update to CRS v4.3.0

[arminabf]

Updates the CRS version to v4.3.0

[M4tteoP]

Thanks for raising this!

[M4tteoP]

Regarding this, we should also agree on which are the CRS versions expected to be shipped in the wasm module. I would maybe update the CRS version until a v4.x version is marked as LTS and then clearly document (possibly also taking advantage of https://github.com/corazawaf/coraza-coreruleset) how to embed a specific CRS version, but sticking with the LTS ones in the main image. cc @jcchavezs

[arminabf]

Thanks for raising this!

Thank you for the review and the suggested change!

[jcchavezs]

That sounds reasonable to me @M4tteoP. Probably once we have a LTS we can provide two binaries, one for latest CRS and another one for LTS. DO you mind opening an issue?

…

On Wed, Jun 19, 2024 at 10:01 AM Armin Abfalterer ***@***.***> wrote: Thanks for raising this! Thank you for the review and the suggested change! — Reply to this email directly, view it on GitHub <#276 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAXOYAXBFOXR4CBB4PB6MB3ZIE3GFAVCNFSM6AAAAABI25MN7WVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCNZYGAZDEMRSGQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[M4tteoP]

Things are getting better and CRS tests are now running :)
What we are missing here is to also update them. CRS tests version is based on these lines: https://github.com/corazawaf/coraza-proxy-wasm/blob/main/ftw/Dockerfile#L10-L12.

Something like this should work (I'm unsure why we went with the sha, but try directly with the tag):

# TODO update when new CRS version is tagged: https://github.com/coreruleset/coreruleset/archive/refs/tags/v4.0.0-rc2.tar.gz
ADD https://github.com/coreruleset/coreruleset/archive/refs/tags/v4.3.0.tar.gz /workspace/coreruleset/
RUN cd coreruleset && tar -xf v4.3.0.tar.gz --strip-components 1

The final step will be to see if there are any failing tests and investigate why (probably some of them have a common root already spotted in Coraza upstream), I will keep an eye on it

[M4tteoP]

I added a commit with a few more changes and some comments to explain them. Looks good to me, thanks again for your contribution!
@jcchavezs for a second check/approval considering rule changes

[arminabf]

@M4tteoP, @jcchavezs Thank you for your contributions. We are eager to deploy the new version to production and would like to inquire about the timeline for the next release.

[M4tteoP]

@arminabf plans are to have it by the end of this week including bringing in the Coraza v3.2 release that unblocks #263