readme

pkg/acquisition/modules/waf/README.md

@@ -0,0 +1,32 @@
+Ongoing poc for Coraza
+
+For config:
+
+coraza_inband.conf:
+```
+SecRuleEngine On
+SecRule ARGS:id "@eq 0" "id:1, phase:1,deny, status:403,msg:'Invalid id',log,auditlog"
+SecRequestBodyAccess On
+SecRule REQUEST_BODY "@contains password" "id:100, phase:2,deny, status:403,msg:'Invalid request body',log,auditlog"
+```
+
+
+coraza_outofband.conf:
+```
+SecRuleEngine On
+SecRule ARGS:id "@eq 2" "id:2, phase:1,deny, status:403,msg:'Invalid id',log,auditlog"
+SecRequestBodyAccess On
+SecRule REQUEST_BODY "@contains totolol" "id:100, phase:2,deny, status:403,msg:'Invalid request body',log,auditlog"
+```
+
+
+acquis.yaml :
+
+```
+listen_addr: 127.0.0.1
+listen_port: 4241
+path: /
+source: waf
+labels:
+  type: waf
+```