@@ -36,7 +36,7 @@ func (*vmContext) NewPluginContext(contextID uint32) types.PluginContext {
3636
3737type wafMap struct {
3838 kv map [string ]coraza.WAF
39- defaultKey string
39+ defaultWAF coraza. WAF
4040}
4141
4242func newWAFMap (capacity int ) wafMap {
@@ -54,29 +54,23 @@ func (m *wafMap) put(key string, waf coraza.WAF) error {
5454 return nil
5555}
5656
57- func (m * wafMap ) setDefaultKey (key string ) error {
58- if len (key ) == 0 {
59- return errors .New ("empty default WAF key" )
60- }
61-
62- if _ , ok := m .kv [key ]; ok {
63- m .defaultKey = key
64- return nil
57+ func (m * wafMap ) setDefaultWAF (w coraza.WAF ) {
58+ if w == nil {
59+ panic ("nil WAF set as default" )
6560 }
66-
67- return fmt .Errorf ("unknown default WAF key %q" , key )
61+ m .defaultWAF = w
6862}
6963
7064func (m * wafMap ) getWAFOrDefault (key string ) (coraza.WAF , bool , error ) {
7165 if w , ok := m .kv [key ]; ok {
7266 return w , false , nil
7367 }
7468
75- if len ( m . defaultKey ) == 0 {
76- return nil , false , errors .New ("no default WAF key " )
69+ if m . defaultWAF == nil {
70+ return nil , false , errors .New ("no default WAF" )
7771 }
7872
79- return m .kv [ m . defaultKey ] , true , nil
73+ return m .defaultWAF , true , nil
8074}
8175
8276type corazaPlugin struct {
@@ -100,8 +94,33 @@ func (ctx *corazaPlugin) OnPluginStart(pluginConfigurationSize int) types.OnPlug
10094 return types .OnPluginStartStatusFailed
10195 }
10296
97+ // directivesAuthoritesMap is a map of directives name to the list of
98+ // authorities that reference those directives. This is used to
99+ // initialize the WAFs only for the directives that are referenced
100+ directivesAuthoritiesMap := map [string ][]string {}
101+ for authority , directivesName := range config .perAuthorityDirectives {
102+ directivesAuthoritiesMap [directivesName ] = append (directivesAuthoritiesMap [directivesName ], authority )
103+ }
104+
103105 perAuthorityWAFs := newWAFMap (len (config .directivesMap ))
104106 for name , directives := range config .directivesMap {
107+ var authorities []string
108+
109+ // if the name of the directives is the default directives, we
110+ // initialize the WAF despite the fact that it is not associated
111+ // to any authority. This is because we need to initialize the
112+ // default WAF for requests that don't belong to any authority.
113+ if name != config .defaultDirectives {
114+ var directivesFound bool
115+ authorities , directivesFound = directivesAuthoritiesMap [name ]
116+ if ! directivesFound {
117+ // if no directives found as key, no authority references
118+ // these directives and hence we won't initialize them as
119+ // it will be a waste of resources.
120+ continue
121+ }
122+ }
123+
105124 // First we initialize our waf and our seclang parser
106125 conf := coraza .NewWAFConfig ().
107126 WithErrorCallback (logError ).
@@ -119,18 +138,32 @@ func (ctx *corazaPlugin) OnPluginStart(pluginConfigurationSize int) types.OnPlug
119138 return types .OnPluginStartStatusFailed
120139 }
121140
122- err = perAuthorityWAFs .put (name , waf )
123- if err != nil {
124- proxywasm .LogCriticalf ("Failed to register authority WAF: %v" , err )
125- return types .OnPluginStartStatusFailed
141+ if len (authorities ) == 0 {
142+ // if no authorities are associated directly with this WAF
143+ // but we still initialize it, it means this is the default
144+ // one.
145+ perAuthorityWAFs .setDefaultWAF (waf )
146+ }
147+
148+ for _ , authority := range authorities {
149+ err = perAuthorityWAFs .put (authority , waf )
150+ if err != nil {
151+ proxywasm .LogCriticalf ("Failed to register authority WAF: %v" , err )
152+ return types .OnPluginStartStatusFailed
153+ }
126154 }
155+
156+ delete (directivesAuthoritiesMap , name )
127157 }
128158
129- if len (config .defaultDirectives ) > 0 {
130- if err := perAuthorityWAFs .setDefaultKey (config .defaultDirectives ); err != nil {
131- proxywasm .LogCriticalf ("Failed to set the default directives: %v" , err )
132- return types .OnPluginStartStatusFailed
159+ if len (directivesAuthoritiesMap ) > 0 {
160+ // if there are directives remaining in the directivesAuthoritiesMap, means
161+ // those directives weren't part of the directivesMap and hence not declared.
162+ for unknownDirective := range directivesAuthoritiesMap {
163+ proxywasm .LogCriticalf ("Unknown directives %q" , unknownDirective )
133164 }
165+
166+ return types .OnPluginStartStatusFailed
134167 }
135168
136169 ctx .perAuthorityWAFs = perAuthorityWAFs
0 commit comments