332 lines
10 KiB
Gherkin
332 lines
10 KiB
Gherkin
# Storyboard library file
|
|
|
|
# For ease of upgrade DO NOT CHANGE THIS library file
|
|
# Make your function changes by using user 'hook' functions
|
|
# or by overriding functions
|
|
# in the site.story file - for site wide changes.
|
|
#
|
|
# and in filtergroup specific story file - see examplef1.story
|
|
#
|
|
# This library is built to largely duplicate the logic in V4
|
|
#
|
|
# Many e2guardian[f1].conf flags are replaced by overiding
|
|
# library functions - see site.story and examplef1.story
|
|
#
|
|
# Simple functions are defined which control the logic flow and the
|
|
# lists that are used. See notes/Storyboard for details.
|
|
#
|
|
# The entry point in v5 for standard filtering is 'checkrequest'
|
|
#
|
|
|
|
# Entry function called by standard proxy module to check http,
|
|
# https proxy and transparent http requests
|
|
# It is also called within a MITM session
|
|
function(checkrequest)
|
|
if(true) returnif hook_checkrequest
|
|
if(viruscheckset) checknoscanlists
|
|
if(bypassallowset) checknobypasslists
|
|
if(exceptionset) return true
|
|
#if(fullurlin,searchterms) setsearchterm
|
|
if(true) is_search_term
|
|
ifnot(greyset) returnif localcheckrequest
|
|
if(connect) return sslrequestcheck
|
|
ifnot(greyset) returnif exceptioncheck
|
|
ifnot(greyset) greycheck
|
|
ifnot(greyset) returnif bannedcheck
|
|
if(fullurlin, change) setmodurl
|
|
if(true) returnif embeddedcheck
|
|
if(headerin,headermods) setmodheader
|
|
if(fullurlin, addheader) setaddheader
|
|
if(searchin,override) setexception
|
|
if(returnset) return setdone
|
|
if(searchin,banned) return setblock
|
|
if(fullurlin,redirect) return setredirect
|
|
if(true) setgrey
|
|
|
|
|
|
# Entry function called by proxy module to check http response
|
|
# It is also called within a MITM session
|
|
function(checkresponse)
|
|
if(true) returnif hook_checkresponse
|
|
if(exceptionset) return false
|
|
if(responseheaderin,reponseheadermods) setmodheader
|
|
if(viruscheckset) checknoscantypes
|
|
if(urlin,exceptionfile) return false
|
|
if(true) return checkfiletype
|
|
|
|
# Entry function called by THTTPS module to check https request
|
|
function(thttps-checkrequest)
|
|
if(true) returnif hook_thttps-checkrequest
|
|
if(true) thttps_automitm
|
|
if(true) returnif checktimesblocked
|
|
if(true) returnif localsslrequestcheck
|
|
if(true) returnif sslrequestcheck
|
|
ifnot(hassniset) checksni
|
|
|
|
# Entry function called by ICAP module to check reqmod
|
|
function(icap-checkrequest)
|
|
if(true) returnif hook_icap-checkrequest
|
|
#unless blocked or redirect or connect - leave logging for RESPMOD
|
|
if(connect) return icapsslrequestcheck
|
|
ifnot(greyset) icap-checkrequest2
|
|
if(redirectset) return true
|
|
ifnot(blockset) setnolog
|
|
|
|
function(icap-checkrequest2)
|
|
if(viruscheckset) checknoscanlists
|
|
if(bypassallowset) checknobypasslists
|
|
if(exceptionset) return true
|
|
#if(fullurlin,searchterms) setsearchterm
|
|
if(true) is_search_term
|
|
ifnot(greyset) returnif localcheckrequest
|
|
ifnot(greyset) returnif exceptioncheck
|
|
ifnot(greyset) greycheck
|
|
ifnot(greyset) returnif bannedcheck
|
|
if(fullurlin, change) setmodurl
|
|
if(true) returnif embeddedcheck
|
|
if(headerin,headermods) setmodheader
|
|
if(fullurlin, addheader) setaddheader
|
|
if(searchin,override) return setgrey
|
|
if(searchin,banned) return setblock
|
|
if(true) setgrey
|
|
|
|
# Entry function called by ICAP module to check respmod
|
|
function(icap-checkresponse)
|
|
if(true) returnif hook_icap-checkresponse
|
|
if(viruscheckset) checknoscanlists
|
|
if(true) return checkresponse
|
|
|
|
# Checks embeded urls
|
|
# returns true if blocked, otherwise false
|
|
function(embeddedcheck)
|
|
if(embeddedin, localexception) return false
|
|
if(embeddedin, localgrey) return false
|
|
if(embeddedin, localbanned) return setblock
|
|
if(embeddedin, exception) return false
|
|
if(embeddedin, grey) return false
|
|
if(embeddedin, banned) return setblock
|
|
|
|
# Local checks
|
|
# returns true if matches local exception or banned
|
|
function(localcheckrequest)
|
|
if(true) returnif hook_localcheckrequest
|
|
if(connect) return localsslrequestcheck
|
|
if(true) checktimesblocked
|
|
if(returnset) return setblock
|
|
ifnot(greyset) returnif localexceptioncheck
|
|
ifnot(greyset) localgreycheck
|
|
ifnot(greyset) returnif localbannedcheck
|
|
if(searchin,localbanned) return setblock
|
|
|
|
|
|
# Local SSL checks
|
|
# returns true if matches local exception
|
|
function(localsslrequestcheck)
|
|
if(true) returnif hook_localsslrequestcheck
|
|
if(true) returnif sslchecktimesblocked
|
|
if(sitein, localexception) return setexception
|
|
if(sitein, localgreyssl) returnif sslcheckmitm
|
|
if(sitein, localbanned) true
|
|
ifnot(returnset) return false
|
|
if(true) returnif sslcheckmitm
|
|
if(true) return setblock
|
|
|
|
# SSL site replace (used instead of dns kulge)
|
|
# returns true on match and successful replacement
|
|
function(sslreplace)
|
|
if(fullurlin,sslreplace) return setconnectsite
|
|
if(true) return false
|
|
|
|
function(sslchecktimesblocked)
|
|
if(true) checktimesblocked
|
|
ifnot(returnset) return false
|
|
if(true) returnif sslcheckmitm
|
|
if(true) return setblock
|
|
|
|
# Local grey check
|
|
# returns true on match
|
|
function(localgreycheck)
|
|
if(urlin, localgrey) return setgrey
|
|
|
|
# Local banned check
|
|
# returns true on match
|
|
function(localbannedcheck)
|
|
if(urlin, localbanned) return setblock
|
|
|
|
# Local exception check
|
|
# returns true on match
|
|
function(localexceptioncheck)
|
|
if(urlin, localexception) return setexception
|
|
|
|
# Exception check
|
|
# returns true on match
|
|
function(exceptioncheck)
|
|
if(urlin, exception) return setexception
|
|
if(refererin,refererexception) return setexception
|
|
if(headerin, exceptionheader) return setexception
|
|
if(useragentin, exceptionuseragent) return setexception
|
|
ifnot(urlin,embededreferer) return false
|
|
if(embeddedin,refererexception) return setexception
|
|
|
|
# SSL Exception check
|
|
# returns true on match
|
|
function(sslexceptioncheck)
|
|
if(sitein, exception) return setexception
|
|
if(headerin, exceptionheader) return setexception
|
|
if(useragentin, exceptionuseragent) return setexception
|
|
if(true) return false
|
|
|
|
# Greylist check
|
|
# returns true on match
|
|
function(greycheck)
|
|
if(urlin, grey) return setgrey
|
|
|
|
# Banned list check
|
|
# returns true on match
|
|
function(bannedcheck)
|
|
if(true) returnif checkblanketblock
|
|
if(urlin, banned) return setblock
|
|
ifnot(urlin,exceptionfile) returnif checkurlextension
|
|
if(useragentin, banneduseragent) return setblock
|
|
if(headerin, bannedheader) return setblock
|
|
|
|
# Checks url for banned extensions
|
|
# returns true on match
|
|
function(checkurlextension)
|
|
if(urlin,bannedextension) return setblock
|
|
|
|
# Local SSL list(s) check
|
|
# returns true on match
|
|
function(localsslcheckrequest)
|
|
if(true) returnif hook_localsslcheckrequest
|
|
if(sitein, localexception) return setexception
|
|
#if(sitein, localbanned) return setblock
|
|
|
|
# Check whether to go MITM
|
|
# returns true if yes, false if no
|
|
function(sslcheckmitm)
|
|
# use next line to have general MITM
|
|
if(true) return sslcheckmitmgeneral
|
|
# use next line instead of last to limit MITM to greylist
|
|
#if(true) return sslcheckmitmgreyonly
|
|
|
|
# Always go MITM
|
|
# returns true if yes, false if no
|
|
function(sslcheckmitmgeneral)
|
|
if(true) setgomitm
|
|
ifnot(returnset) return false
|
|
if(sitein, nocheckcert) setnocheckcert
|
|
if(true) sslreplace
|
|
if(true) return true
|
|
|
|
# Only go MITM when in greyssl list
|
|
# returns true if yes, false if no
|
|
function(sslcheckmitmgreyonly)
|
|
if(sitein, greyssl) setgomitm
|
|
ifnot(returnset) return false
|
|
if(sitein, nocheckcert) setnocheckcert
|
|
if(true) sslreplace
|
|
if(true) return true
|
|
|
|
# SSL request check
|
|
# returns true if exception or gomitm
|
|
function(sslrequestcheck)
|
|
if(true) returnif hook_sslrequestcheck
|
|
if(true) returnif sslexceptioncheck
|
|
if(true) returnif sslcheckmitm
|
|
if(sitein, banned) return setblock
|
|
if(true) sslreplace
|
|
ifnot(returnset) returnif sslcheckblanketblock
|
|
if(true) setgrey
|
|
|
|
function(checknoscanlists)
|
|
if(urlin,exceptionvirus) unsetviruscheck
|
|
|
|
function(checknoscantypes)
|
|
if(mimein,exceptionvirus) return unsetviruscheck
|
|
if(extensionin,exceptionvirus) return unsetviruscheck
|
|
|
|
function(checknobypasslists)
|
|
if(urlin,bannedbypass) return unsetbypassallow
|
|
|
|
# ICAP SSL request check
|
|
# returns true if exception
|
|
function(icapsslrequestcheck)
|
|
if(true) returnif hook_icapsslrequestcheck
|
|
if(true) returnif icapsquidbump
|
|
if(true) returnif sslexceptioncheck
|
|
# Squid ignores sslreplace and throws error so comment out for now
|
|
#t configif(true) sslreplace
|
|
if(sitein, banned) return setblock
|
|
|
|
# Blanket block
|
|
# returns true if to block
|
|
# Placeholder function - overide in fn.story
|
|
function(checkblanketblock)
|
|
|
|
# SSL Blanket block
|
|
# returns true if to block
|
|
# Placeholder function - overide in fn.story
|
|
function(sslcheckblanketblock)
|
|
|
|
# ICAP Squid bump
|
|
# override in site.story to return true if bump is being deployed on squid
|
|
function(icapsquidbump)
|
|
|
|
# File type blocking
|
|
# returns true if blocking
|
|
# Default uses banned lists and allows all others
|
|
# Overide in site.story or fn.story if only types in exception file type lists
|
|
# are to be allowed
|
|
function(checkfiletype)
|
|
if(mimein, bannedmime) return setblock
|
|
if(extensionin, bannedextension) return setblock
|
|
|
|
# SNI checking - determines default action when no SNI or TSL is present on a
|
|
# THTTPS connection
|
|
# Default blocks all requests with TLS or SNI absent that are not ip site exceptions
|
|
function(checksni)
|
|
ifnot(tls,,511) return setblock
|
|
ifnot(hassniset,,512) return setblock
|
|
|
|
# automitm on transparent https
|
|
# default enables on transparent https - to allow block/status pages to browsers
|
|
# override this is fn.story if this causes problems with apps
|
|
function(thttps_automitm)
|
|
if(true) setautomitm
|
|
|
|
# Timed global block
|
|
# returns true if to block
|
|
# Placeholder function - overide in fn.story
|
|
function(checktimesblocked)
|
|
|
|
# Entry function to check if to log
|
|
# returns true if log entry is to be made
|
|
# This can be overriden in site.story (or fn.story) to log all for testing.
|
|
function(checklogging)
|
|
if(urlin,nolog) setnolog
|
|
if(returnset) return false
|
|
if(true) return true
|
|
|
|
function(is_search_term)
|
|
if(urlin,searchtermexceptions) return false
|
|
if(fullurlin,searchterms) setsearchterm
|
|
if(returnset) return true
|
|
|
|
# Placeholder functions for user hooks
|
|
# Allow user code to be actioned at the start of key functions
|
|
# If hook function returns false (default) processing continues
|
|
# in parent function
|
|
# if hook function returns true parent function exits with true
|
|
#
|
|
function(hook_checkrequest)
|
|
function(hook_checkresponse)
|
|
function(hook_thttps-checkrequest)
|
|
function(hook_icap-checkrequest)
|
|
function(hook_icap-checkresponse)
|
|
function(hook_localcheckrequest)
|
|
function(hook_localsslrequestcheck)
|
|
function(hook_localsslcheckrequest)
|
|
function(hook_sslrequestcheck)
|
|
function(hook_icapsslrequestcheck)
|