Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

updates to CRS v4.0.0-rc2, sets equal BodyLimits in default configs #243

Merged
merged 5 commits into from
Nov 24, 2023
Merged

updates to CRS v4.0.0-rc2, sets equal BodyLimits in default configs #243

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
31b7247
updates to CRS v4.0.0-rc2, sets equal BodyLimits in default configs
M4tteoP Oct 25, 2023
6c34522
comments out RequestBodyNoFilesLimit
M4tteoP Oct 26, 2023
5af23ed
adds comment about SecRequestBodyNoFilesLimit (sync with coraza upstr…
M4tteoP Oct 30, 2023
9af30a0
aligns request body limits to 131072, sets process partial by default…
M4tteoP Nov 21, 2023
b05f219
ftw.yml
M4tteoP Nov 24, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@

Web Application Firewall WASM filter built on top of [Coraza](https://github.com/corazawaf/coraza) and implementing the [proxy-wasm ABI](https://github.com/proxy-wasm/spec). It can be loaded directly from Envoy or also used as an Istio plugin.

Mind that a WAF is not a plug-and-play security solution. It requires a configuration and tuning tailored to the environment and traffic the WAF is meant to protect to be effective. For production usage, it is strongly recommended to be fully aware of the deployed configurations (See [@recommended-conf](./wasmplugin/rules/coraza.conf-recommended.conf) and [@crs-setup-conf](./wasmplugin/rules/crs-setup.conf.example)) and to perform a tuning phase of the rule set used. For more information on tuning the OWASP Core Rule Set (CRS), please refer to the [False Positives and Tuning](https://coreruleset.org/docs/concepts/false_positives_tuning/) guide.

## Getting started

`go run mage.go -l` lists all the available commands:
Expand Down Expand Up @@ -106,7 +108,7 @@ configuration:
"Include @demo-conf",
"SecDebugLogLevel 9",
"SecRuleEngine On",
"Include @crs-setup-demo-conf",
"Include @crs-setup-conf",
"Include @owasp_crs/*.conf"
]
},
Expand All @@ -126,15 +128,15 @@ configuration:
"Include @demo-conf",
"SecDebugLogLevel 9",
"SecRuleEngine On",
"Include @crs-setup-demo-conf",
"Include @crs-setup-conf",
"Include @owasp_crs/REQUEST-901-INITIALIZATION.conf"
]
},
"default_directives": "default"
}
```

#### Recommendations using CRS with proxy-wasm
#### Recommendations using CRS with coraza-proxy-wasm

- In order to mitigate as much as possible malicious requests (or connections open) sent upstream, it is recommended to keep the [CRS Early Blocking](https://coreruleset.org/20220302/the-case-for-early-blocking/) feature enabled (SecAction [`900120`](./wasmplugin/rules/crs-setup.conf.example)).

Expand All @@ -159,7 +161,7 @@ FTW_INCLUDE=920410 go run mage.go ftw
Once the filter is built, via the commands `go run mage.go runEnvoyExample`, `go run mage.go reloadEnvoyExample`, and `go run mage.go teardownEnvoyExample` you can spin up, test, and tear down the test environment.
Envoy with the coraza-wasm filter will be reachable at `localhost:8080`.
The filter is configured with the CRS loaded working in Anomaly Scoring mode.
For details and locally tweaking the configuration refer to [@demo-conf](./wasmplugin/rules/coraza-demo.conf) and [@crs-setup-demo-conf](./wasmplugin/rules/crs-setup-demo.conf).
For details and locally tweaking the configuration refer to [@recommended-conf](./wasmplugin/rules/coraza.conf-recommended.conf) and [@crs-setup-conf](./wasmplugin/rules/crs-setup.conf.example).

In order to monitor envoy logs while performing requests you can run:

Expand Down
4 changes: 2 additions & 2 deletions example/envoy/envoy-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ static_resources:
"directives_map": {
"rs1": [
"Include @demo-conf",
"Include @crs-setup-demo-conf",
"Include @crs-setup-conf",
"SecDefaultAction \"phase:3,log,auditlog,pass\"",
"SecDefaultAction \"phase:4,log,auditlog,pass\"",
"SecDefaultAction \"phase:5,log,auditlog,pass\"",
Expand All @@ -66,7 +66,7 @@ static_resources:
],
"rs2": [
"Include @demo-conf",
"Include @crs-setup-demo-conf",
"Include @crs-setup-conf",
"SecDefaultAction \"phase:3,log,auditlog,pass\"",
"SecDefaultAction \"phase:4,log,auditlog,pass\"",
"SecDefaultAction \"phase:5,log,auditlog,pass\"",
Expand Down
6 changes: 3 additions & 3 deletions example/istio/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ spec:
- Include @demo-conf
- SecDebugLogLevel 9
- SecRuleEngine On
- Include @crs-setup-demo-conf
- Include @crs-setup-conf
- Include @owasp_crs/*.conf
selector:
matchLabels:
Expand Down Expand Up @@ -82,7 +82,7 @@ spec:
- Include @demo-conf
- SecDebugLogLevel 9
- SecRuleEngine On
- Include @crs-setup-demo-conf
- Include @crs-setup-conf
- Include @owasp_crs/*.conf
selector:
matchLabels:
Expand Down Expand Up @@ -127,4 +127,4 @@ Coraza: Warning. Javascript method detected [file "@owasp_crs/REQUEST-941-APPLIC
[tag "application-multi"] [tag "language-multi"] [tag "attack-xss"] [tag "paranoia-level/1"]
[tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "my-hostname"] [uri "/anything/?arg=<script>alert(0)</script>"]
[unique_id "wTueIQloYpvpWNLzVfy"] thread=27
```
```
6 changes: 3 additions & 3 deletions ftw/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,9 @@ RUN apk update && apk add curl

WORKDIR /workspace

# TODO update when new CRS version is tagged: https://github.com/coreruleset/coreruleset/archive/refs/tags/v4.0.0-rc1.tar.gz
ADD https://github.com/coreruleset/coreruleset/tarball/477d8c3431d042294af2651f08d63d10b6f3fd60 /workspace/coreruleset/
RUN cd coreruleset && tar -xf 477d8c3431d042294af2651f08d63d10b6f3fd60 --strip-components 1
# TODO update when new CRS version is tagged: https://github.com/coreruleset/coreruleset/archive/refs/tags/v4.0.0-rc2.tar.gz
ADD https://github.com/coreruleset/coreruleset/tarball/2b92d53ea708babbca8da06cd13decffbc9e31b5 /workspace/coreruleset/
RUN cd coreruleset && tar -xf 2b92d53ea708babbca8da06cd13decffbc9e31b5 --strip-components 1

COPY ftw.yml /workspace/ftw.yml
COPY tests.sh /workspace/tests.sh
Expand Down
15 changes: 5 additions & 10 deletions ftw/ftw.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,6 @@ testoverride:
'920100-16': 'Invalid HTTP request line. Rejected by Envoy with Error 400'
'949110-4': 'Related to 920100. Invalid HTTP method. Rejected by Envoy with Error 400'
'941110-4': 'Referer header is sanitized by Envoy and removed from the request'
'941110-9': 'Referer header is sanitized by Envoy and removed from the request'
'920270-5': 'Referer header is sanitized by Envoy and removed from the request'
'941101-1': 'Referer header is sanitized by Envoy and removed from the request'
'920210-2': 'Connection header is stripped out by Envoy'
'920210-3': 'Connection header is stripped out by Envoy'
Expand All @@ -26,17 +24,13 @@ testoverride:
'920274-3': 'PL4 - False positive. Envoy Populates :path header, therefore invalid character are detected'
'920274-5': 'PL4 - False positive. Envoy Populates :path header, therefore invalid character are detected'
'932161-7': 'Referer header is sanitized by Envoy and removed from the request'
'932161-8': 'Referer header is sanitized by Envoy and removed from the request'
'932161-9': 'Referer header is sanitized by Envoy and removed from the request'
'932161-10': 'Referer header is sanitized by Envoy and removed from the request'
'932161-11': 'Referer header is sanitized by Envoy and removed from the request'
'932161-12': 'Referer header is sanitized by Envoy and removed from the request'
'932236-6': 'Referer header is sanitized by Envoy and removed from the request'
'932236-7': 'Referer header is sanitized by Envoy and removed from the request'
'932236-28': 'Referer header is sanitized by Envoy and removed from the request'
'932237-6': 'Referer header is sanitized by Envoy and removed from the request'
'932237-7': 'Referer header is sanitized by Envoy and removed from the request'
'932237-8': 'Referer header is sanitized by Envoy and removed from the request'
'932239-6': 'Referer header is sanitized by Envoy and removed from the request'
'932239-7': 'Referer header is sanitized by Envoy and removed from the request'
'932239-19': 'Referer header is sanitized by Envoy and removed from the request'

# Rules working, tests excluded for different expected output
'920270-4': 'Log contains 920270. Test has log_contains disabled.'
Expand All @@ -48,7 +42,6 @@ testoverride:
'920280-3': 'Rule 920280 not detected. Host not present. Coraza side'
'920290-1': 'Rule 920290 not detected. Empty Host. Coraza side'
'920430-3': 'Rule 920430 not detected. Proto version. Coraza side'
'920430-5': 'Rule 920430 not detected. Proto version. Coraza side'
'920430-8': 'Rule 920430 not detected. Proto version. Coraza side'
'920430-9': 'Rule 920430 not detected. Proto version. Coraza side'
'934120-23': 'Rule 934120 partially detected. With HTTP/1.1 Envoy return 400. With HTTP/2 Enclosed alphanumerics not detected. Coraza Side'
Expand All @@ -57,3 +50,5 @@ testoverride:
'934120-26': 'Rule 934120 partially detected. With HTTP/1.1 Envoy return 400. With HTTP/2 Enclosed alphanumerics not detected. Coraza Side'
'934120-39': 'Rule 934120 partially detected. With HTTP/1.1 Envoy return 400. With HTTP/2 Enclosed alphanumerics not detected. Coraza Side'
'932200-13': 'Unfortunate match inside logs against a different rule log. wip'
'934131-5': 'See https://github.com/corazawaf/coraza/pull/899'
'934131-7': 'See https://github.com/corazawaf/coraza/pull/899'
4 changes: 2 additions & 2 deletions lifecycle_multiphase_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,7 +139,7 @@ func TestLifecycleMultiPhase(t *testing.T) {
{
name: "944150 - Deny anticipated at request headers phase from response headers phase",
inlineRules: `
Include @demo-conf\nInclude @crs-setup-demo-conf\nInclude @owasp_crs/*.conf
Include @demo-conf\nInclude @crs-setup-conf\nInclude @owasp_crs/*.conf
`,
reqHdrs: [][2]string{
{":path", "/"},
Expand All @@ -154,7 +154,7 @@ func TestLifecycleMultiPhase(t *testing.T) {
{
name: "943120 - Deny anticipated at request headers phase from response headers phase",
inlineRules: `
Include @demo-conf\nInclude @crs-setup-demo-conf\nInclude @owasp_crs/*.conf
Include @demo-conf\nInclude @crs-setup-conf\nInclude @owasp_crs/*.conf
`,
reqHdrs: [][2]string{
{":path", "/login.php?jsessionid=74B0CB414BD77D17B5680A6386EF1666"},
Expand Down
2 changes: 1 addition & 1 deletion wasmplugin/fs.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ func init() {
map[string]string{
"@recommended-conf": "coraza.conf-recommended.conf",
"@demo-conf": "coraza-demo.conf",
"@crs-setup-demo-conf": "crs-setup-demo.conf",
"@crs-setup-demo-conf": "crs-setup.conf.example", // Deprecated, points to @crs-setup-conf
"@ftw-conf": "ftw-config.conf",
"@crs-setup-conf": "crs-setup.conf.example",
},
Expand Down
19 changes: 7 additions & 12 deletions wasmplugin/rules/coraza-demo.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,18 +41,21 @@ SecRule REQUEST_HEADERS:Content-Type "^application/json" \
# to the size of data, with files excluded. You want to keep that value as
# low as practical.
#
SecRequestBodyLimit 13107200
# Running as a Wasm plugin, we expect Limit equal to MemoryLimit: it would be prevented buffering request body to files anyways.

SecRequestBodyLimit 131072

SecRequestBodyInMemoryLimit 131072

SecRequestBodyNoFilesLimit 131072
# SecRequestBodyNoFilesLimit is currently not supported by Coraza
# SecRequestBodyNoFilesLimit 131072
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think SecRequestBodyNoFilesLimit is not implemented Coraza side, we should at least comment it out, not letting users think that it is enforced.


# What to do if the request body size is above our configured limit.
# Keep in mind that this setting will automatically be set to ProcessPartial
# when SecRuleEngine is set to DetectionOnly mode in order to minimize
# disruptions when initially deploying Coraza.
#
SecRequestBodyLimitAction Reject
SecRequestBodyLimitAction ProcessPartial

# Verify that we've correctly processed the request body.
# As a rule of thumb, when failing to process a request body
Expand Down Expand Up @@ -168,19 +171,11 @@ SecResponseBodyLimitAction ProcessPartial

# -- Filesystem configuration ------------------------------------------------

# The location where Coraza stores temporary files (for example, when
# it needs to handle a file upload that is larger than the configured limit).
#
# This default setting is chosen due to all systems have /tmp available however,
# this is less than ideal. It is recommended that you specify a location that's private.
#
SecTmpDir /tmp/

# The location where Coraza will keep its persistent data. This default setting
# is chosen due to all systems have /tmp available however, it
# too should be updated to a place that other users can't access.
#
SecDataDir /tmp/
# SecDataDir /tmp/


# -- File uploads handling configuration -------------------------------------
Expand Down
18 changes: 6 additions & 12 deletions wasmplugin/rules/coraza.conf-recommended.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,11 +41,13 @@ SecRule REQUEST_HEADERS:Content-Type "^application/json" \
# to the size of data, with files excluded. You want to keep that value as
# low as practical.
#
# Running as a Wasm plugin, we expect Limit equal to MemoryLimit: it would be prevented buffering request body to files anyways.

SecRequestBodyLimit 13107200

SecRequestBodyInMemoryLimit 131072
SecRequestBodyInMemoryLimit 13107200
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this change connected to the 1gb?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, it is about:

Not being able to split the request between memory and then into a file after a certain limit, for coraza-proxy-wasm the two limits should be the same


SecRequestBodyNoFilesLimit 131072
# SecRequestBodyNoFilesLimit 131072

# What to do if the request body size is above our configured limit.
# Keep in mind that this setting will automatically be set to ProcessPartial
Expand Down Expand Up @@ -168,19 +170,11 @@ SecResponseBodyLimitAction ProcessPartial

# -- Filesystem configuration ------------------------------------------------

# The location where Coraza stores temporary files (for example, when
# it needs to handle a file upload that is larger than the configured limit).
#
# This default setting is chosen due to all systems have /tmp available however,
# this is less than ideal. It is recommended that you specify a location that's private.
#
SecTmpDir /tmp/

# The location where Coraza will keep its persistent data. This default setting
# The location where Coraza will keep its persistent data. This default setting
# is chosen due to all systems have /tmp available however, it
# too should be updated to a place that other users can't access.
#
SecDataDir /tmp/
# SecDataDir /tmp/


# -- File uploads handling configuration -------------------------------------
Expand Down
Loading