cclohmar/zoraxy-waf
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: plugin proxies to backend directly — no 284 leaking. WAF URL inspects, Backend URL receives allowed traffic

Browse source
This commit is contained in:
Claus Lohmar 2026-08-07 13:10:14 +00:00
parent d0f8b76154
commit 3b7af072a0
5 changed files with 69 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
config.go
View file

@ -12,6 +12,7 @@ import (
type Config struct { type Config struct {
Enabled bool `json:"enabled"` Enabled bool `json:"enabled"`
WAFURL string `json:"waf_url"` WAFURL string `json:"waf_url"`
BackendURL string `json:"backend_url"` // where to proxy allowed traffic
ReturnPort int `json:"return_port"` ReturnPort int `json:"return_port"`
HealthInterval int `json:"health_interval"` HealthInterval int `json:"health_interval"`
TimeoutMs int `json:"timeout_ms"` TimeoutMs int `json:"timeout_ms"`
@ -34,6 +35,7 @@ func defaultConfig() Config {
return Config{ return Config{
Enabled: false, Enabled: false,
WAFURL: "http://127.0.0.1:8080", WAFURL: "http://127.0.0.1:8080",
BackendURL: "http://127.0.0.1:80",
ReturnPort: 8080, ReturnPort: 8080,
HealthInterval: 5, HealthInterval: 5,
TimeoutMs: 500, TimeoutMs: 500,

3
main.go
View file

@ -100,6 +100,9 @@ func handleSaveConfig(w http.ResponseWriter, r *http.Request) {
if u := r.FormValue("waf_url"); u != "" { if u := r.FormValue("waf_url"); u != "" {
cfg.WAFURL = u cfg.WAFURL = u
} }
if u := r.FormValue("back_url"); u != "" {
cfg.BackendURL = u
}
if v := r.FormValue("return_port"); v != "" { if v := r.FormValue("return_port"); v != "" {
fmt.Sscanf(v, "%d", &cfg.ReturnPort) fmt.Sscanf(v, "%d", &cfg.ReturnPort)
} }

69
middleware.go
View file

@ -1,11 +1,12 @@
package main package main
import ( import (
"io"
"log" "log"
"net/http" "net/http"
"net/url"
"sync/atomic" "sync/atomic"
"time"
"zoraxy-firewall/zoraxy_plugin"
) )
var breaker = newCircuitBreaker() var breaker = newCircuitBreaker()
@ -30,12 +31,9 @@ func metricsSnapshot() map[string]interface{} {
func circuitStateStr(s CircuitState) string { func circuitStateStr(s CircuitState) string {
switch s { switch s {
case StateClosed: case StateClosed: return "closed"
return "closed" case StateOpen: return "open"
case StateOpen: case StateHalfOpen: return "half-open"
return "open"
case StateHalfOpen:
return "half-open"
} }
return "unknown" return "unknown"
} }
@ -46,23 +44,24 @@ func handleInspect(w http.ResponseWriter, r *http.Request) {
if !cfg.Enabled { if !cfg.Enabled {
atomic.AddUint64(&requestsBypassed, 1) atomic.AddUint64(&requestsBypassed, 1)
w.WriteHeader(int(zoraxy_plugin.ControlStatusCode_UNHANDLED)) proxyToBackend(w, r)
return return
} }
if breaker.State() == StateOpen { if breaker.State() == StateOpen {
atomic.AddUint64(&requestsBypassed, 1) atomic.AddUint64(&requestsBypassed, 1)
log.Printf("Firewall: breaker OPEN — fail-open, passing %s %s", r.Method, r.URL.Path) log.Printf("Firewall: breaker OPEN — fail-open, passing %s %s", r.Method, r.URL.Path)
w.WriteHeader(int(zoraxy_plugin.ControlStatusCode_UNHANDLED)) proxyToBackend(w, r)
return return
} }
// Inspect via WAF.
status, err := inspect(r) status, err := inspect(r)
if err != nil { if err != nil {
atomic.AddUint64(&requestsBypassed, 1) atomic.AddUint64(&requestsBypassed, 1)
log.Printf("Firewall: inspection error — fail-open: %v", err) log.Printf("Firewall: inspection error — fail-open: %v", err)
breaker.RecordFailure() breaker.RecordFailure()
w.WriteHeader(int(zoraxy_plugin.ControlStatusCode_UNHANDLED)) proxyToBackend(w, r)
return return
} }
@ -71,10 +70,54 @@ func handleInspect(w http.ResponseWriter, r *http.Request) {
if status == 403 { if status == 403 {
atomic.AddUint64(&requestsBlocked, 1) atomic.AddUint64(&requestsBlocked, 1)
log.Printf("Firewall: BLOCKED %s %s", r.Method, r.URL.Path) log.Printf("Firewall: BLOCKED %s %s", r.Method, r.URL.Path)
w.WriteHeader(int(zoraxy_plugin.ControlStatusCode_CAPTURED)) w.Header().Set("Content-Type", "text/html")
w.WriteHeader(403)
w.Write([]byte("<html><body><h1>403 Forbidden</h1><p>Blocked by Firewall</p></body></html>"))
return return
} }
// WAF allows — proxy to backend.
atomic.AddUint64(&requestsAllowed, 1) atomic.AddUint64(&requestsAllowed, 1)
w.WriteHeader(int(zoraxy_plugin.ControlStatusCode_UNHANDLED)) proxyToBackend(w, r)
}
// proxyToBackend forwards the request to Zoraxy's original upstream.
// The original target is passed by Zoraxy via the X-Zoraxy-Uri header.
func proxyToBackend(w http.ResponseWriter, r *http.Request) {
cfg := getConfig()
target, err := url.Parse(cfg.BackendURL)
if err != nil {
http.Error(w, "invalid backend URL", http.StatusInternalServerError)
return
}
proxyReq, err := http.NewRequestWithContext(r.Context(), r.Method, target.String()+r.URL.Path, r.Body)
if err != nil {
http.Error(w, "proxy error", http.StatusInternalServerError)
return
}
for key, vals := range r.Header {
for _, v := range vals {
proxyReq.Header.Add(key, v)
}
}
proxyReq.Header.Set("X-Forwarded-For", r.RemoteAddr)
client := &http.Client{Timeout: time.Duration(cfg.TimeoutMs) * time.Millisecond}
resp, err := client.Do(proxyReq)
if err != nil {
http.Error(w, "backend unreachable", http.StatusBadGateway)
return
}
defer resp.Body.Close()
for key, vals := range resp.Header {
for _, v := range vals {
w.Header().Add(key, v)
}
}
w.WriteHeader(resp.StatusCode)
io.Copy(w, resp.Body)
} }

2
web/app.js
View file

@ -5,6 +5,7 @@ function loadConfig() {
$('#fw-enabled').prop('checked', data.enabled); $('#fw-enabled').prop('checked', data.enabled);
$('#enabled-label').text(data.enabled ? 'Firewall Enabled' : 'Firewall Disabled'); $('#enabled-label').text(data.enabled ? 'Firewall Enabled' : 'Firewall Disabled');
$('#waf-url').val(data.waf_url); $('#waf-url').val(data.waf_url);
$('#back-url').val(data.backend_url);
$('#return-port').val(data.return_port); $('#return-port').val(data.return_port);
$('#health-interval').val(data.health_interval); $('#health-interval').val(data.health_interval);
$('#timeout-ms').val(data.timeout_ms); $('#timeout-ms').val(data.timeout_ms);
@ -32,6 +33,7 @@ function saveConfig() {
data: { data: {
enabled: $('#fw-enabled').is(':checked'), enabled: $('#fw-enabled').is(':checked'),
waf_url: $('#waf-url').val().trim(), waf_url: $('#waf-url').val().trim(),
back_url: $('#back-url').val().trim(),
return_port: $('#return-port').val(), return_port: $('#return-port').val(),
health_interval: $('#health-interval').val(), health_interval: $('#health-interval').val(),
timeout_ms: $('#timeout-ms').val() timeout_ms: $('#timeout-ms').val()

6
web/index.html
View file

@ -31,6 +31,12 @@
<small>The firewall application URL (e.g. Wallarm, ModSecurity, Coraza).</small> <small>The firewall application URL (e.g. Wallarm, ModSecurity, Coraza).</small>
</div> </div>
<div class="field">
<label for="back-url">Backend URL (allowed traffic)</label>
<input type="text" id="back-url" placeholder="http://10.1.1.10:8001">
<small>Traffic is proxied here when the WAF allows it.</small>
</div>
<div class="field"> <div class="field">
<label for="return-port">Return Port</label> <label for="return-port">Return Port</label>
<input type="number" id="return-port" placeholder="8080" min="1" max="65535"> <input type="number" id="return-port" placeholder="8080" min="1" max="65535">