Skip to content

Commit 3b0366c

Browse files
ADubhlaoichADubhlaoich
committed
Merge branch 'waf/refactor' of github.com:nginx/documentation into waf/refactor
2 parents 3141690 + 8d9b591 commit 3b0366c

File tree

3 files changed

+290
-2
lines changed

3 files changed

+290
-2
lines changed

‎content/includes/waf/table-policy-features.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,11 @@
1515
| [Evasion techniques]({{< ref "/waf/policies/evasion-techniques.md" >}}) | All evasion techniques are enabled by default, and can be disabled individually. These include directory traversal, bad escaped characters and more. |
1616
| [gRPC protection]({{< ref "/waf/policies/evasion-techniques.md" >}}) | gRPC protection detects malformed content, parses well-formed content, and extracts the text fields for detecting attack signatures and disallowed meta-characters. In addition, it enforces size restrictions and prohibition of unknown fields. The Interface Definition Language (IDL) files for the gRPC API must be attached to the profile. gRPC protection can be on unary or bidirectional traffic. |
1717
| [HTTP compliance]() | All HTTP protocol compliance checks are enabled by default except for GET with body and POST without body. It is possible to enable any of these two. Some of the checks enabled by default can be disabled, but others, such as bad HTTP version and null in request are performed by the NGINX parser and NGINX App Protect WAF only reports them. These checks cannot be disabled. |
18-
| [IP address lists]() | Organize lists of allowed and forbidden IP addresses across several lists with common attributes. |
18+
| [IP address lists]({{< ref "/waf/policies/ip-address-lists.md" >}}) | Organize lists of allowed and forbidden IP addresses across several lists with common attributes. |
1919
| [IP intelligence]({{< ref "/waf/policies/ip-intelligence.md" >}}) | Configure the IP Intelligence feature to customize enforcement based on the source IP of the request, limiting access from IP addresses with questionable reputation. |
2020
| [Parameter parsing]() | Support only auto-detect parameter value type and acts according to the result: plain alphanumeric string, XML or JSON. |
2121
| [Sensitive parameters]() | The default policy masks the “password” parameter in the security log, and can be customized for more |
22-
| [Server technology signatures]() | Support adding signatures per added server technology. |
22+
| [Server technology signatures]({{< ref "/waf/policies/server-technology-signatures.md" >}}) | Support adding signatures per added server technology. |
2323
| [Threat campaigns]({{< ref "/waf/policies/threat-campaigns.md" >}}) | These are patterns that detect all the known attack campaigns. They are very accurate and have almost no false positives, but are very specific and do not detect malicious traffic that is not part of those campaigns. The default policy enables threat campaigns but it is possible to disable it through the respective violation. |
2424
| [User-defined HTTP headers]({{< ref "/waf/policies/user-headers.md" >}}) | Handling headers as a special part of requests |
2525
| [XFF trusted headers]({{< ref "/waf/policies/xff-headers.md" >}}) | Disabled by default, and can accept an optional list of custom XFF headers. |

‎content/waf/policies/ip-address-lists.md‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
---
2+
title: IP Address Lists
3+
weight: 1600
4+
toc: true
5+
nd-content-type: reference
6+
nd-product: NAP-WAF
7+
nd-docs: DOCS-000
8+
---
9+
10+
IP address lists are a feature that let you organize allowed and forbidden IP addresses into reusable lists with common attributes.
11+
12+
They make it possible to apply specific policy settings to incoming requests based on the source IP address.
13+
14+
Each IP address list includes:
15+
- A unique name
16+
- An enforcement type (`always`, `never`, or `policy-default`)
17+
- A list of IP addresses
18+
19+
Here is an example of a declarative policy using an IP address lists configuration:
20+
21+
```json
22+
{
23+
"policy": {
24+
"name": "IpGroups_policy",
25+
"template": {
26+
"name": "POLICY_TEMPLATE_NGINX_BASE"
27+
},
28+
"applicationLanguage": "utf-8",
29+
"caseInsensitive": false,
30+
"enforcementMode": "blocking",
31+
"ip-address-lists": [
32+
{
33+
"name": "Standalone",
34+
"description": "Optional Description",
35+
"blockRequests": "policy-default",
36+
"setGeolocation": "IN",
37+
"ipAddresses": [
38+
{
39+
"ipAddress": "1.2.3.4/32"
40+
},
41+
{
42+
"ipAddress": "1111:fc00:0:112::2"
43+
}
44+
]
45+
}
46+
]
47+
}
48+
}
49+
```
50+
51+
The following example shows an IP group definition stored in an external file `external_ip_groups.json`:
52+
53+
```json
54+
{
55+
"policy": {
56+
"name": "IpGroups_policy2",
57+
"template": {
58+
"name": "POLICY_TEMPLATE_NGINX_BASE"
59+
},
60+
"applicationLanguage": "utf-8",
61+
"caseInsensitive": false,
62+
"enforcementMode": "blocking",
63+
"ip-address-lists": [
64+
{
65+
"name": "external_ip_groups",
66+
"description": "Optional Description",
67+
"blockRequests": "always",
68+
"setGeolocation": "IL",
69+
"$ref": "file:///tmp/policy/external_ip_groups.json"
70+
}
71+
]
72+
}
73+
}
74+
```
75+
76+
Example of the file `external_ip_groups.json`:
77+
78+
```json
79+
{
80+
"name": "External IP address lists",
81+
"description": "Optional Description",
82+
"blockRequests": "always",
83+
"setGeolocation": "IR",
84+
"ipAddresses": [
85+
{
86+
"ipAddress": "66.51.41.21"
87+
},
88+
{
89+
"ipAddress": "66.52.42.22"
90+
}
91+
]
92+
}
93+
```
94+
95+
## IP address lists in policy override rules conditions
96+
97+
The **Override Rules** feature allows you to override original or parent policy settings.
98+
99+
Rules are defined using specific conditions, which can include an IP address list based on the declarative policy JSON schema.
100+
101+
When triggered, the rule is applied to the `clientIp` attribute using the `matches` function:
102+
103+
`clientIp.matches(ipAddressLists["standalone"])`
104+
105+
Here is a policy example:
106+
107+
```json
108+
{
109+
"policy": {
110+
"name": "ip_group_override_rule",
111+
"template": {
112+
"name": "POLICY_TEMPLATE_NGINX_BASE"
113+
},
114+
"applicationLanguage": "utf-8",
115+
"caseInsensitive": false,
116+
"enforcementMode": "blocking",
117+
"ip-address-lists": [
118+
{
119+
"name": "standalone",
120+
"ipAddresses": [
121+
{
122+
"ipAddress": "1.1.1.1/32"
123+
}
124+
]
125+
}
126+
],
127+
"override-rules": [
128+
{
129+
"name": "myRule1",
130+
"condition": "clientIp.matches(ipAddressLists['standalone'])",
131+
"actionType": "extend-policy",
132+
"override": {
133+
"policy": {
134+
"enforcementMode": "transparent"
135+
}
136+
}
137+
}
138+
]
139+
}
140+
}
141+
```
142+
143+
The previous example policy contains an IP address list named `standalone`, which is used in the override rule condition `clientIp.matches(ipAddressLists['standalone'])`.
144+
145+
This condition means that the rule enforcement is applied and overrides the base policy enforcement whenever the `clientIp` matches one of the `ipAddresses` in the `ip-address-list` named `standalone`.
146+
147+
The value used in the override condition must exist and exactly match the name defined in `ip-address-lists`.
148+
149+
### Possible errors
150+
151+
| Error text | Input | Explanation |
152+
|-----------------------------------------|---------------------------------------------------|-----------------------------------------------------------|
153+
| Invalid field `invalidList` | `clientIp.matches(invalidList['standalone']);` | An incorrect keyword was used instead of `ipAddressLists` |
154+
| Invalid value empty string | `clientIp.matches(ipAddressLists[''])` | An empty name was provided |
155+
| Failed to compile policy - `ipGroupOverridePolicy` | `uri.matches(ipAddressLists['standalone']);` | Used `ipAddressLists` without the `clientIp` attribute |

0 commit comments

Comments
 (0)