cebilon123 / waffle

Web Application Firewall, made in go.

WAFFLE

---

❗ The problem

Imagine, that you are a user who wants to play a game, or use a website on remote server, but something isn't right, the connection is so slow, and you don't know why. You are probably mad, because you can't watch your favorite cat videos and images. Anime is out of your reach as well, you are thinking about eating pizza from tasty Da Grasso 🐴 to make your day just a little bit better and better.

---

💚 The solution

You wrote to the website administrator to use Waffle, the open-source DDOS protector, the reverse proxy of future, the strongest defense of all, and it's free (and not nearly done at all)!

Documentation

This is github wiki's based documentation of the project (in progress):

• Documentation

Introduction

Probably you know about CloudFlare, every one knows, but this is a partially paid solution. As the open source community we are missing a real modular and open source Web Application Firewall that could be used in the place of CF. The project is huge, tho we are looking for the contributors.

How to run / Develop ?

Prerequisites

• Go 1.22+
• golangci-lint
• Npcap (windows)
• make (if windows, try using chocolatey)
• openssl (if windows, try using git bash)
• mockery

1. Create certificates and FS embed go file provider make certs_windows //: # (2. Execute docker compose up -d to create needed infrastructure)
2. Set environment variables before running the proxy:

Generate certificates

Execute make certs_windows and go through process. It should certs in the .cert directory.

Next steps

Important

Currently, the project can be only used with GO installed locally, but there is a plan to create usable binaries.

*How to run binaries? Currently there are 3 binaries:

• collector
• proxy
• tcpproxy (partially done)

The proxy is the core binary, which can be kind of used, to run it execute: go run ./cmd/proxy/main.go

Remember to add valid config to the ./cmd/proxy/config.yml file, looks something like this:

dns:
  - host: "google.localhost:8080"
    address: "https://google.com"
  - host: "100commitow.localhost:8080"
    address: "https://100commitow.pl"

rules:
  custom:
    - name: "request payload must contain at least one character and should contain at least one header"
      predicate: "p => LEN(p.payload) > 0 && LEN(p.headers) > 0"
    - name: "payload must be a json"
      predicate: "p => FORMAT(p.payload) == 'json'"

Planned features / Architecture

To bo honest, I'm learning how to write WAF from the scratch, so this part will be updated after a while.

• XSS protection (HTML + we can take a look on sql injection)
• DDOS protection

What I have learned?

• Neovim
• DDOS protection
• XSS /SQLI protection

Contribution

What do I need to know to help?

If you are looking to help to with a code contribution our project uses GO, k8s.

How can I do that?

Never made an open source contribution before? Wondering how contributions work in the in our project? Here's a quick rundown!

Find an issue that you are interested in addressing or a feature that you would like to add.

Fork the repository associated with the issue to your local GitHub organization. This means that you will have a copy of the repository under your-GitHub-username/repository-name.

Clone the repository to your local machine using git clone.

Create a new branch for your fix using git checkout -b branch-name-here.

Make the appropriate changes for the issue you are trying to address or the feature that you want to add.

Use git add insert-paths-of-changed-files-here to add the file contents of the changed files to the "snapshot" git uses to manage the state of the project, also known as the index.

Use git commit -m "Insert a short message of the changes made here" to store the contents of the index with a descriptive message.

Push the changes to the remote repository using git push origin branch-name-here.

Submit a pull request to the upstream repository.

Title the pull request with a short description of the changes made and the issue or bug number associated with your change. For example, you can title an issue like so "Added more log outputting to resolve #4352".

In the description of the pull request, explain the changes that you made, any issues you think exist with the pull request you made, and any questions you have for the maintainer. It's OK if your pull request is not perfect (no pull request is), the reviewer will be able to help you fix any problems and improve it!

Wait for the pull request to be reviewed by a maintainer.

Make changes to the pull request if the reviewing maintainer recommends them.

Celebrate your success after your pull request is merged! 🚀

Where can I go for help? If you need help, you can ask questions on our Discord: https://discord.gg/33azuUWnm4

What does the Code of Conduct mean for me?

Our Code of Conduct means that you are responsible for treating everyone on the project with respect and courtesy regardless of their identity. If you are the victim of any inappropriate behavior or comments as described in our Code of Conduct, we are here for you and will do the best to ensure that the abuser is reprimanded appropriately, per our code.

HTML injection are attacks agains the HTML tokenization algorithm, examples: Basically, we need to tokenize input and check attributes, tags against a set of rules

Links:

• A Comprehensive Examination of Cloudflare's IP-based Distributed Denial of Service Mitigation
• A Brief Study on The Evolution of Next Generation Firewall and Web Application Firewall
• SWAP: Mitigating XSS Attacks using a Reverse Proxy
• 

waffle's Issues

Add custom WAF contains rule

Sometimes we want to disqualify some kinds of payloads in our waf. This rule will help in that.

Add BPF provider

Context

Currently we have packet reading, and network interface provider tho it's problematic to listen for valid packets from network interfaces and protocols. To accomplish that we can use BPF filter

TODO

• add BPF filter configuration to the collector worker
• add yaml configuration to the collector worker

AC

• there is possibility to write the PBF filter in the config
• we can configure application from the config

Add support for ip addresses from headers

This is a email I've got:

hi, please add support ratelimit cf-connecting-ip? original visitor IP
address appears in an appended HTTP header called CF-Connecting-IP.

TLS fingerprinting research + implementation

Context:

There is an method founded by the Salesforce engineers called "TLS fingerprinting" which can be used to found out the exact OS, browser, client data while making the TLS Handshake.

TODO:

• found out how TLS fingerprint works
• add implementation of it to the application

AC:

• there is a rich comment with the exact information, articles and other resources about TLS fingerprint
• there is an implementation of the whole thing
• there is high test coverage in the newly written code

Comment:

I have been doing some research about the subject and in order to make it real and fully functional we need to somehow rewrite the server, in order to have access to all the data send in the TLS Handshake. Currently we have access to the method in the TLS config struct, which gives us access to the thing, but there aren't all the needed data about request in order to make it functional.

There are also already made implementation of the TLS Fingerprinting for the server side and client side in golang.

Add request data visualisation

Context:

Currently, there is no way to visualize what requests are coming through our WAF. At the very beginning, we need a frontend that simply visualizes the incoming requests.

It could be done as a list of incoming requests and some kind of graph.

TODO

• add a request visualization (currently we don't have any metrics gathering code, so this needs to be done as well)

AC

• we have an incoming request visualization
• there is high test coverage

Info

We could create our custom frontend i.e. in React, or we can try using Grafana, share some ideas here, and let's discuss 😄

YAML config

We need to have YAML config in order to configure domains and ip addresses.

Reverse proxy

We have TLS based server set up, but we are missing the initial functionality of reverse proxy.
We need to introduce redirect mechanism and the possibility to read possible redirections from config file.

TODO:

• reverse proxy logic
• possible redirect domain : address map from config and database

AC

• we have reverse proxy logic
• we have redirect domain : address mapping from config and database

How to test?

• execute unit tests
• try adding domain : address map to database or/and config

TLS introduction

We need to introduce TLS as the first layer of the defense. Basically, after its introduction, we will be able to validate client handshake which will be useful to guard applications from botnets and related attacks ie. DDOS

Refactor how config and certificates are being read

Context

Currently the config and the certificates are embedded in the main.go. It is good approach for now but it would be nice to refactor it, in order to make it simpler to set up and edit during the development.

TODO

• Refactor how the config and certificates are being read
• Add unit tests for the changes
• Fix other tests accordingly (if it's needed)

AC

• There is a new approach of reading the configs and certificates
• There are unit tests made for the changes and others are fixed

How to test?

• The pipeline should succeed
• Unit tests should pass
• WAF should read configs and certificates

MySQL database migrations

We need to have the possibility to create migrations to the database, we can also use GORM to simplify stuff in the beginning.

Add multi server architecture

In order to make it more scalable we need to add multi server architecture.

Add infra: dockerfile, terraform with k8s

Add XSS protection

We need to create an outline of the defense system, with the first defense: XSS protection

Add TCP proxy

Context:
We have http proxy, but we want to copy Cloudflare and their Spectrum service, which means that we need to have TCP reverse proxy.
(Later it could be used for the HTTP proxy as well)

TODO:

• Add simple outline of TCP reverse proxy
• Add unit tests

AC:

• we have functional TCP reverse proxy

Add DDOS protection