/rebuff

Application Security as a Service

Primary LanguageRuby

Firewall as a Service

Packet inspection for:

  • SQL injections
  • ??? Mitigation of DoS and DDoS attacks Deny common attacks

What's needed?

  • DNS roundrobin in front of...
  • ?x servers
  • iptables for control
  • something to inspect every packet?

Anatomy of a SecRule

Every request is checked by and returns:

  • part of the request (REQUEST_FILENAME|ARGS_NAMES|ARGS|XML)
  • log of attack blocked
  • severity

class Rebuff

def call(env) request = Rack::Request.new(env) headers = Rack::Utils::HeaderHash.new customer = Customer.find(env.headers.customer_id)

if customer.bad_requests.include?(/request.body/)
  [500, {}, []]
end

env.each do |key, value|
  if key =~ /HTTP_(.*)/
    headers[$1] = value
  end
end

result = Net::HTTP.start(@host, @port) do |http|
  method = rack_request.request_method
  case method
  when "GET", "HEAD", "DELETE", "OPTIONS", "TRACE"
    req = Net::HTTP.const_get(method.capitalize).new(request.fullpath, headers)
  when "PUT", "POST"
    req = Net::HTTP.const_get(method.capitalize).new(request.fullpath, headers)
  else
    raise "Method not supported: #{method}"
  end
  
  http.request(result)
end

[result.code, Rack::Utils::HeaderHash.new(result.to_hash), [result.body]]

end end

Issues

  • Bandwidth. Who pays for it?
  • let's say that Jimmy User does a promotion of some sort that suddenly gets hella hits. all that shit coming from a couple of IPs is so gonna get flagged and ACL'd as a DoS. logic dictates that you're going to be the one that gets the support call.
  • How is ssl encryption/decryption handled?