Merge pull request #33 from fastly/SEC-10908_threat_assessment

SEC-10980 changes required

config_examples/waflyctl.toml.example

@@ -0,0 +1,78 @@
+
+logpath = "waflyctl.log"
+apiendpoint = "https://api.fastly.com"
+tags = ["OWASP","language-html","language-htm","language-css","language-jpg","language-json"]
+action = "log"
+rules = []
+
+# ONLY during new WAF provisionings we disabled the following list of rules by default
+disabledrules = []
+
+[owasp]
+# OWASP generic settings
+ParanoiaLevel = 3
+AllowedHTTPVersions = "HTTP/1.0 HTTP/1.1 HTTP/2"
+AllowedMethods = "GET HEAD POST OPTIONS PUT PATCH DELETE"
+AllowedRequestContentType = "application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|application/x-amf|application/json|text/plain"
+ArgLength = 800
+ArgNameLength = 800
+CombinedFileSizes = 10000000
+CRSValidateUTF8Encoding = false
+MaxFileSize = 10000000
+MaxNumArgs = 255
+TotalArgLength = 6400
+RestrictedExtensions = ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx"
+RestrictedHeaders = "/proxy/ /lock-token/ /content-range/ /translate/ /if/"
+
+# OWASP score settings
+InboundAnomalyScoreThreshold = 10
+CriticalAnomalyScore = 5
+ErrorAnomalyScore = 4
+WarningAnomalyScore = 3
+NoticeAnomalyScore = 2
+PHPInjectionScoreThreshold = 5
+RCEScoreThreshold = 5
+HTTPViolationScoreThreshold = 5
+LFIScoreThreshold = 5
+RFIScoreThreshold = 5
+SessionFixationScoreThreshold = 5
+SQLInjectionScoreThreshold = 5
+XSSScoreThreshold = 5
+
+[weblog]
+name = "weblogs"
+address = "address"
+port = "514"
+format = '''{\"type\":\"req\",\"service_id\":\"%{req.service_id}V\",\"request_id\":\"%{req.http.fastly-soc-x-request-id}V\",\"start_time\":\"%{time.start.sec}V\",\"fastly_info\":\"%{fastly_info.state}V\",\"datacenter\":\"%{server.datacenter}V\",\"client_ip\":\"%a\",\"req_method\":\"%m\",\"req_uri\":\"%{cstr_escape(req.url)}V\",\"req_h_host\":\"%{cstr_escape(req.http.Host)}V\",\"req_h_user_agent\":\"%{cstr_escape(req.http.User-Agent)}V\",\"req_h_accept_encoding\":\"%{cstr_escape(req.http.Accept-Encoding)}V\",\"req_header_bytes\":\"%{req.header_bytes_read}V\",\"req_body_bytes\":\"%{req.body_bytes_read}V\",\"waf_logged\":\"%{waf.logged}V\",\"waf_blocked\":\"%{waf.blocked}V\",\"waf_failures\":\"%{waf.failures}V\",\"waf_executed\":\"%{waf.executed}V\",\"anomaly_score\":\"%{waf.anomaly_score}V\",\"sql_injection_score\":\"%{waf.sql_injection_score}V\",\"rfi_score\":\"%{waf.rfi_score}V\",\"lfi_score\":\"%{waf.lfi_score}V\",\"rce_score\":\"%{waf.rce_score}V\",\"php_injection_score\":\"%{waf.php_injection_score}V\",\"session_fixation_score\":\"%{waf.session_fixation_score}V\",\"http_violation_score\":\"%{waf.http_violation_score}V\",\"xss_score\":\"%{waf.xss_score}V\",\"resp_status\":\"%{resp.status}V\",\"resp_bytes\":\"%{resp.bytes_written}V\",\"resp_header_bytes\":\"%{resp.header_bytes_written}V\",\"resp_body_bytes\":\"%{resp.body_bytes_written}V\"}'''
+
+[waflog]
+name = "waflogs"
+address = "address"
+port = 514
+format = '''{\"type\":\"waf\",\"request_id\":\"%{req.http.fastly-soc-x-request-id}V\",\"rule_id\":\"%{waf.rule_id}V\",\"severity\":\"%{waf.severity}V\",\"anomaly_score\":\"%{waf.anomaly_score}V\",\"logdata\":\"%{cstr_escape(waf.logdata)}V\",\"waf_message\":\"%{waf.message}V\"}'''
+
+
+[vclsnippet]
+name = "Fastly_WAF_Snippet"
+content = '''
+if (!req.http.fastly-soc-x-request-id)
+{
+  set req.http.fastly-soc-x-request-id = digest.hash_sha256(now randomstr(64) req.http.host req.url req.http.Fastly-Client-IP server.identity);
+}
+'''
+type = "recv"
+priority = 10
+dynamic = 1
+
+[response]
+name = "WAF_Response"
+httpstatuscode = 403
+httpresponse = "Forbidden"
+contenttype = "text/plain"
+content = "403 Forbidden"
+
+[prefetch]
+name = "WAF_Prefetch"
+statement = "!req.backend.is_shield"
+type = "PREFETCH"
+priority = 10

waflyctl.go

@@ -235,7 +235,7 @@ func Init(
 		fmt.Println("- waflogs", config.Waflog.Port)
 	*/
 	//now lets create a logging object
-	file, err := os.OpenFile(config.Logpath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0666)
+	file, err := os.OpenFile(config.Logpath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600)
 	if err != nil {
 		log.Fatalln("Failed to open log file", logFile, ":", err)
 	}

waflyctl.toml

@@ -1 +1 @@
-config_examples/waflyctl.fastly_soc_example.toml
+config_examples/waflyctl.toml.example