WAF

# NGINX + ModSecurity (OWASP CRS) 설정
# 오픈소스 WAF 구성

# === modsecurity.conf (메인 설정) ===
SecRuleEngine On  # WAF 활성화 (DetectionOnly로 테스트 가능)

# 요청 바디 처리
SecRequestBodyAccess On
SecRequestBodyLimit 13107200  # 12.5MB
SecRequestBodyNoFilesLimit 131072  # 128KB (파일 제외)

# 응답 바디 처리 (선택)
SecResponseBodyAccess Off

# 감사 로그 설정
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"  # 4xx, 5xx 응답 로깅 (404 제외)
SecAuditLogParts ABIJDEFHZ
SecAuditLogType Serial
SecAuditLog /var/log/modsec_audit.log

# 디버그 로그
SecDebugLog /var/log/modsec_debug.log
SecDebugLogLevel 0  # 프로덕션: 0, 디버깅: 3-9

# 기본 액션 설정
SecDefaultAction "phase:1,deny,status:403,log"

# === OWASP CRS 규칙 로드 ===
Include /etc/nginx/modsecurity/crs-setup.conf
Include /etc/nginx/modsecurity/rules/*.conf

# === 커스텀 규칙 ===

# SQL 인젝션 강화 탐지
SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_HEADERS \
    "@rx (?i)(?:select|insert|update|delete|drop|union|exec)\s+" \
    "id:100001,\
     phase:2,\
     deny,\
     status:403,\
     log,\
     msg:'SQL Injection Attempt',\
     tag:'OWASP_CRS',\
     tag:'attack-sqli'"

# XSS 강화 탐지
SecRule ARGS|ARGS_NAMES|REQUEST_BODY \
    "@rx (?i)]*>|javascript:|on\w+\s*=" \
    "id:100002,\
     phase:2,\
     deny,\
     status:403,\
     log,\
     msg:'XSS Attack Attempt',\
     tag:'attack-xss'"

# 경로 탐색 공격 방어
SecRule REQUEST_URI|ARGS \
    "@rx (?:\.\.[\\/]|\.\.%2f|\.\.%5c)" \
    "id:100003,\
     phase:1,\
     deny,\
     status:403,\
     log,\
     msg:'Path Traversal Attempt'"

# 특정 User-Agent 차단 (스캐너, 봇)
SecRule REQUEST_HEADERS:User-Agent \
    "@rx (?i)(sqlmap|nikto|nmap|masscan|havij|acunetix)" \
    "id:100004,\
     phase:1,\
     deny,\
     status:403,\
     log,\
     msg:'Security Scanner Detected'"

# API 엔드포인트별 커스텀 규칙
SecRule REQUEST_URI "@beginsWith /api/admin" \
    "id:100005,\
     phase:1,\
     chain"
    SecRule REMOTE_ADDR "!@ipMatch 10.0.0.0/8,192.168.0.0/16" \
        "deny,\
         status:403,\
         log,\
         msg:'Admin API access from non-internal IP'"

# === nginx.conf 설정 ===
# http {
#     modsecurity on;
#     modsecurity_rules_file /etc/nginx/modsecurity/modsecurity.conf;
#
#     server {
#         listen 443 ssl;
#         server_name example.com;
#
#         # WAF 적용
#         modsecurity on;
#
#         location / {
#             proxy_pass http://backend;
#         }
#
#         # 특정 경로 WAF 제외 (예: 파일 업로드)
#         location /api/upload {
#             modsecurity off;  # 또는 modsecurity_rules 'SecRuleRemoveById 100001';
#             proxy_pass http://backend;
#         }
#     }
# }

# === 규칙 제외 (오탐 처리) ===
# 특정 URI에서 특정 규칙 제외
SecRule REQUEST_URI "@beginsWith /api/webhook" \
    "id:100010,\
     phase:1,\
     pass,\
     nolog,\
     ctl:ruleRemoveById=942100"  # 특정 SQLi 규칙 제외

// Express.js 애플리케이션 레벨 보안 (WAF 보완)
// WAF와 함께 사용하는 애플리케이션 계층 방어

const express = require('express');
const helmet = require('helmet');
const rateLimit = require('express-rate-limit');
const slowDown = require('express-slow-down');
const hpp = require('hpp');
const xss = require('xss-clean');
const mongoSanitize = require('express-mongo-sanitize');

const app = express();

// 1. HTTP 헤더 보안 (Helmet)
app.use(helmet({
    contentSecurityPolicy: {
        directives: {
            defaultSrc: ["'self'"],
            scriptSrc: ["'self'", "'strict-dynamic'"],
            styleSrc: ["'self'", "'unsafe-inline'"],
            imgSrc: ["'self'", "data:", "https:"],
            connectSrc: ["'self'"],
            fontSrc: ["'self'"],
            objectSrc: ["'none'"],
            mediaSrc: ["'self'"],
            frameSrc: ["'none'"],
        },
    },
    crossOriginEmbedderPolicy: true,
    crossOriginOpenerPolicy: true,
    crossOriginResourcePolicy: { policy: "same-site" },
    dnsPrefetchControl: { allow: false },
    frameguard: { action: "deny" },
    hidePoweredBy: true,
    hsts: { maxAge: 31536000, includeSubDomains: true, preload: true },
    ieNoOpen: true,
    noSniff: true,
    referrerPolicy: { policy: "strict-origin-when-cross-origin" },
    xssFilter: true,
}));

// 2. Rate Limiting (DDoS, Brute Force 방어)
const limiter = rateLimit({
    windowMs: 15 * 60 * 1000,  // 15분
    max: 100,                   // IP당 100 요청
    standardHeaders: true,
    legacyHeaders: false,
    message: {
        error: 'Too many requests',
        retryAfter: '15 minutes'
    },
    // Redis store 사용 권장 (클러스터 환경)
    // store: new RedisStore({ client: redisClient }),
});
app.use('/api/', limiter);

// 로그인 엔드포인트 강화된 Rate Limit
const loginLimiter = rateLimit({
    windowMs: 60 * 60 * 1000,  // 1시간
    max: 5,                     // IP당 5회 시도
    skipSuccessfulRequests: true,
    message: { error: 'Too many login attempts. Try again in 1 hour.' }
});
app.use('/api/auth/login', loginLimiter);

// 3. Slow Down (점진적 지연)
const speedLimiter = slowDown({
    windowMs: 15 * 60 * 1000,
    delayAfter: 50,    // 50번째 요청 후
    delayMs: (hits) => hits * 100,  // 점진적 지연 증가
    maxDelayMs: 2000,
});
app.use('/api/', speedLimiter);

// 4. HTTP Parameter Pollution 방어
app.use(hpp());

// 5. XSS 필터링 (입력 새니타이징)
app.use(xss());

// 6. NoSQL Injection 방어 (MongoDB)
app.use(mongoSanitize({
    replaceWith: '_',
    onSanitize: ({ req, key }) => {
        console.warn(`[SECURITY] Sanitized key: ${key} from ${req.ip}`);
    }
}));

// 7. 요청 바디 크기 제한
app.use(express.json({ limit: '10kb' }));
app.use(express.urlencoded({ extended: true, limit: '10kb' }));

// 8. 커스텀 보안 미들웨어
const securityMiddleware = (req, res, next) => {
    // SQL Injection 패턴 탐지
    const sqlPatterns = /(\b(SELECT|INSERT|UPDATE|DELETE|DROP|UNION|EXEC)\b)/gi;
    const body = JSON.stringify(req.body);
    const query = JSON.stringify(req.query);

    if (sqlPatterns.test(body) || sqlPatterns.test(query)) {
        console.warn(`[WAF-APP] SQL Injection attempt from ${req.ip}`);
        return res.status(403).json({ error: 'Forbidden request pattern' });
    }

    // Path Traversal 탐지
    if (req.url.includes('..') || req.url.includes('%2e%2e')) {
        console.warn(`[WAF-APP] Path Traversal attempt from ${req.ip}`);
        return res.status(403).json({ error: 'Forbidden request pattern' });
    }

    next();
};
app.use(securityMiddleware);

// 9. 요청 로깅 (Threat Hunting용)
const requestLogger = (req, res, next) => {
    const logData = {
        timestamp: new Date().toISOString(),
        method: req.method,
        url: req.url,
        ip: req.ip,
        userAgent: req.headers['user-agent'],
        contentLength: req.headers['content-length'],
    };

    // 의심스러운 User-Agent 플래그
    const suspiciousAgents = ['sqlmap', 'nikto', 'nmap', 'curl', 'python-requests'];
    if (suspiciousAgents.some(agent =>
        logData.userAgent?.toLowerCase().includes(agent))) {
        logData.suspicious = true;
    }

    console.log('[REQUEST]', JSON.stringify(logData));
    next();
};
app.use(requestLogger);

// 10. 에러 핸들러 (정보 노출 방지)
app.use((err, req, res, next) => {
    console.error('[ERROR]', err.stack);

    // 프로덕션에서는 상세 에러 노출 금지
    const message = process.env.NODE_ENV === 'production'
        ? 'Internal Server Error'
        : err.message;

    res.status(err.status || 500).json({
        error: message,
        requestId: req.id  // 추적용 ID
    });
});

app.listen(3000);