{"id":21649584,"url":"https://github.com/kaanaktas/go-slm","last_synced_at":"2025-03-20T03:19:18.464Z","repository":{"id":49445917,"uuid":"472123469","full_name":"kaanaktas/go-slm","owner":"kaanaktas","description":"policy-based service level management library that enforces policy requirements","archived":false,"fork":false,"pushed_at":"2023-12-12T10:15:48.000Z","size":442,"stargazers_count":2,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-01-25T05:25:05.330Z","etag":null,"topics":["concurrency","go","gorutines","owasp","owasp-crs-core-rule-set","sql-injection-attacks","xss-attacks"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kaanaktas.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2022-03-20T23:00:10.000Z","updated_at":"2023-03-10T14:19:47.000Z","dependencies_parsed_at":"2023-12-12T11:29:30.952Z","dependency_job_id":"2ac6a98d-59fb-4490-a5ce-30b3b6eb7847","html_url":"https://github.com/kaanaktas/go-slm","commit_stats":null,"previous_names":[],"tags_count":8,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kaanaktas%2Fgo-slm","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kaanaktas%2Fgo-slm/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kaanaktas%2Fgo-slm/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kaanaktas%2Fgo-slm/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kaanaktas","download_url":"https://codeload.github.com/kaanaktas/go-slm/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244541980,"owners_count":20469246,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["concurrency","go","gorutines","owasp","owasp-crs-core-rule-set","sql-injection-attacks","xss-attacks"],"created_at":"2024-11-25T07:34:44.479Z","updated_at":"2025-03-20T03:19:18.442Z","avatar_url":"https://github.com/kaanaktas.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![GitHub go.mod Go version](https://img.shields.io/github/go-mod/go-version/xmlking/go-workspace)](https://github.com/xmlking/go-workspace/blob/main/go.mod)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n![test](https://github.com/kaanaktas/go-slm/workflows/go-slm/badge.svg \"test\")\n[![coverage](https://codecov.io/gh/kaanaktas/go-slm/branch/main/graph/badge.svg)](https://codecov.io/gh/kaanaktas/go-slm)\n\n# go-slm\n\ngo-slm is a policy-based service level monitoring library that ensures the adherence of policy specifications for each service.\n\nIntroduction\n------------\n\ngo-slm supports service based **data filter** and **schedule** enforcement, allowing users to expand existing data filter rules according to their needs or disable unnecessary ones. \nThe rule-sets under **https://github.com/coreruleset/coreruleset** are referenced for Owasp rule definitions and additional configuration files can be created in the same way \nif other rule-sets from Coreruleset are required.\n\nInstallation\n-------------\n\n`go get github.com/kaanaktas/go-slm`\n\nConfiguration\n-------------\n![](diagram.png)\n\n## datafilter\n\ngo-slm implements 3 data filters; **owasp-sqli**, **owasp-xss** and **pan-filtering**, with the default rule definitions for each located in **datafilter/rules**. \nThe filter rules' definitions are defined in **datafilter/datafilter_rule_set.yaml** which can be used without any modifications.\u003cbr/\u003e\n\n\nIf users want to make any changes to the existing filter rules or add new ones, they must:\n* create a custom filter rule definition file and place it in the main project directory which will overwrite any rule defined in the default filter rule definition file.\n* generate their own version of **datafilter_rule_set.yaml** with necessary modifications made therein and put it into the main project directory. \nThis will enable them to overwrite existing types/rules in the default datafilter_rule_set.yaml or define new types/rules with changes made in their version of datafilter_rule_set.yaml.\n* finally, link custom filter files within the custom datafilter_rule_set.yaml for use.\n\n**custom_owasp_attack_sqli.yaml**\n\n```\n- name: '942110'\n  disable: true\n  rule: (?:^\\s*[\\\"'`;]+|[\\\"'`]+\\s*$)\n  message: 'Custom message: SQL Injection Attack: Common Injection Testing Detected'\n  sample: var=''\n- name: new_rule_123\n  disable: false\n  rule: \u003cnew_rule_regex\u003e\n  message: \u003cnew_rule_message\u003e\n  sample: \u003cnew_rule_sample\u003e\n```\nIn the example file above, 2 rules are defined for owasp_attack_sqli. As an example, if we place this file in the **/config** directory of the main application,\n* the first rule with name=942110 updates and disables the existing rule in the default filter rule file (**datafilter/rules/owasp_attack_sqli.yaml**). \nThis allows users to disable a particular rule which is not needed in their own set of rules, while they can also change its message or regex value as desired.\n* The second rule with name=new_rule_123 creates a new filter rule and adds it to the package's generated set of rules. \nIt should include a \u003cnew_rule_regex\u003e for defining the pattern for filtering data, along with an appropriate \u003cnew-rule-message\u003e that will be displayed \nwhen a match is found, and a \u003cnew_rule_sample\u003e to demonstrate the rule in action.\n\n**custom_datafilter_rule_set.yaml**\n\n```\n- type: owasp\n  rules:\n    - name: sqli\n      path: rules/owasp_attack_sqli.yaml\n      custom_path: config/custom_owasp_attack_sql.yaml\n```\nThe **custom_datafilter_rule_set.yaml** file contains a single rule that updates owasp_sqli, leaving the other rules unchanged. \nThe rules defined in **custom_owasp_attack_sqli.yaml** will update the rules in **owasp_attack_sqli.yaml** if necessary or add new rules to our rule_set. \nTo ensure that the newly created custom_owasp_attack_sqli.yaml file is used, it must be defined in the **GO_SLM_DATA_FILTER_RULE_SET_PATH** environment variable. \nThe code to set this environment variable is as follows:\n\n`_ = os.Setenv(\"GO_SLM_DATA_FILTER_RULE_SET_PATH\", \"/{directory}/custom_datafilter_rule_set.yaml\")\n`\n\nExamples of how to set the environment variable can be found in the **/datafilter/testdata** directory.\n\n## schedule\n\nSLM schedule policies allow the specification of the time frames during which an access policy will be enforced. \nThis can be achieved by defining a new schedule policy based on days and hours and establishing a priority order among them.\n\nThe schedule definition file contains a list of schedule policies with their respective settings. Each policy is assigned a unique \n**scheduleName**, and the days of the week during which it is active are specified under **days**. Additionally, a **start** time and **duration** can be set for each policy, \nwhich determines the time frame when the policy is enforced.\n\nAn example **schedule.yaml** file is shown below:\n\n```\n- scheduleName: weekend\n  days:\n    - Saturday\n    - Sunday\n      start: 00:00:00\n      duration: 1440\n      message: The service is not permitted during the weekend\n- scheduleName: weekdays\n  days:\n    - Monday\n    - Tuesday\n    - Wednesday\n    - Thursday\n    - Friday\n      start: 08:00:00\n      duration: 600\n      message: The service is not permitted in the weekdays between 08:00 and 18:00\n```\n\nThe above example shows two schedule policies: **weekend** and **weekdays**. The weekend policy is active on Saturdays and Sundays, and it has a 24-hour duration. \nThe weekdays policy is active on weekdays from 8:00 to 18:00 and has a 10-hour duration.\n\nTo use this file in an application, the **GO_SLM_SCHEDULE_POLICY_PATH** environment variable needs to be set to the path of the schedule.yaml file, as demonstrated below:\n\n`_ = os.Setenv(\"GO_SLM_SCHEDULE_POLICY_PATH\", \"/{directory}/schedule.yaml\")\n`\n\nThe **{directory}** in the above code should be replaced with the actual directory path where the **schedule.yaml** file is located.\n\n\n## policies\n\nService level monitoring (SLM) policies provide precise management control and potential enforcement by defining the traffic filtering and request monitoring for a service. \nAn SLM policy includes one or more statements that define a reusable common policy. These common policies can be created in a separate definition file, such as **/policy/testdata/common_policies.yaml**, \nand then be reordered in priority order and combined in **policy_rule_set.yaml** to form more complex policies.\n\nThe common_policies definition file contains a list of common policies with their respective settings. Each policy is assigned a unique **name**, and its **statement** includes one or more **type** that \ndefines the type of the policy and the **action** that should be taken.\n\nAn example **common_policies.yaml** file is shown below:\n\n```\n- policy:\n    name: combined_policy\n    statement:\n      - type: data\n        order: 100\n        action:\n          - name: xss\n            active: true\n          - name: pan_process\n            active: true\n          - name: sqli\n            active: true\n      - type: schedule\n        order: 20\n        action:\n          - name: weekend\n            active: true\n            order: 10\n          - name: weekdays\n            active: true\n            order: 20\t\n- policy:\n    name: pan_only_policy\n    statement:\n      - type: data\n        action:\n          - name: pan_process\n            active: true\n- policy:\n    name: combined_policy_no_schedule\n    statement:\n      - type: data\n        order: 100\n        action:\n          - name: xss\n            active: true\n          - name: pan_process\n            active: true\n          - name: sqli\n            active: true\n```\n\nThe above example shows three common policies: **combined_policy**, **pan_only_policy**, and **combined_policy_no_schedule**. \nThe **combined_policy** policy contains two types of policies, **data** and **schedule**, with the data policy having an order of 100 \nand the schedule policy having an order of 20. The **pan_only_policy** policy is a single **data** policy with no order specified. \nThe **combined_policy_no_schedule** policy is a variation of the **combined_policy** policy without any **schedule** policies.\n\nTo use these policies in an application, the **GO_SLM_COMMON_POLICIES_PATH** environment variable should be set to the path of the **common_policies.yaml** file, as demonstrated below:\n\n`_ = os.Setenv(\"GO_SLM_POLICY_RULE_SET_PATH\", \"/{directory}/policy_rule_set.yaml\")\n`\n\nThe **{directory}** in the above code should be replaced with the actual directory path where the **common_policies.yaml** file is located.\n\n\n**policy_rule_set** definition file contains a list of policies that should be triggered for a service's request and response. \nAn example **policy_rule_set.yaml** file is shown below:\n\n```\n- serviceName: service_test\n  request: combined_policy\n  response: pan_only_policy\n- serviceName: service_test_2\n  request: combined_policy_no_schedule\n  response: pan_only_policy\n```\n\nThe above example shows two policies: **service_test** and **service_test_2**. Both policies have a request policy of combined_policy and a response policy of pan_only_policy, \nexcept for the service_test_2 policy, which uses combined_policy_no_schedule instead of combined_policy.\n\nTo use these policies in an application, the **GO_SLM_POLICY_RULE_SET_PATH** environment variable should be set to the path of the **policy_rule_set.yaml** file, as demonstrated below:\n\n`_ = os.Setenv(\"GO_SLM_POLICY_RULE_SET_PATH\", \"/{directory}/policy_rule_set.yaml\")\n`\n\nThe **{directory}** in the above code should be replaced with the actual directory path where the **policy_rule_set.yaml** file is located.\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkaanaktas%2Fgo-slm","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkaanaktas%2Fgo-slm","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkaanaktas%2Fgo-slm/lists"}