corazawaf/coraza-caddy

Unsure if load_owasp_crs is required for using the OWASP core rule set

BurningDog opened this issue · 7 comments

BurningDog commented

I'm trying to use Coraza and the OWASP ruleset with Caddy 2.6.4 (this version of Caddy as it's the latest stable, and I'm using API Platform and its Caddyfile).

I need to use the following lines to build caddy:

RUN xcaddy build \
	--with github.com/corazawaf/coraza-caddy \
	--with github.com/corazawaf/coraza-coreruleset

...otherwise the conf files mentioned in the README don't exist anywhere: @coraza.conf-recommended, @crs-setup.conf.example, @owasp_crs/*.conf. I manually copy those files to the correct locations:

cp /go/pkg/mod/github.com/corazawaf/coraza-coreruleset*/rules/@coraza.conf-recommended /etc/caddy/@coraza.conf-recommended
cp /go/pkg/mod/github.com/corazawaf/coraza-coreruleset*/rules/@crs-setup.conf.example /etc/caddy/@crs-setup.conf.example
cp /go/pkg/mod/github.com/corazawaf/coraza-coreruleset*/rules/@owasp_crs/* /etc/caddy/@owasp_crs/

My Caddyfile is as follows:

{
        # Debug
        {$CADDY_DEBUG}

        # must be always included in your Caddyfile for Coraza module to work
        # see https://github.com/corazawaf/coraza-caddy
        order coraza_waf first
}

{$SERVER_NAME}

route {
        coraza_waf {
                load_owasp_crs
                directives `
                Include @coraza.conf-recommended
                Include @crs-setup.conf.example
                Include @owasp_crs/*.conf
                SecRuleEngine On
                `
        }

        root * /srv/app/public

        php_fastcgi unix//var/run/php/php-fpm.sock
        encode zstd gzip
        file_server
}

I've used caddy fmt --overwrite to correctly format the Caddyfile.

However, when I run caddy I get this error:

Error: adapting config using caddyfile: parsing caddyfile tokens for 'coraza_waf': Caddyfile:14 - Error during parsing: invalid key for filter directive: load_owasp_crs

However, if I comment out the load_owasp_crs directive, then caddy runs. Is this expected?

[Edit: after testing, the WAF is running, but I'm not sure how to check that the OWASP core rule set is running too?]

ameyer8 commented

@BurningDog I had this issue too. It looks like xcaddy is pulling in the latest released version of coraza-caddy and that version doesn't have support for the built in rule set. You can force xcaddy to pull from master with this command:

xcaddy build --with github.com/corazawaf/coraza-caddy@master

I did not have to specify the --with github.com/corazawaf/coraza-coreruleset

  • 👍1
  • ❤️1
jcchavezs commented

@BurningDog could you try what @ameyer8 suggests?

github-actions commented

This issue has been open 30 days waiting for feedback. Remove the stale label or comment, or this will be closed in 14 days.

jcchavezs commented

any movement on this?

github-actions commented

This issue was closed because it has been inactive for 14 days since being marked as stale.

BurningDog commented

Apologies for the long delay in my response - yes, the suggestion at #63 (comment) worked. Thanks @ameyer8!