173 Commits

Author SHA1 Message Date
Fabrizio Salmi
0a96f22563 style: fix imports ordering for gci linter 2025-12-06 23:08:54 +01:00
Fabrizio Salmi
5928ff4210 ci: fix go version and bump to v0.1.3 2025-12-06 22:55:55 +01:00
Fabrizio Salmi
78f0066cb8 docs: update documentation for v0.1.2 (ASN, SOTA, Issues fixed) 2025-12-06 22:53:33 +01:00
Fabrizio Salmi
00c547e2a3 refactor: apply SOTA patterns (Atomic HitCount, Zero-Copy Body, Low-Lock RateLimit) 2025-12-06 22:52:01 +01:00
Fabrizio Salmi
c29a7ce9aa chore: bump version to v0.1.0 2025-12-06 22:47:03 +01:00
Fabrizio Salmi
eea39d253b Security: Implement hardening improvements (LimitReader, GeoIP Fail-Open, UI Decoupling, Go Version) 2025-12-06 22:46:11 +01:00
Fabrizio Salmi
5d57051169 Style: Fix Code Formatting (go fmt) 2025-12-06 22:39:53 +01:00
Fabrizio Salmi
b3d3d5692c Fix: Address security alerts and bump version to v0.0.9 2025-12-06 22:26:16 +01:00
Fabrizio Salmi
1da1fea22b Feat: Implement ASN Blocking (#73) 2025-12-06 22:18:10 +01:00
Nicolas Iglesias
971bc53f8a fix: config initialization 2025-12-06 15:48:28 -03:00
drev74
c8c0fed9e2 fix: lint errors 2025-10-22 23:04:48 +03:00
fab
06a496e3d3 Update WAF version to v0.0.8 2025-10-20 17:48:43 +02:00
drev74
cf7c995137 fix: add trie instantiation on top
test(it): add blacklisting test with real data
2025-10-19 22:32:58 +03:00
fabriziosalmi
14e4de4b66 chore: update WAF version to v0.0.7 2025-10-16 01:03:55 +02:00
fabriziosalmi
1c32e928f1 refactor: enhance IP blacklist handling and add panic recovery in middleware 2025-10-16 00:58:51 +02:00
drev74
5c8d13199b chore: renamed country block to country blacklisting for consistency 2025-10-12 16:04:26 +03:00
drev74
145feb4bf8 test: upd ip blacklist test 2025-10-12 13:12:13 +03:00
drev74
27abae69ea feat: add golangci linter rules 2025-10-11 22:36:20 +03:00
drev74
c905277058 feat!!: switch to go-trie 2025-10-10 23:21:41 +03:00
copilot-swe-agent[bot]
df5f0511ac Complete Caddy module registration preparation
Co-authored-by: fabriziosalmi <1569108+fabriziosalmi@users.noreply.github.com>
2025-09-13 10:20:08 +00:00
fabriziosalmi
b2035a4acf Enhance middleware registration by ensuring proper interface implementation and updating Go version in go.mod 2025-04-30 11:50:33 +02:00
fabriziosalmi
13712e01d9 Bump WAF version to v0.0.5 and ensure proper module registration 2025-04-30 11:38:01 +02:00
fabriziosalmi
fe84fbb5c5 Add debugging tools for WAF configuration and anomaly threshold testing
- Implemented debug_test_results.py to evaluate WAF test results with detailed request/response logging.
- Created debug_waf.go for logging request details and dumping WAF rules to a file.
- Developed debug_waf.py to extract WAF configuration from Caddy Admin API and test WAF rules with sample requests.
- Added sample_rules.json containing test rules for WAF evaluation.
- Configured test.caddyfile for local testing of WAF with defined rules and logging.
- Enhanced test_anomalythreshold.py to validate anomaly threshold behavior with comprehensive test cases and detailed output.
2025-04-30 11:19:17 +02:00
fabriziosalmi
f01d59ca25 glitch 2025-02-01 01:09:51 +01:00
fabriziosalmi
40d0233435 Minor improvements. 2025-02-01 01:06:18 +01:00
fabriziosalmi
e20b1dbea5 version added (hardcoded) 2025-01-29 18:48:41 +01:00
fabriziosalmi
31a3f5943a Version added to metrics. 2025-01-29 18:42:33 +01:00
fabriziosalmi
6974ef8702 geoip and ratelimiter metrics fixed. UI geoip counter fixed. 2025-01-29 15:30:35 +01:00
fabriziosalmi
9223d337fc fixes for the following issues:
- https://github.com/fabriziosalmi/caddy-waf/issues/41
- https://github.com/fabriziosalmi/caddy-waf/issues/40
2025-01-29 13:34:27 +01:00
fabriziosalmi
ee5fc71b43 IP blacklisting fixed. IP & DNS metrics works properly now. Rule header-suspicious-x-forwarded-for temporary removed due to excessive false positive ratio. 2025-01-26 14:29:46 +01:00
fabriziosalmi
86c96b9bac IP & DNS blacklists hits metrics adn tests added. 2025-01-26 14:01:13 +01:00
fabriziosalmi
6c21226eed Fix ipv6 CIDRTrie isse 2025-01-25 00:56:06 +01:00
fabriziosalmi
5e611aa926 Fix CIDR cannot be inserted into Trie 2025-01-25 00:36:59 +01:00
fabriziosalmi
309c6ece63 Missing tests added. 2025-01-24 23:25:48 +01:00
fabriziosalmi
89336b6571 Minor improvements. 2025-01-24 20:52:10 +01:00
fabriziosalmi
89e2f269c1 fix: CaddyModule passes lock by value: 2025-01-22 03:17:50 +01:00
fabriziosalmi
43b49e3000 feat(waf): Improve type safety, rule loading, and logging
- Introducing custom types `RuleID` and `HitCount` for better type safety in rule management and hit tracking.
- Refactoring the `loadRules` function to `rules.go` for code reusability and maintainability, and using this function in the main module.
- Implementing type checks on rule hit stats.
- Adding geoip nil reader check in shutdown.
- Improving logging in various areas to aid debugging.
- Log file name when reloading rules.
2025-01-22 03:06:46 +01:00
fabriziosalmi
6c47370306 modularized: handler, types. 2025-01-22 02:53:48 +01:00
fabriziosalmi
81a831b271 initials unit tests added + some minor fixes. 2025-01-20 02:13:42 +01:00
fabriziosalmi
07a921ff83 minor improvements 2025-01-18 23:53:59 +01:00
fabriziosalmi
1923fdea0a minor improvements 2025-01-18 23:47:35 +01:00
fabriziosalmi
485894758b feat(logging): implement asynchronous logging with batching
- Added a buffered channel and background worker for asynchronous logging.
- Modified `logRequest` to queue log entries instead of writing synchronously.
- Updated `Provision` and `Shutdown` to start and stop the logging worker.
- Improved performance by reducing logging overhead in high-traffic scenarios.
- Added graceful shutdown to ensure all logs are written before exiting.
2025-01-18 23:23:06 +01:00
fabriziosalmi
78e491b5bf feat(waf): optimize rule processing and IP blacklist lookups
- Added short-circuit mechanism to stop rule evaluation early if a blocking decision is made.
- Replaced `map[string]struct{}` with `*CIDRTrie` for efficient IP blacklist storage and lookups.
- Improved performance by avoiding unnecessary rule evaluations and optimizing CIDR range checks.
- Updated `processRuleMatch`, `handlePhase`, and `loadIPBlacklistIntoMap` to support the new optimizations.
2025-01-18 23:15:44 +01:00
fabriziosalmi
9c8c8d189a rules processing improved 2025-01-18 23:09:04 +01:00
fabriziosalmi
5abe0b68bf fixed phase rule hits regression 2025-01-18 14:26:39 +01:00
fab
e16a8f707c Update caddywaf.go 2025-01-18 13:55:44 +01:00
fab
ec3054be60 Update caddywaf.go
fix: update blockRequest calls to include reason, ruleID, and matchedValue

- Updated all calls to `blockRequest` to include required parameters: `reason`, `ruleID`, and `matchedValue`.
- Fixed argument mismatches by replacing incorrect `zap.String` usage with actual string values.
- Enhanced logging for blocked requests to include detailed context (reason, rule ID, and matched value).
- Ensured compatibility with updated `response.go` changes.

This resolves compilation errors and improves logging for blocked requests.
2025-01-18 13:52:44 +01:00
fab
074b6818f4 Update caddywaf.go
blocked by dns and ip metrics added
2025-01-18 09:52:00 +01:00
fab
c4110fb007 Update caddywaf.go
phases metrics fixed
2025-01-18 09:34:22 +01:00
fabriziosalmi
faeb949836 Don't throw error if ip or dns blacklists are not present. 2025-01-15 20:46:16 +01:00