"
    - ".bck/"
    - ".bk/"
    - ".bkp/"
    - ".bat/"
    - ".cdx/"
    - ".cer/"
    - ".cfg/"
    - ".cmd/"
    - ".cnf/"
    - ".com/"
    - ".compositefont/"
    - ".config/"
    - ".conf/"
    - ".copy/"
    - ".crt/"
    - ".cs/"
    - ".csproj/"
    - ".csr/"
    - ".dat/"
    - ".db/"
    - ".dbf/"
    - ".dist/"
    - ".dll/"
    - ".dos/"
    - ".dpkg-dist/"
    - ".drv/"
    - ".gadget/"
    - ".hta/"
    - ".htr/"
    - ".htw/"
    - ".ida/"
    - ".idc/"
    - ".idq/"
    - ".inc/"
    - ".inf/"
    - ".ini/"
    - ".jse/"
    - ".key/"
    - ".licx/"
    - ".lnk/"
    - ".log/"
    - ".mdb/"
    - ".msc/"
    - ".ocx/"
    - ".old/"
    - ".pass/"
    - ".pdb/"
    - ".pfx/"
    - ".pif/"
    - ".pem/"
    - ".pol/"
    - ".prf/"
    - ".printer/"
    - ".pwd/"
    - ".rdb/"
    - ".rdp/"
    - ".reg/"
    - ".resources/"
    - ".resx/"
    - ".sav/"
    - ".save/"
    - ".scr/"
    - ".sct/"
    - ".sh/"
    - ".shs/"
    - ".sql/"
    - ".sqlite/"
    - ".sqlite3/"
    - ".swp/"
    - ".sys/"
    - ".temp/"
    - ".tlb/"
    - ".tmp/"
    - ".vb/"
    - ".vbe/"
    - ".vbs/"
    - ".vbproj/"
    - ".vsdisco/"
    - ".vxd/"
    - ".webinfo/"
    - ".ws/"
    - ".wsc/"
    - ".wsf/"
    - ".wsh/"
    - ".xsd/"
    - ".xsx/"
  restricted_headers_basic:
    - "/content-encoding/"
    - "/proxy/"
    - "/lock-token/"
    - "/content-range/"
    - "/if/"
    - "/x-http-method-override/"
    - "/x-http-method/"
    - "/x-method-override/"
    - "/x-middleware-subrequest/"
    - "/expect/"
  allowed_http_versions:
    - "HTTP/1.0"
    - "HTTP/1.1"
    - "HTTP/2"
    - "HTTP/2.0"
    - "HTTP/3"
    - "HTTP/3.0"
  restricted_headers_extended:
    - "/accept-charset/"
  allowed_request_content_type_charset:
    - "|utf-8|"
    - "|iso-8859-1|"
    - "|iso-8859-15|"
    - "|windows-1252|"