config.php

<?php

declare(strict_types=1);

$function = [
	'block_detected_attack' => true,
	'block_suspected_attack' => true,
	'block_sensitive_response' => true,
	'replace_fake_flag' => true,
	'ip_rate_limit' => true,
];

$config = [
	'function' => $function,
	'flag_path' => '/flag',
	'flag_regex' => '/flag\{[^\r\n]{1,128}\}/i',
	'fake_flag' => '',
	'log_path' => '/tmp/waf/data.log',
	'key_hash' => '',
	'max_input_bytes' => 8192,
	'traffic_sampling_interval_ms' => 1000,
	'ip_rate_limit_window_sec' => 5,
	'ip_rate_limit_max_requests' => 20,
	'ip_rate_limit_store_path' => '/tmp/waf/rate_limit.log',
	'exclude_dirs' => ['./waf/'],
	'inject_root' => '/var/www/html/',
];

function random_uuid_v4(): string
{
	$data = random_bytes(16);
	$data[6] = chr((ord($data[6]) & 0x0f) | 0x40);
	$data[8] = chr((ord($data[8]) & 0x3f) | 0x80);
	$hex = bin2hex($data);

	return sprintf(
		'%s-%s-%s-%s-%s',
		substr($hex, 0, 8),
		substr($hex, 8, 4),
		substr($hex, 12, 4),
		substr($hex, 16, 4),
		substr($hex, 20, 12)
	);
}

function fake_flag_from_regex(string $flagRegex): string
{
	$prefix = 'flag';
	$regex = trim($flagRegex);

	if ($regex !== '' && strlen($regex) >= 3) {
		$delimiter = $regex[0];
		$endPos = strrpos($regex, $delimiter);
		if ($endPos !== false && $endPos > 1) {
			$pattern = substr($regex, 1, $endPos - 1);
			$bracePos = strpos($pattern, '\\{');
			if ($bracePos === false) {
				$bracePos = strpos($pattern, '{');
			}

			if ($bracePos !== false && $bracePos > 0) {
				$rawPrefix = substr($pattern, 0, $bracePos);
				$rawPrefix = preg_replace('/\\\\(.)/', '$1', $rawPrefix) ?? $rawPrefix;
				$rawPrefix = trim($rawPrefix, "^$()[]?:| \\t\\n\\r\\0\\x0B");
				$cleanPrefix = preg_replace('/[^A-Za-z0-9_-]/', '', $rawPrefix) ?? '';
				if ($cleanPrefix !== '') {
					$prefix = $cleanPrefix;
				}
			}
		}
	}

	return $prefix . '{' . random_uuid_v4() . '}';
}

if (!is_array($config['exclude_dirs'])) {
	$config['exclude_dirs'] = ['./waf/'];
}
if (!is_array($config['function'])) {
	$config['function'] = $function;
}

$config['function'] = array_merge($function, $config['function']);
foreach ($config['function'] as $k => $v) {
	$config['function'][(string)$k] = (bool)$v;
}

$config['max_input_bytes'] = max(256, (int)$config['max_input_bytes']);
$config['traffic_sampling_interval_ms'] = max(500, (int)($config['traffic_sampling_interval_ms'] ?? 1000));
$config['ip_rate_limit_window_sec'] = max(1, (int)($config['ip_rate_limit_window_sec'] ?? 5));
$config['ip_rate_limit_max_requests'] = max(1, (int)($config['ip_rate_limit_max_requests'] ?? 20));
$config['ip_rate_limit_store_path'] = (string)($config['ip_rate_limit_store_path'] ?? ('/tmp/waf/rate_limit.log'));
$config['flag_path'] = (string)($config['flag_path'] ?? '/etc/flag');
$config['flag_regex'] = trim((string)($config['flag_regex'] ?? '/flag\{[^\r\n]{1,128}\}/i'));
$config['fake_flag'] = trim((string)($config['fake_flag'] ?? ''));
if ($config['fake_flag'] === '') {
	$config['fake_flag'] = fake_flag_from_regex($config['flag_regex']);
}
$config['key_hash'] = (string)($config['key_hash'] ?? '');
$config['log_path'] = (string)($config['log_path'] ?? '/tmp/waf/data.log');
$config['inject_root'] = (string)($config['inject_root'] ?? '/var/www/html/');

return $config;