seclang

Documentation

Index

• func ParseRule(options RuleOptions) (*coraza.Rule, error)
• func RegisterDirectivePlugin(name string, directive func(w *coraza.Waf, opts string) error)
• type Parser
  • func NewParser(waf *coraza.Waf) (*Parser, error)
  • func (p *Parser) FromFile(profilePath string) error
  • func (p *Parser) FromString(data string) error
  • func (p *Parser) SetCurrentDir(dir string)
• type RuleOptions
• type RuleParser
  • func (p *RuleParser) ParseActions(actions string) error
  • func (p *RuleParser) ParseDefaultActions(actions string) error
  • func (p *RuleParser) ParseOperator(operator string) error
  • func (p *RuleParser) ParseVariables(vars string) error
  • func (p *RuleParser) Rule() *coraza.Rule

Functions

func ParseRule

func ParseRule(options RuleOptions) (*coraza.Rule, error)

ParseRule parses a rule from a string The string must match the seclang format In case WithOperator is false, the rule will be parsed without operator This function is created for external plugin directives

func RegisterDirectivePlugin

func RegisterDirectivePlugin(name string, directive func(w *coraza.Waf, opts string) error)

RegisterDirectivePlugin registers a new directive plugin that can be automatically evaluated as a seclang directive.

Types

type Parser

type Parser struct {
	// contains filtered or unexported fields
}

Parser provides functions to evaluate (compile) SecLang directives

func NewParser

func NewParser(waf *coraza.Waf) (*Parser, error)

NewParser creates a new parser from a WAF instance Rules and settings will be inserted into the WAF rule container (RuleGroup).

func (*Parser) FromFile

func (p *Parser) FromFile(profilePath string) error

FromFile imports directives from a file It will return error if any directive fails to parse or the file does not exist. If the path contains a *, it will be expanded to all files in the directory matching the pattern

func (*Parser) FromString

func (p *Parser) FromString(data string) error

FromString imports directives from a string It will return error if any directive fails to parse or arguments are invalid

func (*Parser) SetCurrentDir

func (p *Parser) SetCurrentDir(dir string)

SetCurrentDir forces the current directory of the parser to dir If FromFile was used, the file directory will be used instead unless overwritten by this function It is mostly used by operators that consumes relative paths

type RuleOptions

type RuleOptions struct {
	ConfigFile   string
	ConfigDir    string
	Waf          *coraza.Waf
	WithOperator bool
	Line         int
	Data         string
}

RuleOptions contains the options used to compile a rule

type RuleParser

type RuleParser struct {
	// contains filtered or unexported fields
}

RuleParser is used to programatically create new rules using seclang formatted strings

func (*RuleParser) ParseActions

func (p *RuleParser) ParseActions(actions string) error

ParseActions parses a comma separated list of actions:arguments Arguments can be wrapper inside quotes

func (*RuleParser) ParseDefaultActions

func (p *RuleParser) ParseDefaultActions(actions string) error

ParseDefaultActions parses a list of actions separated by a comma and assigns it to the specified phase. Default Actions MUST contain a phase Only one phase can be specified per WAF instance A disruptive action is required to be specified Each rule on the indicated phase will inherit the previously declared actions If the user overwrites the default actions, the default actions will be overwritten

func (*RuleParser) ParseOperator

func (p *RuleParser) ParseOperator(operator string) error

ParseOperator parses a seclang formatted operator string A operator must begin with @ (like @rx), if no operator is specified, rx will be used. Everything after the operator will be used as operator argument

func (*RuleParser) ParseVariables

func (p *RuleParser) ParseVariables(vars string) error

ParseVariables parses variables from a string and transforms it into variables, variable negations and variable counters. Multiple separated variables: VARIABLE1|VARIABLE2|VARIABLE3 Variable count: &VARIABLE1 Variable key negation: REQUEST_HEADERS|!REQUEST_HEADERS:user-agent

func (*RuleParser) Rule

func (p *RuleParser) Rule() *coraza.Rule

Rule returns the compiled rule