WAF va in’ektsiyalardan himoya qilish

1) Nima uchun WAF API davrida

• integratsiyalarning «uzun dumlari» (meros kodi, sheriklik vebxuklari),
• parsing tafovutlari (proxy fraymvork),
• yangi protokol/obfuskatsiya aylanma texnikalari.
• WAF erta nosozlik (early deny) va kod chiqarilgunga qadar «virtual patching» ni beradi, lekin xavfsiz ishlanmani almashtirmaydi.

2) Tahdidlar modeli: API uchun inyeksiya turlari

SQLi/ORMi: classic/boolean/time-based/stacked; kechikishlar orqali blind.
NoSQLi (Mongo/Elastic):’$ne/ $gt’, JSON injection, regex-DoS operatorlari.
Command Injection/RCE: shell-metasimvollar, argumentlarni almashtirish, unsafe deserialization → code exec.
XXE: XMLdagi tashqi mavjudotlar/DTD.
SSRF:’169. 254. 169. 254 ’/ichki servis; DNS-rebinding.
Template Injection: Jinja/Thymeleaf/Handlebars; `{{77}}`.
LDAP/EL Injection, XPath, Header injection (CRLF), Path traversal.
GraphQL o’ziga xosdir:’__ schema’introspection, so’rovlarning chuqurligi/murakkabligi.
JSON/JS-spetsifik: Prototype Pollution (’__ proto __’,’constructor’).
gRPC/Protobuf: oversized messages, field smuggling.

3) WAF arxitekturasi

CDN-WAF perimetri: tez geo/ASN filtrlash, bazaviy bot-nazorat, kesh/antipadding.
L7 perimetri (NGINX/Envoy/APISIX/Kong): aniq parsing, chuqur qoidalar, PDP/limitlar bilan integratsiya.
Saidkar/mash (Envoy WASM/Filter): ma’lumotlarga yaqin, ichki API uchun noto’g’ri ijobiy bo’lgan xizmat kamroq.
Tavsiya: ikki qavatli model (CDN-WAF + L7 WAF).

4) Parsing, normallashtirish va anti-aylanib chiqish

• Yo’llarni normallashtirish (’/a/% 2e% 2e/b’→ nosozlik),’UTF-8 ’/Unicode confusables, NUL-baytlar.
• Yagona dekoding: URL-/HTML-/Unicode-/Base64 qatlamlari, ikki tomonlama dekoding taqiqlangan.
• Cheklovlar:’max _ headers’,’max _ header _ size’,’max _ body _ size’,’max _ args’, JSON chuqurligi, multipart-qismlar limiti, 2x gzip/zip-bombalarni taqiqlash.
• Content-Type siyosati:’application/json’faqat JSON-endpointlarda; «polyglot» ni rad etish.

5) Qoidalar modellari

Salbiy (imzolar): OWASP CRS (SQLi/XSS/SSRF/Java/Node RCE va boshqalar). Tez boshlash.
Ijobiy (allow-list): qat’iy sxemalar (JSON Schema/Protobuf), turlari va diapazonlari; yo’nalishlar bo’yicha.
Anomal/skoring: «shubhali» belgilarni jamlash → blokirovka ostonasi.
Kontekst:’POST/payments’va’GET/status’uchun turli profillar; FP dan kichik.

6) Himoya bloklari (bog’lamda)

1. Sxemalar va turlar: JSON Schema/Protobuf biznes-mantiqgacha validatsiya.
2. Parametrlash: tayyorlangan iboralar, ORM-bindinglar, konkatenatsiyani taqiqlash.
3. Output-escaping: HTML/JS/SQL kontekstda.
4. Tana siyosati: Content-Type, oʻlchami, multipart cheklovlari, JSON ruchkalarida binarlar taqiqlanadi.
5. WAF qoidalari: CRS + xususiy salbiy/ijobiy.
6. Rate/Quota/Concurrency: brute/toshbaqa DDoS bostirish, ommaviy shakllar uchun himoya kapchalari/challenges.
7. Tarmoq izolatsiyasi: SSRF (deny RFC1918/metadata/Unix sockets) uchun egress siyosati.
8. Headers-gigiyena:’X-Content-Type-Options: nosniff’,’Content-Security-Policy’front uchun,’Referrer-Policy’.
9. GraphQL guard: chuqurlik/murakkablik chegaralari, proda introspection taqiqlangan (yoki rol-geyt).

7) Konfiguratsiya namunalari

7. 1 NGINX + ModSecurity (OWASP CRS)

nginx load_module modules/ngx_http_modsecurity_module.so;

modsecurity on;
modsecurity_rules_file /etc/modsecurity/modsecurity.conf;
modsecurity_rules '
SecRuleEngine On
Подключаем CRS
Include /etc/modsecurity/crs/crs-setup.conf
Include /etc/modsecurity/crs/rules/.conf

Позитивные правила: только JSON и ограничение размера
SecRule REQUEST_HEADERS:Content-Type "!@rx ^application/json($;)" "id:10001,phase:1,deny,status:415,msg:'Only JSON allowed'"
SecRequestBodyLimit 1048576
SecRequestBodyNoFilesLimit 1048576

Блок локальных адресов (SSRF)
SecRule REQUEST_HEADERS:Host "@ipmatch 127.0.0.0/8 10.0.0.0/8 169.254.0.0/16 192.168.0.0/16" \
"id:10002,phase:1,deny,status:403,msg:'Blocked private range'"
';

server {
listen 443 ssl http2;
server_name api.example.com;

client_max_body_size 1m;
proxy_request_buffering on;  # защита от slow-POST proxy_read_timeout 300ms;
proxy_connect_timeout 100ms;

location /v1/ {
proxy_pass http://app_backends;
}
}

7. 2 Envoy HTTP WAF (WASM + JSON Schema + SSRF egress-deny)

yaml http_filters:
- name: envoy.filters.http.wasm typed_config:
config:
vm_config: { vm_id: waf, code: { local: { filename: /plugins/waf.wasm } } }
configuration:
"@type": type.googleapis.com/google.protobuf.Struct value:
crs_profile: "strict"
deny_patterns: ["(?i)union.select", "(?i)(sleep    benchmark)\\s\\("]
json_schema:
"/v1/payments:create": "/schemas/payments_create.json"
- name: envoy.filters.http.router

Egress SSRF guard (L4): deny private ranges from gateway filter_chains:
- filters:
- name: envoy.filters.network.tcp_proxy typed_config:
stat_prefix: egress cluster: internet access_log: [...]
tunneling_config:
hostname: "%REQ(:authority)%"
transport_socket:
name: envoy.transport_sockets.tls

7. 3 APISIX: turlarni cheklash va blokirovkaga qarshi

yaml routes:
- uri: /v1/
plugins:
cors: { allow_origins: "https://app.example.com" }
request-validation:
body_schema:
{"type":"object","properties":{"amount":{"type":"number","minimum":1}},"required":["amount"]}
uri-blocker:
block_rules: ["..","%2e%2e","%2f..","\\x00"]  # traversal/NULL proxy-rewrite:
headers:
set:
X-Content-Type-Options: "nosniff"

8) Tyuning va noto’g "ri ta’sirlarni kamaytirish (FP)

per-route profillari: qatʼiy qoidalar faqat mos kelganda (masalan, ’/search’ruxsat beradi ’/’%’).
Shadow/Report-Only: blok oldidagi ishlashlarni logga olish; A/B metriklarni taqqoslash.
Shovqinli qonuniy parametrlar uchun maxsus allow roʻyxatlari.
Skoring: faqat koʻrsatgichlar yigʻindisida bloklash.
Tajribalar: yangi qoidalar bo’yicha trafikning kichik foizi → avto-rollback.

9) Kuzatish va forenzika

Метрики: `waf_block_total{rule}`, `waf_anomaly_score`, `request_body_rejected_total`, `schema_violation_total`, `ssrf_block_total`.
Loglar (samplirovannie): qoidalar, soʻrov qismi (tahrirlangan),’trace _ id’,’tenant’,’route’, sabab. PII/sirlarni yashiring.
Dashbordlar: top-qoidalar/yo’llar, FP-klaster, chiqarilgandan keyingi dinamika.
Hodisalar: artefaktlarni (payload, zarur bo’lganda pcap), RCA va «virtual patchlar» mahsulotlarini saqlash.

10) Test va xaos-stsenariylar

WAF aylanma korpuslari (SQLi/XSS/SSRF), ikkilik/uchlik kodirovkalar, aralash Unicode.
Parsing farqlari: proksi va framvork farqlanishi mumkin boʻlgan payload joʻnating (parametrlar, massivlar,’; vs’&).
Slow-POST/oversize, zip-bombalar, ko’p chastotali shakllar, xato boundary.
GraphQL: chuqurlik/murakkablik generatori, limit va taymautlarni tekshirish.

11) Antipatternlar

«CRS yoqilgan va unutilgan»: sxemasiz, yo’nalishlar bo’yicha tyuningsiz.
Xom so’rov tanasi va PII bo’lgan loglar.
Oʻlcham chegaralari yoʻq → aylanib chiqish, parsing uchun DoS.
’Content-Type ’/charset tekshiruvlarini o’ tkazib yuborish → poliglot-hujumlar.
Bulutlar metadatiga egress-filtrlar → SSRF yo’qligi.
Tashqi va ichki API uchun bitta umumiy profil.
Perimetrdagi teshiklar → «sherik uchun» nazoratsiz istisnolar.

12) iGaming/Moliya xususiyatlari

To’lov/chiqarish qalamlaridagi kuchaytirilgan profillar: kichik body-limitlar, qat’iy sxemalar, account/IBAN/PAN-maydonlari uchun deny-ro’yxatlar (niqoblash, formatli tekshirishlar).
PSP/KYC vebxuklari: HMAC imzosi/mutual TLS, alohida WAF profillari, anti-replay.
Geo/ASN-filtrlar va bot-ro’yxatga olish va bonus-abyuzning oldini olish uchun xulq-atvor limitlari.
Insidentlarning o’zgarmas jurnallari (audit), yurisdiksiyalar bo’yicha saqlash.

13) Prod-tayyorlik chek-varaqasi

• Ikki qavatli WAF (CDN + L7), yagona normallashtirish va o’lchov limitlari.
• OWASP CRS kiritilgan, per-route maxsus qoidalari; JSON Schema/Protobuf write-ruchkalarda.
• Content-Type/charset siyosati; ikki tomonlama dekoding/NULL/traversal.
• SSRF-egress-blok xususiy diapazonlarga/metadata; DNS-rebinding himoyasi.
• Rate/Quota/Concurrency va ommaviy shakllarda anti-bot.
• Shadow/Report-Only → canary → enforce; SLO va FP bo’yicha avto-rollback.
• Metriklar/loglar/niqobli treyslar; «top-qoidalar »/FP dashbordlari.
• Virtual patch va RCA pleybuklari; aylanib o’tishning muntazam testlari.
• PSP/KYC vebxuk, toʻlov qalamlari va ichki API uchun alohida profillar.

14) TL; DR

Himoyani qatlamlar bo’yicha quring: me’yorlashtirish va limitlar → sxemalar/turlar → parametrlash → WAF (CRS + kastom) → rate/bot-filtrlar → SSRF egress-blok. per-route-ni sozlang, shadow → canary-da yangi qoidalarni ishga tushiring, metriklarni/FP-ni kuzatib boring va kod fiksigacha «virtual yamoqlar» qiling. To’lov/vebxuk yo’llari uchun - alohida qat’iy profillar, HMAC/mTLS va minimal ishonch oynalari.