# Pangolin Security Rules for Towerops
# Block common web attacks and malicious traffic
#
# Apply these rules to your Pangolin configuration to filter traffic before
# it reaches your application server.
#
# Documentation: https://docs.pangolin.net/

# ============================================================================
# SQL Injection Attempts
# ============================================================================

[[rules]]
name = "Block SQL Injection - UNION"
match.url.regex = "(?i)(union.*(all|select)|select.*from.*information_schema)"
action = "block"
log = true

[[rules]]
name = "Block SQL Injection - Common Patterns"
match.url.regex = "(?i)(\\bor\\b.*=.*|\\band\\b.*=.*|'.*or.*'|\".*or.*\"|;.*drop|;.*delete|;.*insert|;.*update)"
action = "block"
log = true

[[rules]]
name = "Block SQL Injection - Comments"
match.url.regex = "(?i)(/\\*.*\\*/|--.*$|#.*$)"
action = "block"
log = true

# ============================================================================
# Cross-Site Scripting (XSS)
# ============================================================================

[[rules]]
name = "Block XSS - Script Tags"
match.url.regex = "(?i)(<script|</script|javascript:|onerror=|onload=)"
action = "block"
log = true

[[rules]]
name = "Block XSS - Event Handlers"
match.url.regex = "(?i)(onclick|ondblclick|onmouseover|onmouseout|onkeydown|onkeyup|onchange|onsubmit|onfocus|onblur)\\s*="
action = "block"
log = true

# ============================================================================
# Path Traversal
# ============================================================================

[[rules]]
name = "Block Path Traversal - Directory Traversal"
match.url.regex = "(\\.\\./|\\.\\.\\\\/|%2e%2e%2f|%2e%2e/|..%2f|%2e%2e%5c)"
action = "block"
log = true

[[rules]]
name = "Block Path Traversal - Absolute Paths"
match.url.regex = "(?i)(^/etc/|^/proc/|^/sys/|^/var/|^/usr/|^/bin/|^/sbin/|c:\\\\|c:/)"
action = "block"
log = true

# ============================================================================
# Common Exploit Paths (WordPress, PHPMyAdmin, etc.)
# ============================================================================

[[rules]]
name = "Block WordPress Admin"
match.url.path = "/wp-admin"
action = "block"
log = true

[[rules]]
name = "Block WordPress Login"
match.url.path = "/wp-login.php"
action = "block"
log = true

[[rules]]
name = "Block WordPress XML-RPC"
match.url.path = "/xmlrpc.php"
action = "block"
log = true

[[rules]]
name = "Block PHPMyAdmin"
match.url.regex = "(?i)/(phpmyadmin|pma|myadmin|mysql|phpmy|sqladmin)"
action = "block"
log = true

[[rules]]
name = "Block Common Admin Panels"
match.url.regex = "(?i)/(admin|administrator|cpanel|webmail|plesk|directadmin|phppgadmin)"
action = "block"
log = true

# ============================================================================
# Malicious Bots and Scanners
# ============================================================================

[[rules]]
name = "Block Vulnerability Scanners"
match.headers."User-Agent".regex = "(?i)(nikto|nessus|nmap|masscan|zap|burp|sqlmap|metasploit|acunetix|w3af|havij)"
action = "block"
log = true

[[rules]]
name = "Block Scrapers and Crawlers"
match.headers."User-Agent".regex = "(?i)(scrapy|webcopier|httrack|teleport|wget|curl.*bot|python-requests.*bot)"
action = "block"
log = false

[[rules]]
name = "Block Empty User Agent"
match.headers."User-Agent".exact = ""
action = "block"
log = false

# ============================================================================
# Shell Injection Attempts
# ============================================================================

[[rules]]
name = "Block Shell Commands"
match.url.regex = "(?i)(\\|.*ls|\\|.*cat|\\|.*wget|\\|.*curl|;.*ls|;.*cat|;.*wget|;.*curl|`.*`|\\$\\(.*\\))"
action = "block"
log = true

[[rules]]
name = "Block Shell Shock"
match.headers.regex = "(?i)\\(\\)\\s*\\{.*\\}"
action = "block"
log = true

# ============================================================================
# File Upload Exploits
# ============================================================================

[[rules]]
name = "Block Malicious File Extensions"
match.url.regex = "(?i)\\.(php\\d?|phtml|asp|aspx|jsp|cgi|pl|sh|bash|exe|dll|com|bat)\\.?"
action = "block"
log = true

[[rules]]
name = "Block Double Extensions"
match.url.regex = "(?i)\\.(jpg|jpeg|png|gif|pdf|doc|docx)\\.php"
action = "block"
log = true

# ============================================================================
# Information Disclosure
# ============================================================================

[[rules]]
name = "Block Git Directory"
match.url.path_prefix = "/.git"
action = "block"
log = true

[[rules]]
name = "Block SVN Directory"
match.url.path_prefix = "/.svn"
action = "block"
log = true

[[rules]]
name = "Block Environment Files"
match.url.regex = "(?i)/\\.env(\\..*)?$"
action = "block"
log = true

[[rules]]
name = "Block Backup Files"
match.url.regex = "(?i)\\.(bak|backup|old|orig|save|swp|swo|~)$"
action = "block"
log = true

[[rules]]
name = "Block Config Files"
match.url.regex = "(?i)/(config|configuration|settings)\\.(php|xml|json|yml|yaml|ini|conf)$"
action = "block"
log = true

# ============================================================================
# Protocol and Method Attacks
# ============================================================================

[[rules]]
name = "Block HTTP/0.9"
match.http_version = "0.9"
action = "block"
log = false

[[rules]]
name = "Block TRACE Method"
match.method = "TRACE"
action = "block"
log = true

[[rules]]
name = "Block TRACK Method"
match.method = "TRACK"
action = "block"
log = true

# ============================================================================
# Known Exploit Patterns
# ============================================================================

[[rules]]
name = "Block Log4Shell"
match.headers.regex = "(?i)\\$\\{jndi:(ldap|rmi|dns)://"
action = "block"
log = true

[[rules]]
name = "Block Server-Side Request Forgery (SSRF)"
match.url.regex = "(?i)(localhost|127\\.0\\.0\\.1|0\\.0\\.0\\.0|\\[::1\\]|169\\.254\\.|192\\.168\\.|10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.)"
action = "block"
log = true

[[rules]]
name = "Block XXE (XML External Entity)"
match.body.regex = "(?i)<!entity.*system"
action = "block"
log = true

# ============================================================================
# Rate Limiting (requires Pangolin Pro)
# ============================================================================

# Uncomment if you have Pangolin Pro with rate limiting
# [[rules]]
# name = "Rate Limit - General"
# match.all = true
# action = "rate_limit"
# rate_limit.requests = 100
# rate_limit.window = "1m"
# rate_limit.by = "ip"

# [[rules]]
# name = "Rate Limit - Login Endpoints"
# match.url.regex = "(?i)/(login|signin|session|auth)"
# action = "rate_limit"
# rate_limit.requests = 10
# rate_limit.window = "1m"
# rate_limit.by = "ip"

# ============================================================================
# Geo-Blocking (optional)
# ============================================================================

# Block traffic from specific countries if needed
# [[rules]]
# name = "Block Countries"
# match.geo.country_code = ["CN", "RU", "KP"]
# action = "block"
# log = false

# ============================================================================
# Allowlist for Legitimate Traffic
# ============================================================================

# Always allow health checks
[[rules]]
name = "Allow Health Checks"
match.url.path = "/health"
action = "allow"
priority = 1000

# Allow legitimate API endpoints
[[rules]]
name = "Allow API v1"
match.url.path_prefix = "/api/v1"
match.headers."User-Agent".regex = "towerops-agent"
action = "allow"
priority = 1000

# Allow legitimate user agents from monitoring
[[rules]]
name = "Allow Monitoring Services"
match.headers."User-Agent".regex = "(?i)(uptimerobot|pingdom|statuspage|datadog)"
action = "allow"
priority = 1000