增加waf模块

waf/rules/local/custom.conf

@@ -0,0 +1,26 @@
+# custom.conf —— 本地自定义规则示例
+# ID 段：100000-199999
+
+# 100001: 拦截 SQL 注入特征（UNION SELECT）
+SecRule REQUEST_URI|ARGS "@rx (?i)union[\s/*]+select" \
+    "id:100001,phase:1,deny,status:403,log,msg:'SQL injection: UNION SELECT'"
+
+# 100002: 拦截 SQL 注释符
+SecRule ARGS "@rx (?i)(--|#|/\*.*\*/)" \
+    "id:100002,phase:2,deny,status:403,log,msg:'SQL injection: comment'"
+
+# 100003: 拦截 XSS 标签
+SecRule ARGS|REQUEST_HEADERS "@rx (?i)<script|javascript:|onerror=|onload=" \
+    "id:100003,phase:2,deny,status:403,log,msg:'XSS probe'"
+
+# 100004: 路径遍历
+SecRule REQUEST_URI|ARGS "@rx (?i)\.\./|\.\.%2f|\.\.%5c" \
+    "id:100004,phase:1,deny,status:403,log,msg:'Path traversal'"
+
+# 100005: 命令注入常见关键字
+SecRule ARGS "@rx (?i)(;|\|)&?\s*(cat|ls|id|whoami|uname|wget|curl|bash|sh)\s" \
+    "id:100005,phase:2,deny,status:403,log,msg:'Command injection'"
+
+# 100006: 已知恶意扫描器 UA
+SecRule REQUEST_HEADERS:User-Agent "@rx (?i)(nikto|sqlmap|nmap|masscan|acunetix|nessus)" \
+    "id:100006,phase:1,deny,status:403,log,msg:'Malicious scanner UA'"

waf/rules/local/exceptions.conf

@@ -0,0 +1,6 @@
+# exceptions.conf —— 误报白名单
+# 当某条 CRS 规则误报时，在此用 SecRuleRemoveById 或 ctl:ruleRemoveById 关闭
+#
+# 示例：关闭 100003 对 /login 路径的检查
+# SecRule REQUEST_URI "@beginsWith /login" \
+#     "id:100100,phase:1,pass,nolog,ctl:ruleRemoveById=100003"