bext-plugin-waf-rules

Custom WAF rule definitions. OWASP CRS compatible.

Define custom rules for bext's built-in Web Application Firewall. Rules use a format compatible with the OWASP Core Rule Set, so you can adapt existing CRS rules or write new ones. Compiled to WASM for fast evaluation.

Install

bext plugin add waf-rules

Config

[plugins.waf-rules]
rules_dir = "waf/rules"
paranoia_level = 1         # 1-4, higher = stricter
anomaly_threshold = 5

Writing rules

Place `.conf` files in your `rules_dir`. Each rule has a pattern, a phase, and an action:

SecRule REQUEST_URI "@contains /wp-admin" \

SecRule REQUEST_HEADERS:Content-Type "@rx ^application/x-www-form-urlencoded" \ "id:100002,phase:1,chain" SecRule ARGS "@detectSQLi" \ "deny,status:403,msg:'SQL injection attempt'" ```

Built-in rule sets

The plugin ships with a curated subset of the OWASP CRS, organized by threat category:

• SQL injection detection
• XSS pattern matching
• Path traversal prevention
• Remote code execution signatures
• Protocol anomaly detection

Paranoia levels

Level 1 (default) catches obvious attacks with minimal false positives. Each higher level adds more aggressive rules. Test in log-only mode before increasing:

mode = "log"  # log only, don't block