rebrand: zoraxy-waf → Firewall (generic inspection engine, not Wallarm-specific)

This commit is contained in:
Claus Lohmar 2026-08-01 06:48:59 +00:00
parent 7de515818e
commit efb6c813e7
9 changed files with 27 additions and 26 deletions

1
.gitignore vendored
View file

@ -20,3 +20,4 @@ Thumbs.db
# Temp # Temp
tmp/ tmp/
.tmp/ .tmp/
waf_config.json

View file

@ -9,7 +9,7 @@ import (
"time" "time"
) )
// MockWallarm is a test server that simulates a Wallarm node. // Mockinspection endpoint is a test server that simulates a inspection endpoint.
// Usage: go run mock_wallarm.go [--mode=allow|block|slow|flaky] // Usage: go run mock_wallarm.go [--mode=allow|block|slow|flaky]
// //
// Modes: // Modes:
@ -47,7 +47,7 @@ func main() {
port = p port = p
} }
log.Printf("Mock Wallarm node starting on :%s (mode=%s)", port, mode) log.Printf("Mock inspection endpoint starting on :%s (mode=%s)", port, mode)
if err := http.ListenAndServe(":"+port, nil); err != nil { if err := http.ListenAndServe(":"+port, nil); err != nil {
log.Fatal(err) log.Fatal(err)
} }

View file

@ -11,7 +11,7 @@ import (
type Config struct { type Config struct {
Enabled bool `json:"enabled"` Enabled bool `json:"enabled"`
NodeURL string `json:"node_url"` // e.g. http://192.168.1.50:8080 NodeURL string `json:"node_url"` // e.g. http://192.168.1.50:8080
ReturnPort int `json:"return_port"` // port for Wallarm async callbacks ReturnPort int `json:"return_port"` // port for inspection endpoint async callbacks
TimeoutMs int `json:"timeout_ms"` // inspection timeout in milliseconds TimeoutMs int `json:"timeout_ms"` // inspection timeout in milliseconds
} }

2
go.mod
View file

@ -1,3 +1,3 @@
module zoraxy-waf module zoraxy-firewall
go 1.21 go 1.21

12
main.go
View file

@ -7,7 +7,7 @@ import (
"log" "log"
"net/http" "net/http"
"zoraxy-waf/zoraxy_plugin" "zoraxy-firewall/zoraxy_plugin"
) )
//go:embed web/* //go:embed web/*
@ -17,11 +17,11 @@ func main() {
loadConfig() loadConfig()
spec := &zoraxy_plugin.IntroSpect{ spec := &zoraxy_plugin.IntroSpect{
ID: "zoraxy-waf", ID: "zoraxy-firewall",
Name: "Zoraxy WAF", Name: "Firewall",
Author: "Zoraxy Community", Author: "Zoraxy Community",
AuthorContact: "", AuthorContact: "",
Description: "Web Application Firewall — synchronous Wallarm inspection with circuit breaker and fail-open protection.", Description: "Web Application Firewall with circuit breaker and fail-open protection.",
URL: "", URL: "",
Type: zoraxy_plugin.PluginType_Router, // Type 0 — intercepts traffic Type: zoraxy_plugin.PluginType_Router, // Type 0 — intercepts traffic
VersionMajor: 1, VersionMajor: 1,
@ -57,7 +57,7 @@ func main() {
}, mux) }, mux)
uiRouter.AttachHandlerToMux(mux) uiRouter.AttachHandlerToMux(mux)
// --- Return port listener for Wallarm async callbacks (future) --- // --- Return port listener for inspection endpoint async callbacks (future) ---
cfg := getConfig() cfg := getConfig()
if cfg.ReturnPort > 0 { if cfg.ReturnPort > 0 {
go func() { go func() {
@ -120,7 +120,7 @@ func handleGetStats(w http.ResponseWriter, r *http.Request) {
} }
func handleReturnVerdict(w http.ResponseWriter, r *http.Request) { func handleReturnVerdict(w http.ResponseWriter, r *http.Request) {
// Future: Wallarm async callbacks arrive here. // Future: inspection endpoint async callbacks arrive here.
var resp InspectionResponse var resp InspectionResponse
if err := json.NewDecoder(r.Body).Decode(&resp); err != nil { if err := json.NewDecoder(r.Body).Decode(&resp); err != nil {
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "bad verdict"}) writeJSON(w, http.StatusBadRequest, map[string]string{"error": "bad verdict"})

View file

@ -6,7 +6,7 @@ import (
"net/http" "net/http"
"sync/atomic" "sync/atomic"
"zoraxy-waf/zoraxy_plugin" "zoraxy-firewall/zoraxy_plugin"
) )
var breaker = newCircuitBreaker() var breaker = newCircuitBreaker()

View file

@ -10,7 +10,7 @@ import (
"time" "time"
) )
// InspectionRequest is sent to the Wallarm node. // InspectionRequest is sent to the inspection endpoint.
type InspectionRequest struct { type InspectionRequest struct {
Method string `json:"method"` Method string `json:"method"`
URL string `json:"url"` URL string `json:"url"`
@ -22,16 +22,16 @@ type InspectionRequest struct {
BodySample []byte `json:"body_sample"` // first N bytes BodySample []byte `json:"body_sample"` // first N bytes
} }
// InspectionResponse is returned by the Wallarm node. // InspectionResponse is returned by the inspection endpoint.
type InspectionResponse struct { type InspectionResponse struct {
Verdict string `json:"verdict"` // "allow" or "block" Verdict string `json:"verdict"` // "allow" or "block"
Reason string `json:"reason,omitempty"` Reason string `json:"reason,omitempty"`
Score int `json:"score,omitempty"` Score int `json:"score,omitempty"`
} }
const maxBodySample = 4096 // only send first 4KB to Wallarm const maxBodySample = 4096 // only send first 4KB to inspection endpoint
// inspect sends a synchronous inspection request to the Wallarm node. // inspect sends a synchronous inspection request to the inspection endpoint.
// Returns nil if allowed, or an error describing the block reason. // Returns nil if allowed, or an error describing the block reason.
func inspect(r *http.Request) (*InspectionResponse, error) { func inspect(r *http.Request) (*InspectionResponse, error) {
c := getConfig() c := getConfig()
@ -70,13 +70,13 @@ func inspect(r *http.Request) (*InspectionResponse, error) {
resp, err := client.Post(c.NodeURL+"/inspect", "application/json", bytes.NewReader(body)) resp, err := client.Post(c.NodeURL+"/inspect", "application/json", bytes.NewReader(body))
if err != nil { if err != nil {
return nil, fmt.Errorf("wallarm node unreachable: %w", err) return nil, fmt.Errorf("inspection node unreachable: %w", err)
} }
defer resp.Body.Close() defer resp.Body.Close()
var inspResp InspectionResponse var inspResp InspectionResponse
if err := json.NewDecoder(resp.Body).Decode(&inspResp); err != nil { if err := json.NewDecoder(resp.Body).Decode(&inspResp); err != nil {
return nil, fmt.Errorf("decode wallarm response: %w", err) return nil, fmt.Errorf("decode inspection response: %w", err)
} }
log.Printf("WAF: %s %s → %s (score=%d reason=%s)", log.Printf("WAF: %s %s → %s (score=%d reason=%s)",

View file

@ -1,9 +1,9 @@
// Zoraxy WAF — config panel // Firewall — config panel
function loadConfig() { function loadConfig() {
$.get('./api/config', function (data) { $.get('./api/config', function (data) {
$('#waf-enabled').prop('checked', data.enabled); $('#waf-enabled').prop('checked', data.enabled);
$('#enabled-label').text(data.enabled ? 'WAF Enabled' : 'WAF Disabled'); $('#enabled-label').text(data.enabled ? 'Firewall Enabled' : 'Firewall Disabled');
$('#node-url').val(data.node_url); $('#node-url').val(data.node_url);
$('#return-port').val(data.return_port); $('#return-port').val(data.return_port);
$('#timeout-ms').val(data.timeout_ms); $('#timeout-ms').val(data.timeout_ms);
@ -47,7 +47,7 @@ function saveConfig() {
} }
$('#waf-enabled').on('change', function () { $('#waf-enabled').on('change', function () {
$('#enabled-label').text(this.checked ? 'WAF Enabled' : 'WAF Disabled'); $('#enabled-label').text(this.checked ? 'Firewall Enabled' : 'Firewall Disabled');
}); });
$('#save-btn').on('click', saveConfig); $('#save-btn').on('click', saveConfig);

View file

@ -4,13 +4,13 @@
<meta charset="UTF-8"> <meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta name="zoraxy.csrf.Token" content="{{.csrfToken}}"> <meta name="zoraxy.csrf.Token" content="{{.csrfToken}}">
<title>Zoraxy WAF</title> <title>Firewall</title>
<link rel="stylesheet" href="./style.css"> <link rel="stylesheet" href="./style.css">
</head> </head>
<body> <body>
<header> <header>
<h1>Zoraxy WAF</h1> <h1>Firewall</h1>
<p>Web Application Firewall with Wallarm inspection.</p> <p>Web Application Firewall — inspect traffic against a remote inspection engine.</p>
</header> </header>
<main> <main>
@ -22,11 +22,11 @@
<input type="checkbox" id="waf-enabled"> <input type="checkbox" id="waf-enabled">
<span class="slider"></span> <span class="slider"></span>
</label> </label>
<span id="enabled-label">WAF Disabled</span> <span id="enabled-label">Firewall Disabled</span>
</div> </div>
<div class="field"> <div class="field">
<label for="node-url">Wallarm Node URL</label> <label for="node-url">Inspection Endpoint URL</label>
<input type="text" id="node-url" placeholder="http://192.168.1.50:8080"> <input type="text" id="node-url" placeholder="http://192.168.1.50:8080">
</div> </div>
@ -51,7 +51,7 @@
<span id="circuit-state" class="stat-value">--</span> <span id="circuit-state" class="stat-value">--</span>
</div> </div>
<div class="stat-row"> <div class="stat-row">
<span class="stat-label">WAF Status:</span> <span class="stat-label">Status:</span>
<span id="waf-status" class="stat-value">--</span> <span id="waf-status" class="stat-value">--</span>
</div> </div>
<div class="stat-row"> <div class="stat-row">