-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Cannot load rules / directives from config files #10739
Comments
I don't think we have identified any issue on this, but maybe @jcchavezs has some clue? |
in general it would be nice to have FS access (even if limited to a special path) and (outgoing) network access. This currently limits the usefulness of the WASM integration to some really specific use cases. |
I think this is possible by setting a FS into wazero but did not have the
time to try that out. However, coraza comes with CRS embedded if you want
to try that.
José Carlos Chávez
tor. 30. mai 2024 kl. 13:27 skrev Simon Merschjohann <
***@***.***>:
… in general it would be nice to have FS access (even if limited to a
special path) and (outgoing) network access. This currently limits the
usefulness of the WASM integration to some really specific use cases.
—
Reply to this email directly, view it on GitHub
<#10739 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAXOYAVEPTVHMVJKDEQZI73ZE4EKXAVCNFSM6AAAAABH5UOOOKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMZZGM2DSMJUGA>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
@jcchavezs I have one question regarding the I'm asking because if I'm a docker user and I want to use coraza traefik plugin I can't due to In Traefik for what we call The following example with yaml can't be converted to labels due to http:
middlewares:
waf:
plugin:
coraza-http-wasm-traefik:
directives:
- SecRuleEngine On
- SecDebugLog /dev/stdout
- SecDebugLogLevel 9
- SecRule REQUEST_URI "@streq /admin" "id:101,phase:1,log,deny,status:403" Do you have an idea how we can handle that? What I have in mind is using traefik type FileOrContent instead of |
Hi @mmatur the reason for accepting {
"directives": "SecRuleEngine On\nSecDebugLog /dev/stdout\nSecDebugLogLevel 9\nSecRule REQUEST_URI \"@streq /admin\" \"id:101,phase:1,log,deny,status:403\""
} Still you can define the config in a single line adding the next lines or put everything in a file and read that file but we need access to FS. Let me check if I can get that soon. |
I just opened this PR showing it is possible to mount a host file system and load the files from the coraza-http-wasm config jcchavezs/coraza-http-wasm#19. What is missing to enable this in traefik is a way to pass the location of the mounting dir into traefik. For example
where Another option could be:
I guess it is too late to do:
|
@jcchavezs with FileOrContent you can have yaml like that (readability is totally correct for yaml and toml): http:
middlewares:
waf:
plugin:
coraza-http-wasm-traefik:
directives: |
SecRuleEngine On
SecDebugLog /dev/stdout
SecDebugLogLevel 9
SecRule REQUEST_URI "@streq /admin" "id:101,phase:1,log,deny,status:403" or http:
middlewares:
waf:
plugin:
coraza-http-wasm-traefik:
directives: rules.txt
## rules.txt content
## SecRuleEngine On
## SecDebugLog /dev/stdout
## SecDebugLogLevel 9
## SecRule REQUEST_URI "@streq /admin" "id:101,phase:1,log,deny,status:403" For labels configuration it will also simplify (one config option for string or filepath) http.middlewares.waf.plugin.coraza-http-wasm-traefik.directives=./rules.txt The following directives cannot be defined has labels (due to
I saw your PR regarding files support for WASM plugin, will have a look next week. Keeping http:
# ...
middlewares:
waf:
plugin:
coraza:
directives:
- Include /path/coreruleset/rules/*.conf |
I think this is OK. So talking about labels it will be
isn't? |
Welcome!
What did you do?
I'm trying do use Core Rule Set in coraza waf. CRS is unpacked in /etc/traefik/crs4 folder. In that folder I've downloaded recommended coraza config file as described in https://coraza.io/docs/tutorials/coreruleset/
When config file is included there's error about invalid name.
When including wildcard path there's no error, but rules from file / files not working
file is readable under traefik podman container
What did you see instead?
Failed to initialize WAF: invalid WAF config from string: failed to readfile: read /etc/traefik/coraza.conf: invalid name entryPointName=secureWeb middlewareName=waf@file middlewareType=wasm routerName=routerSearx@file
What version of Traefik are you using?
Traefik version 3.0.0 built on 2024-04-29T14:25:59Z version=3.0.0
What is your environment & configuration?
middlewares.yaml
traefik.yaml
If applicable, please paste the log output in DEBUG level
No response
The text was updated successfully, but these errors were encountered: