tcjlj/OpenFlare
1
0
Fork 0
mirror of https://github.com/Rain-kl/OpenFlare.git synced 2026-10-07 08:06:37 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(waf): correct whitelist logic to bypass and add config/IP-group edit broadcasts

Browse Source 
- Transition WAF whitelist filter from strict block-on-miss to bypass-on-hit logic

- Hook up broadcastIPGroupToAgents to CreateIPGroup and UpdateIPGroup WAF logics

- Hook up BroadcastActiveConfig to PublishConfigVersion and ActivateConfigVersion version logics

- Update WAF Lua tests in manager_test.go
This commit is contained in:
ryan
2026-06-26 20:47:30 +08:00
parent 49eae80c78
commit b89dc9ec7e
6 changed files with 42 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/apps/agent/nginx/manager_test.go
+5 -8
View File
@@ -699,15 +699,12 @@ func TestManagedPowLuaFilesUseInternalChallengeFlow(t *testing.T) {
}
}
func TestManagedWAFLuaTreatsWhitelistAsAllowlist(t *testing.T) {
if !strings.Contains(openRestyWAFRuntimeLua, "local function first_allowlist_group(groups)") {
t.Fatal("expected waf runtime to detect allowlist rule groups")
func TestManagedWAFLuaTreatsWhitelistAsBypass(t *testing.T) {
if !strings.Contains(openRestyWAFRuntimeLua, "if ip_matches(group.ip_whitelist, ip)") {
t.Fatal("expected waf runtime to bypass request when ip matches whitelist")
}
if !strings.Contains(openRestyWAFRuntimeLua, "local allowlist_group = first_allowlist_group(groups)") {
t.Fatal("expected waf runtime to enter allowlist mode when whitelist rules exist")
}
if !strings.Contains(openRestyWAFRuntimeLua, "return exit_with_group(allowlist_group)") {
t.Fatal("expected waf runtime to block requests that miss configured whitelists")
if strings.Contains(openRestyWAFRuntimeLua, "first_allowlist_group") {
t.Fatal("expected waf runtime not to block requests that miss configured whitelists")
}
}