secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-29 13:59:40 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

fix(waf): whitelist LAN/RFC1918 so operators are never WAF-banned

Browse Source 
The mitmproxy WAF whitelist was an exact-match set of two IPs, so a LAN
operator whose request matched a rule (e.g. a logout) hit the 3-strikes ban
with no bypass. Make the whitelist CIDR-aware and trust loopback + RFC1918
(LAN + internal LXC bridge). The WAF still inspects external traffic. Already
applied live in the mitmproxy LXC.
This commit is contained in:
CyberMind-FR 2026-05-29 07:00:10 +02:00
parent b43a67b098
commit 0bf6789195
1 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
packages/secubox-mitmproxy/addons/secubox_waf.py
View File

@ -26,6 +26,26 @@ THREATS_LOG = Path("/data/mitmproxy/logs/waf-threats.log")
STATS_FILE = Path("/data/mitmproxy/logs/waf-stats.json") STATS_FILE = Path("/data/mitmproxy/logs/waf-stats.json")
CDN_CONFIG_FILE = Path("/data/mitmproxy/cdn-config.json") CDN_CONFIG_FILE = Path("/data/mitmproxy/cdn-config.json")
WHITELIST = {"127.0.0.1", "192.168.255.1"} WHITELIST = {"127.0.0.1", "192.168.255.1"}
# Trusted networks bypass the WAF entirely: loopback + RFC1918 (the LAN and the
# internal LXC bridge). The WAF protects against EXTERNAL probes; LAN operators
# must never be banned (e.g. a logout request matching a rule). CIDR-aware.
import ipaddress as _ipaddr
_WL_NETS = []
for _c in ("127.0.0.0/8", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "::1/128", "fc00::/7"):
try:
_WL_NETS.append(_ipaddr.ip_network(_c))
except ValueError:
pass
def _is_whitelisted(ip):
if ip in WHITELIST:
return True
try:
addr = _ipaddr.ip_address(ip)
except ValueError:
return False
return any(addr in net for net in _WL_NETS)
STATS_SAVE_INTERVAL = 100 # Save stats every N requests STATS_SAVE_INTERVAL = 100 # Save stats every N requests
# CDN Options (loaded from cdn-config.json) # CDN Options (loaded from cdn-config.json)
@ -757,7 +777,7 @@ class SecuBoxWAF:
client_ip = get_real_client_ip(flow) client_ip = get_real_client_ip(flow)
# Skip whitelist # Skip whitelist
if client_ip in WHITELIST: if _is_whitelisted(client_ip):
if host in self.routes: if host in self.routes:
backend_ip, backend_port = self.routes[host] backend_ip, backend_port = self.routes[host]
original_host = flow.request.headers.get("Host", host) original_host = flow.request.headers.get("Host", host)