EasyWAF v0.9.2

Added

• A documentation site, built with MkDocs from docs/ in this repository: overview, installation, first run, sites, TLS, policies, traffic, accounts, logging, configuration, troubleshooting, and a current list of what EasyWAF does not do.

Changed

• Creating a policy starts with nothing selected, and a Basic sets button ticks the eight that assume nothing about the application behind the proxy. They used to be ticked on arrival, so every new policy carried them whether or not anyone had decided to.
• Creating a policy with no rules says so on the form and in the message afterwards, rather than reporting that it was created with 0 rules.
• The create-site form asks whether to request a Let's Encrypt certificate before offering the list of existing ones, and says why that list goes inert when it does.
• The create-site form's Let's Encrypt checkbox says it covers the site's aliases as well, which it has done since 0.9.1.

Commits

• 05fdd91 A documentation site for EasyWAF — yarivha
• 7e8d1b8 Say that a new site can ask for its certificate — yarivha
• 9e0bcc5 Ask how a site gets its certificate before offering the list — yarivha
• d2c9693 Make the basic rule sets a button, not a default — yarivha
• d6d2147 Record why the gateway is binary rather than score-triggered — yarivha
• 0b94d95 Release 0.9.2 — yarivha

Full changelog: v0.9.1...v0.9.2

EasyWAF v0.9.1

Added

• A site can answer for more than one hostname: aliases share its upstream, policy, ports and headers, so two names for one application no longer means two sites kept in step by hand.
• A certificate requested for a site now covers every hostname it answers for, and renewal re-requests all of them.

Commits

• e2ff352 Plan an authentication gateway — yarivha
• 7ed0c57 One site, many hostnames — yarivha
• 955a501 Release 0.9.1 — yarivha

Full changelog: v0.9.0...v0.9.1

EasyWAF v0.9.0

Added

• Flow logs over syslog: one line per proxied request, sent to a collector with the site, client, method, path, verdict, score and rules. Off by default.
• Settings › Logging: the syslog collector's address and port, applied to the running proxy on save rather than at the next restart.
• Logging configuration in config.toml: the directory the audit log is written to — /var/log/easywaf on every installation, created by the systemd unit — and how many days of files are kept.
• Audit log: every change made through the management interface is written to /var/log/easywaf/audit.log with the account, the client address, the outcome and — when a save was refused — the reason.
• Sign-ins, failed sign-ins and sign-outs appear in the audit log, a failed one naming the account that was tried.
• docs/design/easylog-easywaf-type.md — the wire format EasyWAF emits, specified for EasyLog to implement a parser against.

Fixed

• scripts/modsec2easywaf.py converted CRS rules of every paranoia level. CRS runs level 1 by default and higher levels are opt-in, so 53% of the output was rules CRS itself would not run. It now takes --max-paranoia, default 1.

Commits

• 2fdaee5 Teach the ModSecurity converter about paranoia levels — yarivha
• 312f59b Plan the missing decoders for 0.10.0 — yarivha
• a4e232c Move flow logs to 0.9.0, ahead of IP lists and the engine release — yarivha
• ce89740 Add the logging core: an audit file and a syslog sender — yarivha
• c67f2eb Specify the easywaf log type for EasyLog — yarivha
• 00866c5 Emit the flow line for every proxied request — yarivha
• a873e6f Set the syslog collector in Settings, not config.toml — yarivha
• b94006a Put the log directory at /var/log/easywaf everywhere — yarivha
• 847ce5c Record who changed what, in a layer rather than in handlers — yarivha
• d5e1b8b Release 0.9.0 — yarivha

Full changelog: v0.8.1...v0.9.0

EasyWAF v0.8.1

Fixed

• Signing in after a session ended looped between the login page and the dashboard until the browser gave up with ERR_TOO_MANY_REDIRECTS. The login page decided "already signed in" from the cookie alone while every other page checked the database.
• Logging out did not always remove the session cookie: the removal did not name the path the cookie was set with, so the browser kept it.

Commits

• e1bb20a Shorten the changelog to one line per change — yarivha
• 2faae69 List each commit, with author and hash, on the release page — yarivha
• 7badb58 Drop the changelog entry for the release-page change — yarivha
• 26afff9 Condense the whole changelog to one line per change — yarivha
• e82e7b8 Fix the login page looping against the dashboard — yarivha
• 31459c7 Release 0.8.1 — yarivha

Full changelog: v0.8.0...v0.8.1

EasyWAF v0.8.0

Added

• Accounts have roles: admin sees and changes everything, viewer sees the
  dashboard, traffic, sites, policies, rules, exclusions and certificates but
  changes nothing. Every account existing before the upgrade becomes an admin.
• Account management under Settings › Accounts: create, change role, reset a
  password, sign out everywhere, suspend, delete.
• Accounts can be suspended rather than deleted, keeping their history, and
  their last sign-in is recorded.
• Sessions can be ended. A password change, role change, suspension or "sign
  out everywhere" invalidates that account's sessions immediately, instead of
  leaving them valid for up to eight hours.
• The interface reflects the role: controls a viewer cannot use are not offered,
  and the header shows a viewer badge.

Changed

• Authorisation is declared per route rather than checked by each handler, so a
  page that needs an administrator cannot be written without saying so.
• Settings is administrator-only. Certificates are readable by viewers —
  private keys are never rendered — but uploading, requesting and deleting are
  not.

Security

• A session no longer outlives the password that created it.
• No action can leave the installation without an enabled administrator: the
  last one cannot be demoted, suspended or deleted, and no account can suspend
  or delete itself.

Commits

• 81765eb Point prune-debris at where the database actually is — yarivha
• f1329c3 Put proxy performance on the roadmap at 0.10.0 — yarivha
• c8e7339 Give accounts roles, and make a session endable — yarivha
• 20e2cd3 Convert every handler to a declared authorisation requirement — yarivha
• 7dcd829 Add account management, guarded against locking everyone out — yarivha
• 01a988c Show a viewer only what a viewer can do — yarivha
• 3615997 Let a viewer read certificates — yarivha
• c7e0c1d Let an account change its own password — yarivha

Full changelog: v0.7.3...v0.8.0

EasyWAF v0.7.3

Added

• Clicking a chart filters the traffic it stands for: a Traffic Monitor bar narrows to that hour, and a dashboard bar or verdict slice opens Traffic Monitor already narrowed.

Changed

• A sub-threshold match is labelled SCORED rather than DETECTED, and shows its score — the old word read as though an enforcing policy had stopped enforcing.

Commits

• f7b6a83 Call a sub-threshold match SCORED, not DETECTED — yarivha
• ab8c95a Make the charts filters — yarivha
• 5349106 Release 0.7.3 — yarivha

Full changelog: v0.7.2...v0.7.3

EasyWAF v0.7.2

Fixed

• Rule Exclusions now appears in the Security Policy menu, as one page across all policies with a filter.

Commits

• ccaf35d Put Rule Exclusions in the Security Policy menu — yarivha
• 31fbdea Release 0.7.2 — yarivha

Full changelog: v0.7.1...v0.7.2

EasyWAF v0.7.1

Added

• A site with no policy attached now says so, on the dashboard, in the sites list and beside the policy selector. It is the one state in which nothing is inspected.

Fixed

• Excluding a rule from Traffic Monitor failed with "invalid digit found in string". The exclusion was saved; only the confirmation was lost.

Commits

• 280cc8a Move IP lists to 0.9.0 and rewrite what 0.7.0 left of it — yarivha
• c85defc Say when a site is not inspected at all — yarivha
• cf01bdc Fix the flash redirect appending a second question mark — yarivha
• af82541 Release 0.7.1 — yarivha

Full changelog: v0.7.0...v0.7.1

EasyWAF v0.7.0

Added

• A rule exclusion can name the clients it applies to, so one client's false positive no longer needs the rule weakened for everyone.
• Traffic Monitor rows carry an "exclude for this IP" button, and mark a rule already excluded for that client.
• A Rule Exclusions page per policy lists every rule not running, with the client and path each covers, and removes them.

Commits

• e5c1727 Move logging to 0.8.0, ahead of load balancing and export — yarivha
• cc16ba4 Let an exclusion name the clients it applies to — yarivha
• 137fbdc Release 0.7.0 — yarivha

Full changelog: v0.6.12...v0.7.0

EasyWAF v0.6.12

Added

• A policy's custom rules can be copied into another policy, skipping any rule the target already holds by pattern.
• scripts/modsec2easywaf.py converts ModSecurity rules, refusing with a reason the ones it cannot convert faithfully.

Changed

• A cloned rule is a custom rule and no longer sits in the set it came from, while still recording where it came from.

Fixed

• The Traffic Monitor graph ignored the verdict filter, so the table filtered while the graph showed everything. It also gained a Detected series.

Commits

• 24078d3 Convert ModSecurity rules, and refuse the ones that cannot be — yarivha
• f4548cb Refuse ModSecurity rules that count rather than detect — yarivha
• 987cdc2 Make a cloned rule a custom rule, and let policies share them — yarivha
• ec54e78 Make the traffic graph answer the same question as the table — yarivha
• ec76b01 Release 0.6.12 — yarivha

Full changelog: v0.6.11...v0.6.12