seclang

Documentation

Index

• func ParseRule(options RuleOptions) (*coraza.Rule, error)
• func RegisterDirective(name string, directive Directive)
• type Directive
• type DirectiveOptions
• type Parser
  • func NewParser(waf *coraza.Waf) (*Parser, error)
  • func (p *Parser) FromFile(profilePath string) error
  • func (p *Parser) FromString(data string) error
  • func (p *Parser) SetCurrentDir(dir string)
• type RuleOptions
• type RuleParser
  • func (p *RuleParser) ParseActions(actions string) error
  • func (p *RuleParser) ParseDefaultActions(actions string) error
  • func (p *RuleParser) ParseOperator(operator string) error
  • func (p *RuleParser) ParseVariables(vars string) error
  • func (p *RuleParser) Rule() *coraza.Rule

Functions

func ParseRule

func ParseRule(options RuleOptions) (*coraza.Rule, error)

ParseRule parses a rule from a string The string must match the seclang format In case WithOperator is false, the rule will be parsed without operator This function is created for external plugin directives

func RegisterDirective

func RegisterDirective(name string, directive Directive)

RegisterDirective registers a directive to the seclang processor. All WAF instances will share the same directive map.

Types

type Directive

type Directive = func(options *DirectiveOptions) error

Directive type is used to extend the secland directives

type DirectiveOptions

type DirectiveOptions struct {
	Waf       *coraza.Waf
	Config    types.Config
	Arguments string
	Path      []string
}

DirectiveOptions contains the parsed options for a directive

type Parser

type Parser struct {
	// contains filtered or unexported fields
}

Parser provides functions to evaluate (compile) SecLang directives

func NewParser

func NewParser(waf *coraza.Waf) (*Parser, error)

NewParser creates a new parser from a WAF instance Rules and settings will be inserted into the WAF rule container (RuleGroup).

func (*Parser) FromFile

func (p *Parser) FromFile(profilePath string) error

FromFile imports directives from a file It will return error if any directive fails to parse or the file does not exist. If the path contains a *, it will be expanded to all files in the directory matching the pattern

func (*Parser) FromString

func (p *Parser) FromString(data string) error

FromString imports directives from a string It will return error if any directive fails to parse or arguments are invalid

func (*Parser) SetCurrentDir

func (p *Parser) SetCurrentDir(dir string)

SetCurrentDir forces the current directory of the parser to dir If FromFile was used, the file directory will be used instead unless overwritten by this function It is mostly used by operators that consumes relative paths

type RuleOptions

type RuleOptions struct {
	WithOperator bool
	Waf          *coraza.Waf
	Config       types.Config
	Directive    string
	Data         string
}

RuleOptions contains the options used to compile a rule

type RuleParser

type RuleParser struct {
	// contains filtered or unexported fields
}

RuleParser is used to programatically create new rules using seclang formatted strings

func (*RuleParser) ParseActions

func (p *RuleParser) ParseActions(actions string) error

ParseActions parses a comma separated list of actions:arguments Arguments can be wrapper inside quotes

func (*RuleParser) ParseDefaultActions

func (p *RuleParser) ParseDefaultActions(actions string) error

ParseDefaultActions parses a list of actions separated by a comma and assigns it to the specified phase. Default Actions MUST contain a phase Only one phase can be specified per WAF instance A disruptive action is required to be specified Each rule on the indicated phase will inherit the previously declared actions If the user overwrites the default actions, the default actions will be overwritten

func (*RuleParser) ParseOperator

func (p *RuleParser) ParseOperator(operator string) error

ParseOperator parses a seclang formatted operator string A operator must begin with @ (like @rx), if no operator is specified, rx will be used. Everything after the operator will be used as operator argument

func (*RuleParser) ParseVariables

func (p *RuleParser) ParseVariables(vars string) error

ParseVariables parses variables from a string and transforms it into variables, variable negations and variable counters. Multiple separated variables: VARIABLE1|VARIABLE2|VARIABLE3 Variable count: &VARIABLE1 Variable key negation: REQUEST_HEADERS|!REQUEST_HEADERS:user-agent

func (*RuleParser) Rule

func (p *RuleParser) Rule() *coraza.Rule

Rule returns the compiled rule