WIP

2026-01-14 11:03:59 +03:00
parent de92065d22
commit 562f9511db
43 changed files with 619 additions and 422 deletions
--- a/ansible/roles/waf_config/defaults/main.yml
+++ b/ansible/roles/waf_config/defaults/main.yml
@@ -0,0 +1,195 @@
+# Defaults
+waf_config_owasp_crs_version: "4.21.0"
+
+# Required unless not site.custom_cert
+waf_config_email: null
+
+# Required if site.bot_barrier
+waf_config_bot_barrier_secret: null
+
+# Optionnal
+waf_config_local_ca_name: null
+waf_config_ca_root: null
+
+waf_config_sites: []
+# - name: ""
+#   site: ""
+#   paths:
+#     - path: "*"
+#       addrs:
+#         - ""
+#   blacklist:
+#     - ""
+#   aliases:
+#     - ""
+#   plugins:     FIXME:TODO
+#     - ""
+#   exceptions:
+#     before_request:
+#       - ""
+#     after_response:
+#       - ""
+
+waf_config_defaults:
+  redirect_from_aliases: true
+  custom_cert: true
+  custom_cert_file: ""
+  custom_key_file: ""
+
+  rate_events: 1000
+  rate_window: "1m"
+
+  bot_barrier: false
+
+  # CRS defaults
+  log_only: false
+  paranoia_level: 1
+  detection_paranoia_level: null
+  enforce_bodyproc_urlencoded: 1
+  critical_anomaly_score: 5
+  error_anomaly_score: 4
+  warning_anomaly_score: 3
+  notice_anomaly_score: 2
+  inbound_anomaly_score_threshold: 5
+  outbound_anomaly_score_threshold: 4
+  reporting_level: 4
+  max_num_args: 255
+  arg_name_length: 100
+  arg_length: 1000
+  total_arg_length: 64000
+  max_file_size: 10485760        # 10 Mo
+  combined_file_sizes: 20970520  # 20 Mo
+  sampling_percentage: 100
+  allowed_methods:
+    - "GET"
+    - "HEAD"
+    - "POST"
+    - "OPTIONS"
+  allowed_request_content_type:
+    - "|application/x-www-form-urlencoded|"
+    - "|multipart/form-data|"
+    - "|text/xml|"
+    - "|application/xml|"
+    - "|application/soap+xml|"
+    - "|application/json|"
+    - "|application/reports+json|"
+    - "|application/csp-report|"
+  restricted_extensions:
+    - ".ani/"
+    - ".asa/"
+    - ".asax/"
+    - ".ascx/"
+    - ".back/"
+    - ".backup/"
+    - ".bak/"
+    - ".bck/"
+    - ".bk/"
+    - ".bkp/"
+    - ".bat/"
+    - ".cdx/"
+    - ".cer/"
+    - ".cfg/"
+    - ".cmd/"
+    - ".cnf/"
+    - ".com/"
+    - ".compositefont/"
+    - ".config/"
+    - ".conf/"
+    - ".copy/"
+    - ".crt/"
+    - ".cs/"
+    - ".csproj/"
+    - ".csr/"
+    - ".dat/"
+    - ".db/"
+    - ".dbf/"
+    - ".dist/"
+    - ".dll/"
+    - ".dos/"
+    - ".dpkg-dist/"
+    - ".drv/"
+    - ".gadget/"
+    - ".hta/"
+    - ".htr/"
+    - ".htw/"
+    - ".ida/"
+    - ".idc/"
+    - ".idq/"
+    - ".inc/"
+    - ".inf/"
+    - ".ini/"
+    - ".jse/"
+    - ".key/"
+    - ".licx/"
+    - ".lnk/"
+    - ".log/"
+    - ".mdb/"
+    - ".msc/"
+    - ".ocx/"
+    - ".old/"
+    - ".pass/"
+    - ".pdb/"
+    - ".pfx/"
+    - ".pif/"
+    - ".pem/"
+    - ".pol/"
+    - ".prf/"
+    - ".printer/"
+    - ".pwd/"
+    - ".rdb/"
+    - ".rdp/"
+    - ".reg/"
+    - ".resources/"
+    - ".resx/"
+    - ".sav/"
+    - ".save/"
+    - ".scr/"
+    - ".sct/"
+    - ".sh/"
+    - ".shs/"
+    - ".sql/"
+    - ".sqlite/"
+    - ".sqlite3/"
+    - ".swp/"
+    - ".sys/"
+    - ".temp/"
+    - ".tlb/"
+    - ".tmp/"
+    - ".vb/"
+    - ".vbe/"
+    - ".vbs/"
+    - ".vbproj/"
+    - ".vsdisco/"
+    - ".vxd/"
+    - ".webinfo/"
+    - ".ws/"
+    - ".wsc/"
+    - ".wsf/"
+    - ".wsh/"
+    - ".xsd/"
+    - ".xsx/"
+  restricted_headers_basic:
+    - "/content-encoding/"
+    - "/proxy/"
+    - "/lock-token/"
+    - "/content-range/"
+    - "/if/"
+    - "/x-http-method-override/"
+    - "/x-http-method/"
+    - "/x-method-override/"
+    - "/x-middleware-subrequest/"
+    - "/expect/"
+  allowed_http_versions:
+    - "HTTP/1.0"
+    - "HTTP/1.1"
+    - "HTTP/2"
+    - "HTTP/2.0"
+    - "HTTP/3"
+    - "HTTP/3.0"
+  restricted_headers_extended:
+    - "/accept-charset/"
+  allowed_request_content_type_charset:
+    - "|utf-8|"
+    - "|iso-8859-1|"
+    - "|iso-8859-15|"
+    - "|windows-1252|"