WIP

ansible/roles/bgwaf/defaults/main.yml

@@ -54,10 +54,157 @@ bgwaf_sites: []
 #       - ""
 #     after_response:
 #       - ""
-#   redirect_from_aliases: true
+
-#   custom_cert: true
+bgwaf_defaults:
-#   custom_cert_file: ""
+  redirect_from_aliases: true
-#   custom_key_file: ""
+  custom_cert: true
-#   rate_events: 1000
+  custom_cert_file: ""
-#   rate_window: "1m"
+  custom_key_file: ""
-#   bot_barrier: false
+  rate_events: 1000
+  rate_window: "1m"
+  bot_barrier: false
+  log_only: true
+  paranoia_level: 1
+  detection_paranoia_level: null
+  enforce_bodyproc_urlencoded: 1
+  critical_anomaly_score: 5
+  error_anomaly_score: 4
+  warning_anomaly_score: 3
+  notice_anomaly_score: 2
+  inbound_anomaly_score_threshold: 5
+  outbound_anomaly_score_threshold: 4
+  reporting_level: 4
+  max_num_args: 255
+  arg_name_length: 100
+  arg_length: 1000
+  total_arg_length: 64000
+  max_file_size: 10485760        # 10 Mo
+  combined_file_sizes: 20970520  # 20 Mo
+  sampling_percentage: 100
+  allowed_methods:
+    - "GET"
+    - "HEAD"
+    - "POST"
+    - "OPTIONS"
+  allowed_request_content_type:
+    - "|application/x-www-form-urlencoded|"
+    - "|multipart/form-data|"
+    - "|text/xml|"
+    - "|application/xml|"
+    - "|application/soap+xml|"
+    - "|application/json|"
+    - "|application/reports+json|"
+    - "|application/csp-report|"
+  restricted_extensions:
+    - ".ani/"
+    - ".asa/"
+    - ".asax/"
+    - ".ascx/"
+    - ".backup/"
+    - ".bak/"
+    - ".bat/"
+    - ".cdx/"
+    - ".cer/"
+    - ".cfg/"
+    - ".cmd/"
+    - ".cnf/"
+    - ".com/"
+    - ".compositefont/"
+    - ".config/"
+    - ".conf/"
+    - ".copy/"
+    - ".crt/"
+    - ".cs/"
+    - ".csproj/"
+    - ".csr/"
+    - ".dat/"
+    - ".db/"
+    - ".dbf/"
+    - ".dist/"
+    - ".dll/"
+    - ".dos/"
+    - ".dpkg-dist/"
+    - ".drv/"
+    - ".gadget/"
+    - ".hta/"
+    - ".htr/"
+    - ".htw/"
+    - ".ida/"
+    - ".idc/"
+    - ".idq/"
+    - ".inc/"
+    - ".inf/"
+    - ".ini/"
+    - ".jse/"
+    - ".key/"
+    - ".licx/"
+    - ".lnk/"
+    - ".log/"
+    - ".mdb/"
+    - ".msc/"
+    - ".ocx/"
+    - ".old/"
+    - ".pass/"
+    - ".pdb/"
+    - ".pfx/"
+    - ".pif/"
+    - ".pem/"
+    - ".pol/"
+    - ".prf/"
+    - ".printer/"
+    - ".pwd/"
+    - ".rdb/"
+    - ".rdp/"
+    - ".reg/"
+    - ".resources/"
+    - ".resx/"
+    - ".save/"
+    - ".scr/"
+    - ".sct/"
+    - ".shs/"
+    - ".sql/"
+    - ".sqlite/"
+    - ".sqlite3/"
+    - ".swp/"
+    - ".sys/"
+    - ".temp/"
+    - ".tlb/"
+    - ".tmp/"
+    - ".vb/"
+    - ".vbe/"
+    - ".vbs/"
+    - ".vbproj/"
+    - ".vsdisco/"
+    - ".vxd/"
+    - ".webinfo/"
+    - ".ws/"
+    - ".wsc/"
+    - ".wsf/"
+    - ".wsh/"
+    - ".xsd/"
+    - ".xsx/"
+  restricted_headers_basic:
+    - "/content-encoding/"
+    - "/proxy/"
+    - "/lock-token/"
+    - "/content-range/"
+    - "/if/"
+    - "/x-http-method-override/"
+    - "/x-http-method/"
+    - "/x-method-override/"
+    - "/x-middleware-subrequest/"
+    - "/expect/"
+  allowed_http_versions:
+    - "HTTP/1.0"
+    - "HTTP/1.1"
+    - "HTTP/2"
+    - "HTTP/2.0"
+    - "HTTP/3"
+    - "HTTP/3.0"
+  restricted_headers_extended:
+    - "/accept-charset/"
+  allowed_request_content_type_charset:
+    - "|utf-8|"
+    - "|iso-8859-1|"
+    - "|iso-8859-15|"
+    - "|windows-1252|"

ansible/roles/bgwaf/tasks/main.yml

@@ -145,11 +145,11 @@
 
 - name: Generate sites exclusions before request file
   loop: "{{ bgwaf_sites }}"
-  vars:
+  loop_control:
-    bgwaf_site_exclusions: "{{ item.exceptions.before_request | default([]) }}"
+    loop_var: "site"
   ansible.builtin.template:
-    src: "templates/exclusions.conf"
+    src: "templates/exclusions-request-before.conf"
-    dest: "/etc/caddy/sites/{{ item.name }}/exclusions-request-before.conf"
+    dest: "/etc/caddy/sites/{{ site.name }}/exclusions-request-before.conf"
     group: "caddy"
     mode: "0640"
   notify:
@@ -157,11 +157,11 @@
 
 - name: Generate sites exclusions after response file
   loop: "{{ bgwaf_sites }}"
-  vars:
+  loop_control:
-    bgwaf_site_exclusions: "{{ item.exceptions.after_response | default([]) }}"
+    loop_var: "site"
   ansible.builtin.template:
-    src: "templates/exclusions.conf"
+    src: "templates/exclusions-response-after.conf"
-    dest: "/etc/caddy/sites/{{ item.name }}/exclusions-response-after.conf"
+    dest: "/etc/caddy/sites/{{ site.name }}/exclusions-response-after.conf"
     group: "caddy"
     mode: "0640"
   notify:

ansible/roles/bgwaf/templates/coraza.conf

@@ -147,7 +147,7 @@ SecAuditLogType Serial
 
 # The format used to write the audit log.
 # Can be one of JSON|JsonLegacy|Native|OCSF
-SecAuditLogFormat Native
+SecAuditLogFormat JSON
 
 # The following settings are not supported by Coraza
 # SecCookieFormat 0

ansible/roles/bgwaf/templates/exclusions-request-before.conf

@@ -0,0 +1,3 @@
+{% for exclusion in site.exceptions.before_request | default([]) %}
+{{ exclusion }}
+{% endfor %}

ansible/roles/bgwaf/templates/exclusions-response-after.conf

@@ -0,0 +1,3 @@
+{% for exclusion in site.exceptions.after_response | default([]) %}
+{{ exclusion }}
+{% endfor %}

ansible/roles/bgwaf/templates/exclusions.conf

@@ -1,3 +0,0 @@
-{% for exclusion in bgwaf_site_exclusions %}
-{{ exclusion }}
-{% endfor %}

ansible/vars.yml

@@ -13,6 +13,13 @@ waf:
             - "http://www1"
             - "http://www2"
             - "http://www3"
+      log_only: true
+#     paranoia_level: 1
+#     detection_paranoia_level: null
       custom_cert: true
       custom_cert_file: "/etc/ssl/certs/local.crt"
       custom_key_file: "/etc/ssl/private/local.key"
+#     exceptions:
+#       before_request:
+#         - 'SecRule REQUEST_URI "@beginsWith /?bin/sh" "id:1,nolog,ctl:ruleRemoveById=932160"'
+#         - 'SecRule REQUEST_URI "@beginsWith /?bin/sh" "id:2,nolog,ctl:ruleRemoveById=932250"'