Cannot load rules / directives from config files

[y4rr0]

Welcome!

• Yes, I've searched similar issues on GitHub and didn't find any.
• Yes, I've searched similar issues on the Traefik community forum and didn't find any.

What did you do?

I'm trying do use Core Rule Set in coraza waf. CRS is unpacked in /etc/traefik/crs4 folder. In that folder I've downloaded recommended coraza config file as described in https://coraza.io/docs/tutorials/coreruleset/
When config file is included there's error about invalid name.

http:
  middlewares:
   waf:
      plugin:
        coraza-http-wasm-traefik:
           directives:
             - Include "/etc/traefik/crs4/coraza.conf"

When including wildcard path there's no error, but rules from file / files not working

http:
  middlewares:
   waf:
      plugin:
        coraza-http-wasm-traefik:
           directives:
             - Include "/etc/traefik/crs4/*.conf"

file is readable under traefik podman container

What did you see instead?

Failed to initialize WAF: invalid WAF config from string: failed to readfile: read /etc/traefik/coraza.conf: invalid name entryPointName=secureWeb middlewareName=waf@file middlewareType=wasm routerName=routerSearx@file

What version of Traefik are you using?

Traefik version 3.0.0 built on 2024-04-29T14:25:59Z version=3.0.0

What is your environment & configuration?

middlewares.yaml

http:
  middlewares:
   waf:
      plugin:
        coraza-http-wasm-traefik:
           directives:
             - Include "/etc/traefik/crs4/coraza.conf"

traefik.yaml

experimental:
  plugins:
    cloudflarewarp:
      moduleName: "github.com/BetterCorp/cloudflarewarp"
      version: "v1.3.3"
    coraza-http-wasm-traefik:
      moduleName: "github.com/jcchavezs/coraza-http-wasm-traefik"
      version: "v0.2.1"

If applicable, please paste the log output in DEBUG level

No response

[emilevauge]

I don't think we have identified any issue on this, but maybe @jcchavezs has some clue?

[smerschjohann]

in general it would be nice to have FS access (even if limited to a special path) and (outgoing) network access. This currently limits the usefulness of the WASM integration to some really specific use cases.

[jcchavezs]

I think this is possible by setting a FS into wazero but did not have the time to try that out. However, coraza comes with CRS embedded if you want to try that. José Carlos Chávez tor. 30. mai 2024 kl. 13:27 skrev Simon Merschjohann < ***@***.***>:

…

in general it would be nice to have FS access (even if limited to a special path) and (outgoing) network access. This currently limits the usefulness of the WASM integration to some really specific use cases. — Reply to this email directly, view it on GitHub <#10739 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAXOYAVEPTVHMVJKDEQZI73ZE4EKXAVCNFSM6AAAAABH5UOOOKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMZZGM2DSMJUGA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[mmatur]

@jcchavezs I have one question regarding the directives configuration, is there a reason you have decided to have a []string?

I'm asking because if I'm a docker user and I want to use coraza traefik plugin I can't due to []string.

In Traefik for what we call label providers (docker, ecs, consulcatalog, etc...) having a []string for directives can be a blocker due to the size limit and the parsing.

The following example with yaml can't be converted to labels due to , in the following SecRule REQUEST_URI "@streq /admin" "id:101,phase:1,log,deny,status:403":

http:
  middlewares:
     waf:
        plugin:
          coraza-http-wasm-traefik:
             directives:
               - SecRuleEngine On
	       - SecDebugLog /dev/stdout
	       - SecDebugLogLevel 9
	       - SecRule REQUEST_URI "@streq /admin" "id:101,phase:1,log,deny,status:403"

Do you have an idea how we can handle that? What I have in mind is using traefik type FileOrContent instead of []string

[jcchavezs]

Hi @mmatur the reason for accepting []string is readability purposes. It is fine in YAML but if config could be defined in JSON then having everything in one line would be hard to read:

{
    "directives": "SecRuleEngine On\nSecDebugLog /dev/stdout\nSecDebugLogLevel 9\nSecRule REQUEST_URI \"@streq /admin\" \"id:101,phase:1,log,deny,status:403\""
}

Still you can define the config in a single line adding the next lines or put everything in a file and read that file but we need access to FS. Let me check if I can get that soon.

[jcchavezs]

I just opened this PR showing it is possible to mount a host file system and load the files from the coraza-http-wasm config jcchavezs/coraza-http-wasm#19.

What is missing to enable this in traefik is a way to pass the location of the mounting dir into traefik. For example

http:
# ...
  middlewares:
    waf:
      plugin:
        coraza:
          fsRootDir: /etc/traefik 
          directives:
            - SecRuleEngine On
            - SecDebugLog /dev/stdout
            - SecDebugLogLevel 9
            - SecRule REQUEST_URI "@streq /admin" "id:101,phase:1,log,deny,status:403"

where fsRootDir could be accepted for every wasm plugin. What do you think @emilevauge ?

Another option could be:

http:
# ...
  middlewares:
    waf:
      plugin:
        coraza:
          runtime: 
            rootFS: /etc/traefik 
            env:
              a: b
          directives:
            - SecRuleEngine On
            - SecDebugLog /dev/stdout
            - SecDebugLogLevel 9
            - SecRule REQUEST_URI "@streq /admin" "id:101,phase:1,log,deny,status:403"

I guess it is too late to do:

http:
# ...
  middlewares:
    waf:
      plugin:
        coraza:
          runtime: 
            rootFS: /etc/traefik 
            env:
              a: b
          config:
            directives:
              - SecRuleEngine On
              - SecDebugLog /dev/stdout
              - SecDebugLogLevel 9
              - SecRule REQUEST_URI "@streq /admin" "id:101,phase:1,log,deny,status:403"

[mmatur]

Hi @mmatur the reason for accepting []string is readability purposes. It is fine in YAML but if config could be defined in JSON then having everything in one line would be hard to read:

{
    "directives": "SecRuleEngine On\nSecDebugLog /dev/stdout\nSecDebugLogLevel 9\nSecRule REQUEST_URI \"@streq /admin\" \"id:101,phase:1,log,deny,status:403\""
}

Still you can define the config in a single line adding the next lines or put everything in a file and read that file but we need access to FS. Let me check if I can get that soon.

@jcchavezs with FileOrContent you can have yaml like that (readability is totally correct for yaml and toml):

http:
  middlewares:
     waf:
        plugin:
          coraza-http-wasm-traefik:
             directives: |
               SecRuleEngine On
	       SecDebugLog /dev/stdout
	       SecDebugLogLevel 9
	       SecRule REQUEST_URI "@streq /admin" "id:101,phase:1,log,deny,status:403"

or

http:
  middlewares:
     waf:
        plugin:
          coraza-http-wasm-traefik:
             directives: rules.txt 
             
## rules.txt content
##           SecRuleEngine On
##	       SecDebugLog /dev/stdout
##	       SecDebugLogLevel 9
##	       SecRule REQUEST_URI "@streq /admin" "id:101,phase:1,log,deny,status:403"

For labels configuration it will also simplify (one config option for string or filepath)

http.middlewares.waf.plugin.coraza-http-wasm-traefik.directives=./rules.txt

The following directives cannot be defined has labels (due to , in SecRule REQUEST_URI "@streq /admin" "id:101,phase:1,log,deny,status:403":

SecRuleEngine On
SecDebugLog /dev/stdout
SecDebugLogLevel 9
SecRule REQUEST_URI "@streq /admin" "id:101,phase:1,log,deny,status:403"

I saw your PR regarding files support for WASM plugin, will have a look next week.

Keeping directives as []string the best way to use a file to define my directives is to do something like that?

http:
# ...
  middlewares:
    waf:
      plugin:
        coraza:
          directives:
            - Include /path/coreruleset/rules/*.conf

[jcchavezs]

http:
# ...
  middlewares:
    waf:
      plugin:
        coraza:
          directives:
            - Include /path/coreruleset/rules/*.conf

I think this is OK. So talking about labels it will be

http.middlewares.waf.plugin.coraza-http-wasm-traefik.directives="Include ./rules.txt"

isn't?