KO | EN

GitLite

Minimalist Open Source Repository Search Engine

gitlite — search

#developer-tools #typescript #codex #ai-agents #claude-code #dsh #dsh-plugin #cli #macos #ai-agent #deepseek-harness #open-source

modsecurity-wasm-filter

★ 47 Open GitHub ↗

No description available.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# PROJECT NOT UNDER ACTIVE MANAGEMENT
This project will no longer be maintained by Intel.  
Intel has ceased development and contributions including, but not limited to, maintenance, bug fixes, new releases, or updates, to this project.  
Intel no longer accepts patches to this project.  
If you have an ongoing need to use this project, are interested in independently developing it, or would like to maintain patches for the open source software community, please create your own fork of this project.

# ModSecurity Wasm Filter For Istio/Envoy Mesh

This is the source code of the [modsecurity-wasm-filter](https://github.com/intel/modsecurity-wasm-filter) for Istio/Envoy Mesh Http Filter.

We offer a Envoy WASM Plugin integrated with ModSecurity to implement the WAF functionality in the http filter chain. We containerd the WASM binary so users can easily deploy the filter in their istio/envoy mesh.

The plugin is the basic version and the modsecurity rule inside the plugin can be updated by the istio CR `WasmPlugin`. And we support dynamic update of the wasm binary and modsecurity rules based on istio > 1.13. The rule server for OWASP rules and customer rules will be delivered in the future.

### 1. Build and upload wasm plugin:

First, clone the repository and open into `wasmplugin` folder :

```
 git clone https://github.com/intel/modsecurity-wasm-filter.git 
 cd modsecurity-wasm-filter/wasmplugin
 ```

Run `docker build` to build modsecurity wasm plugin. This will generate a docker image containing a single wasm binary.

`docker build -t ${HUB}/${IMAGE_NAME}:${TAG} -f Dockerfile .`

Run `docker push` to push the binary to remote repository:

`docker push ${HUB}/${IMAGE_NAME}:${TAG}`

### 2. Intall Istio and httpbin example

make sure `istioctl` verison > 1.13

```
istioctl install --set meshConfig.defaultConfig.proxyMetadata.WASM_INSECURE_REGISTRIES=* -y
kubectl label namespace default istio-injection=enabled
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.14/samples/httpbin/httpbin.yaml
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.14/samples/httpbin/httpbin-gateway.yaml
```

### 3.  Build and deploy ruleserver controller

Build ruleserver docker image:

```
cd modsecurity-wasm-filter/ruleserver
make docker-build IMG=ruleserver:crd
```

Deploy controller on kubernetes:

```
make deploy IMG=ruleserver:crd
```

Install CRD on kubernetes:

```
make install 
kubectl apply -f config/samples/
```

### 4. Test wasm filter

In another terminal, forward port 80 of istio ingressgateway to port 8080 of local machine

`kubectl port-forward -n istio-system svc/istio-ingressgateway 8080:80`

Send http request to see if the service is working as expected:

`curl -X POST -i http://localhost:8080/post?param1=test` will return HTTP 200 response

`curl -X POST -i http://localhost:8080/post?param1=attack` will return HTTP 400 response

modsecurity-wasm-filter

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README