Skip to main content
Version: Next

Waf Plugin

Description#

  • Waf is the core implementation of gateway to realize firewall function for network traffic.

Plugin Setting#

Please refer to the deployment document, choose a way to start shenyu-admin. For example, through Local Deployment to start the Apache ShenYu management system.

  • In shenyu-admin BasicConfig --> plugin -> waf set to enable.If you don't want to use this function, please disable this plugin in the shenyu-admin.

  • Add configuration mode in plugin editing.

{"model":"black"}# model can be 'black' or 'mixed'# The default mode is blacklist mode; If setting is mixed, it will be mixed mode. We will explain it specifically below.

Add Dependency#

  • Introducing waf dependency in the pom.xml of the gateway.
  <!-- apache shenyu waf plugin start-->  <dependency>      <groupId>org.apache.shenyu</groupId>      <artifactId>shenyu-spring-boot-starter-plugin-waf</artifactId>      <version>${project.version}</version>  </dependency>  <!-- apache shenyu waf plugin end-->

Waf Plugin Configuration#

For more instructions on selector and rule configuration, please refer to: Selector And Rule Config, here only some fields are introduced.

Waf plugin rule configuration page:

For requests that are denied access by Waf , the response header status code is: 403.

Black Model#

  • When model is set to black mode, only the matched traffic will execute the rejection policy, and the unmatched traffic will be skipped directly.
  • The Handler feild in the rule configuration is invalid and can be configured to be empty.

Mixed Model#

  • When model is set to mixed mode, all traffic will pass through waf plugin. For different matching traffic, users can set whether to reject or pass.

  • The Handler feild in the rule configuration must be configured:

    • permission: The handle logic that matches the rule. reject: deny access, allow: allow access.

    • statusCode: When access is denied, the value of the code field in the response body. Will not modify the status code of the response header.

      e.g.：statusCode=10001，The rejected response body is :

      {"code":10001,"message":"You are forbidden to visit"}

Situation#

  • Waf is also the pre-plugin of ShenYu, which is mainly used to intercept illegal requests or exception requests and give relevant rejection policies.
  • When faced with replay attacks, you can intercept illegal ip and host, and set reject strategy according to matched ip or host.
  • How to determine ip and host, please refer to: parsing-ip-and-host