expresser

<!DOCTYPE html> <html> <head> <title>firewall.coffee</title> <meta http-equiv="content-type" content="text/html; charset=UTF-8"> <link rel="stylesheet" media="all" href="public/stylesheets/normalize.css" /> <link rel="stylesheet" media="all" href="docco.css" /> </head> <body> <div class="container"> <div class="page"> <div class="header"> <h1>firewall.coffee</h1> <div class="toc"> <h3>Table of Contents</h3> <ol> <li> <a class="source" href="index.html"> index.coffee </a> </li> <li> <a class="source" href="app.html"> app.coffee </a> </li> <li> <a class="source" href="cron.html"> cron.coffee </a> </li> <li> <a class="source" href="database.html"> database.coffee </a> </li> <li> <a class="source" href="downloader.html"> downloader.coffee </a> </li> <li> <a class="source" href="events.html"> events.coffee </a> </li> <li> <a class="source" href="firewall.html"> firewall.coffee </a> </li> <li> <a class="source" href="imaging.html"> imaging.coffee </a> </li> <li> <a class="source" href="logger.html"> logger.coffee </a> </li> <li> <a class="source" href="mailer.html"> mailer.coffee </a> </li> <li> <a class="source" href="settings.html"> settings.coffee </a> </li> <li> <a class="source" href="sockets.html"> sockets.coffee </a> </li> <li> <a class="source" href="utils.html"> utils.coffee </a> </li> </ol> </div> </div> <h2 id="expresser-firewall">EXPRESSER FIREWALL</h2> Firewall to protect the server against well known HTTP and socket attacks. ATTENTION! The Firewall module is started automatically by the App module. If you wish to disable it, set <code>Settings.firewall.enabled</code> to false.  <div class='highlight'><pre>class Firewall async = require "async" lodash = require "lodash" logger = require "./logger.coffee" moment = require "moment" settings = require "./settings.coffee" sockets = "./sockets.coffee" util = require "util" utils = require "./utils.coffee"</pre></div> Holds a collection of blacklisted IPs. <div class='highlight'><pre> blacklist: null</pre></div> <h2 id="protection-patterns">PROTECTION PATTERNS</h2> <div class='highlight'><pre> patterns = {} patterns.lfi = [/\.\.\//] # root path match patterns.sql = [/((\%3D)|(=))[^\n]*((\%27)|(\')|(\-\-)|(\%3B)|(;))/i, # SQL meta chars /\w*((\%27)|(\'))((\%6F)|o|(\%4F))((\%72)|r|(\%52))/i, # simple SQL injection /((\%27)|(\'))union/i, # union SQL injection /exec(\s|\+)+(s|x)p\w+/i, # MSSQL specific injection /UNION(?:\s+ALL)?\s+SELECT/i] # union select SQL injection patterns.xss = [/((\%3C)|<)((\%2F)|\/)*[a-z0-9\%]+((\%3E)|>)/i, # simple XSS /((\%3C)|<)((\%69)|i|(\%49))((\%6D)|m|(\%4D))((\%67)|g|(\%47))[^\n]+((\%3E)|>)/i, # img src XSS /((\%3C)|<)[^\n]+((\%3E)|>)/i] # all other XSS</pre></div> <h2 id="init">INIT</h2> Init the firewall. This must be called AFTER the web app has started. @param [Object] Firewall init options. @option options [Object] server The Express server object to bind to. <div class='highlight'><pre> init: (options, callback) => options = {server: options} if not options.server? env = process.env</pre></div> Server is mandatory! <div class='highlight'><pre> if not options.server? logger.error "Firewall.init", "App server is invalid. Abort!" return</pre></div> Bind HTTP protection. <div class='highlight'><pre> if settings.firewall.httpPatterns isnt "" and env.NODE_ENV isnt "test" options.server.use @checkHttpRequest logger.info "Firewall.init", "Protect HTTP requests."</pre></div> Bind sockets protection. <div class='highlight'><pre> if settings.firewall.socketPatterns isnt "" and env.NODE_ENV isnt "test" logger.info "Firewall.init", "Protect Socket requests." @blacklist = {}</pre></div> <h2 id="http-protection">HTTP PROTECTION</h2> Check HTTP requests against common web attacks. <div class='highlight'><pre> checkHttpRequest: (req, res, next) => ip = utils.getClientIP req</pre></div> If IP is blaclisted, end the request immediatelly. <div class='highlight'><pre> if @checkBlacklist ip @sendAccessDenied res, "Blacklisted"</pre></div> Helper method to check HTTP patterns. <div class='highlight'><pre> check = (p) => @checkHttpPattern p, req, res</pre></div> Set valid and checl all enabled patterns. <div class='highlight'><pre> valid = true enabledPatterns = settings.firewall.httpPatterns.split "," for pattern in enabledPatterns valid = false if check(pattern)</pre></div> Only proceed if request is valid. <div class='highlight'><pre> next() if valid</pre></div> Test the request against the enabled protection patterns. <div class='highlight'><pre> checkHttpPattern: (module, req, res) => p = patterns[module].length - 1 while p >= 0 if patterns[module][p].test req.url @handleHttpAttack "#{module}", p, req, res return true --p return false</pre></div> Handle attacks. <div class='highlight'><pre> handleHttpAttack: (module, pattern, req, res) => ip = utils.getClientIP req @logAttack module, pattern, req.url, ip @sendAccessDenied res</pre></div> <h2 id="sockets-protection">SOCKETS PROTECTION</h2> Check Socket requests against common web attacks. <div class='highlight'><pre> checkSocketRequest: (socket, message, next) => ip = utils.getClientIP req</pre></div> If IP is blaclisted, end the request immediatelly. <div class='highlight'><pre> if @checkBlacklist ip @sendAccessDenied socket, "Blacklisted"</pre></div> Helper method to check socket patterns. <div class='highlight'><pre> check = (p) => @checkSocketPattern p, socket, util.inspect(message)</pre></div> Set valid and checl all enabled patterns. <div class='highlight'><pre> valid = true enabledPatterns = settings.firewall.socketPatterns.split "," for pattern in enabledPatterns valid = false if check(pattern)</pre></div> Only proceed if request is valid. <div class='highlight'><pre> next() if valid</pre></div> Test the request against the enabled protection patterns. <div class='highlight'><pre> checkSocketPattern: (module, socket, message) => p = patterns[module].length - 1 while p >= 0 if patterns[module][p].test message @handleSocketAttack "#{module}", p, socket, message return --p</pre></div> Handle attacks. <div class='highlight'><pre> handleSocketAttack: (module, pattern, socket, message) => ip = utils.getClientIP socket @logAttack module, pattern, message, ip @sendAccessDenied socket</pre></div> <h2 id="blacklist-methods">BLACKLIST METHODS</h2> Reset the blacklist object. <div class='highlight'><pre> clearBlacklist: => @blacklist = {}</pre></div> Check if the specified IP is blacklisted. <div class='highlight'><pre> checkBlacklist: (ip) => bl = @blacklist[ip] if not bl? return false</pre></div> Check if record has expired. <div class='highlight'><pre> if bl.expires < moment() delete @blacklist[ip] return false</pre></div> Increase the blacklist count, and increase the expiry date in case it has reached the max retries. <div class='highlight'><pre> bl.count = bl.count + 1 if bl.count >= settings.firewall.blacklistMaxRetries bl.expires = moment().add "s", settings.firewall.blacklistLongExpires return true</pre></div> Add the specified IP to the blacklist. <div class='highlight'><pre> addToBlacklist: (ip) => bl = @blacklist[ip] bl = {} if not bl?</pre></div> Set blacklist object. <div class='highlight'><pre> bl.expires = moment().add "s", settings.firewall.blacklistExpires bl.count = 1 @blacklist[ip] = bl</pre></div> <h2 id="helper-methods">HELPER METHODS</h2> Send an access denied and end the request in case it wasn’t authorized. <div class='highlight'><pre> sendAccessDenied: (obj, message) => message = "Access denied" if not message?</pre></div> Set status and message. <div class='highlight'><pre> obj.status(403) if obj.status? and not obj.headerSent obj.send(message) if obj.send?</pre></div> Disconnect or end? <div class='highlight'><pre> if obj.disconnect? return obj.disconnect() else return obj.end()</pre></div> Log attacks. <div class='highlight'><pre> logAttack: (module, pattern, resource, ip) => logger.warn "ATTACK DETECTED!", module, pattern, resource, "From #{ip}"</pre></div> <h2 id="singleton-implementation">Singleton implementation</h2> <div class='highlight'><pre>Firewall.getInstance = -> @instance = new Firewall() if not @instance? return @instance module.exports = exports = Firewall.getInstance()</pre></div> <div class="fleur">h</div> </div> </div> </body> </html>