sneak
d712bb1496
check / check (push) Waiting to run
docs/settings.md is now the one settings reference; the spec keeps the conventions, the off list and each group's requirements and reasons, and links to it for the per-setting entries. The endpoint list, the ban notes, the state file contents, the rule file format and the alert object likewise live in docs/ and are linked from the spec. The package list from the README's Design section joins "Architecture". The nine docs files are byte-identical to those on the README branch. Package comments that named "Alert webhook schema", "Request log" and "Metrics endpoint" for their field lists now name the docs files. Model: fable-5-1
32 lines
1.9 KiB
Markdown
32 lines
1.9 KiB
Markdown
# The Core Rule Set
|
|
|
|
The OWASP Core Rule Set 4.25.0 runs on each request after the rule files, unless
|
|
`SWWAF_WAF_MODE` is `off`. It reads the method, the URL with its query, and the
|
|
headers. Once `SWWAF_WAF_BODY_LIMIT` is set, it also reads a body that is form
|
|
data, multipart, JSON or XML. No answer is inspected. The settings are under
|
|
"Attack detection" in [`settings.md`](settings.md). The same section of
|
|
[`SPEC.md`](../SPEC.md) says why bodies are not read by default, and gives the
|
|
six changes `smallwebwaf` makes to the Core Rule Set, with the reason for each.
|
|
|
|
Each rule that matches adds to the request's score. A score at or over
|
|
`SWWAF_WAF_ANOMALY_THRESHOLD` is a match. A match is refused with `403` while
|
|
`SWWAF_WAF_MODE` is `block`, and let through while it is `detect`. Either way
|
|
the log line gives the rule ids and the score, and a `waf_block` alert is sent.
|
|
A request with more than 1000 query parameters or body fields adds 5 to its
|
|
score, since Coraza reads only the first 1000. The Core Rule Set inspects only a
|
|
request that every earlier check let through. It skips a path under
|
|
`SWWAF_WAF_EXEMPT_PATHS` and a client in `SWWAF_ALLOW_NETS`. An engine error on
|
|
a request forwards the request, and is logged and counted.
|
|
|
|
Body inspection suits apps whose forms carry no code. In front of a code forge
|
|
it refuses issue and comment text, wiki pages and files saved in the web editor
|
|
that hold shell commands or code. The log line names the rule ids, which
|
|
`SWWAF_WAF_DISABLED_RULES` can switch off. A body the Core Rule Set cannot parse
|
|
adds 5 to the score. So does a multipart body cut by the limit in the middle of
|
|
a part's header. The client has until `SWWAF_CLIENT_REQUEST_TIMEOUT` runs out to
|
|
send the part that is read. Any other body, such as a git push, reaches the app
|
|
uninspected.
|
|
|
|
[`gitea.md`](gitea.md) records what the Core Rule Set still refuses in front of
|
|
gitea, with and without body inspection.
|