Skip to content

Commit

Permalink
cleanup crs version and fix ctrl-f replace mess
Browse files Browse the repository at this point in the history
  • Loading branch information
@electricjesus
electricjesus committed Mar 8, 2024
1 parent 8ec20e3 commit 933e614
Showing 1 changed file with 11 additions and 11 deletions.
22 changes: 11 additions & 11 deletions calico-enterprise/threat/web-application-firewall.mdx
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,16 +25,16 @@ Historically, web application firewalls (WAFs) were deployed at the edge of your
### About {{prodname}} WAF

WAF is deployed in your cluster along with Envoy DaemonSet. {{prodname}} proxies selected service traffic through Envoy, checking HTTP requests using the industry-standard
[ModSecurity](https://owasp.org/www-project-modsecurity-core-rule-set/) with OWASP Core Rule Set v3.3.5 modified for kubernetes workloads.
<!--To review the rules deployed with the WAF, see [Rule Set files](https://github.com/tigera/operator/tree/master/pkg/render/applicationlayer/embed/corerule set/rules).-->
[ModSecurity](https://owasp.org/www-project-modsecurity-core-rule-set/) with OWASP Core Rule Set `v4.0.0-rc2` with some modifications for kubernetes workloads.

Check failure on line 28 in calico-enterprise/threat/web-application-firewall.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'kubernetes'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'kubernetes'?", "location": {"path": "calico-enterprise/threat/web-application-firewall.mdx", "range": {"start": {"line": 28, "column": 139}}}, "severity": "ERROR"}


You simply enable WAF in Manager UI, and determine the services that you want to enable for WAF protection. By default WAF is set to `DetectionOnly` so no traffic will be denied until you are ready to turn on blocking mode.

Every request that WAF finds an issue with, will result in a Security Event being created for [you to review in the UI](#view-waf-events), regardless of whether the traffic was allowed or denied. This can greatly help in tuning later.

#### How WAF determines if a request should be allowed or denied

If you configure WAF in blocking mode, WAF will use something called [anomaly scoring mode](https://corerule set.org/docs/concepts/anomaly_scoring/) to determine if a request is allowed with `200 OK` or denied `403 Forbidden`.
If you configure WAF in blocking mode, WAF will use something called [anomaly scoring mode](https://coreruleset.org/docs/concepts/anomaly_scoring/) to determine if a request is allowed with `200 OK` or denied `403 Forbidden`.

This works by matching a single HTTP request against all the configured WAF rules. Each rule has a score and WAF adds all the matched rule scores together, and compares it to the overall anomaly threshold score (100 by default). If the score is under the threshold the request is allowed and if the score is over the threshold the request is denied. Our WAF starts in detection mode only and with a high default scoring threshold so is safe to turn on and then [fine-tune the WAF](#manage-your-waf) for your specific needs in your cluster.

Expand Down Expand Up @@ -176,10 +176,10 @@ Include @owasp_crs/*.conf
SecRuleEngine DetectionOnly
```

The configuration file starts with importing the appropriate rule set config. We use Coraza WAF's recommended [Core Rule Set setup](https://coraza.io/docs/tutorials/corerule set/) files:
The configuration file starts with importing the appropriate rule set config. We use Coraza WAF's recommended [Core Rule Set setup](https://coraza.io/docs/tutorials/coreruleset/) files:

Check failure on line 179 in calico-enterprise/threat/web-application-firewall.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'config'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'config'?", "location": {"path": "calico-enterprise/threat/web-application-firewall.mdx", "range": {"start": {"line": 179, "column": 71}}}, "severity": "ERROR"}

Check failure on line 179 in calico-enterprise/threat/web-application-firewall.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'Coraza'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'Coraza'?", "location": {"path": "calico-enterprise/threat/web-application-firewall.mdx", "range": {"start": {"line": 179, "column": 86}}}, "severity": "ERROR"}

Check failure on line 179 in calico-enterprise/threat/web-application-firewall.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'WAF's'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'WAF's'?", "location": {"path": "calico-enterprise/threat/web-application-firewall.mdx", "range": {"start": {"line": 179, "column": 93}}}, "severity": "ERROR"}

1. Coraza recommended [configuration](https://github.com/corazawaf/coraza/blob/main/coraza.conf-recommended)

Check failure on line 181 in calico-enterprise/threat/web-application-firewall.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'Coraza'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'Coraza'?", "location": {"path": "calico-enterprise/threat/web-application-firewall.mdx", "range": {"start": {"line": 181, "column": 4}}}, "severity": "ERROR"}
1. The rest of the [corerule set](https://github.com/corerule set/corerule set) files, currently [v4.0.0-rc2](https://github.com/corerule set/corerule set/tree/v4.0.0-rc2)
1. The rest of the [coreruleset](https://github.com/coreruleset/coreruleset) files, currently [v4.0.0-rc2](https://github.com/coreruleset/coreruleset/tree/v4.0.0-rc2)

Check failure on line 182 in calico-enterprise/threat/web-application-firewall.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'coreruleset'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'coreruleset'?", "location": {"path": "calico-enterprise/threat/web-application-firewall.mdx", "range": {"start": {"line": 182, "column": 21}}}, "severity": "ERROR"}

These files can be customized if desired. Add all your customizations directly under `tigera.conf`:

Expand Down Expand Up @@ -220,12 +220,12 @@ By default WAF will not block a request even if it has matching rule violations.

##### Other basic customizations

For basic customizations, it's best to add it after all the includes in `tigera.conf`. In fact, this is the reason why the `SecRuleEngine` directive and the rest of [our customizations](https://github.com/tigera/operator/blob/master/pkg/render/applicationlayer/embed/corerule set/tigera.conf#L8-L17) are situated there.
For basic customizations, it's best to add it after all the includes in `tigera.conf`. In fact, this is the reason why the `SecRuleEngine` directive and the rest of [our customizations](https://github.com/tigera/operator/blob/master/pkg/render/applicationlayer/embed/coreruleset/tigera.conf#L8-L17) are situated there.

An example is adding a sampling mode. For that, the tigera.conf will look like this:

Check failure on line 225 in calico-enterprise/threat/web-application-firewall.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Terms] Use 'Tigera' instead of 'tigera'.

Raw Output:
{"message": "[Vale.Terms] Use 'Tigera' instead of 'tigera'.", "location": {"path": "calico-enterprise/threat/web-application-firewall.mdx", "range": {"start": {"line": 225, "column": 53}}}, "severity": "ERROR"}

```bash
# CoreRule Set activation
# coreruleset activation
Include @coraza.conf-recommended
Include @crs-setup.conf.example
Include @owasp_crs/*.conf
Expand All @@ -235,7 +235,7 @@ SecRuleEngine DetectionOnly
# --- all customizations appear below this line, unless they need a specific loading order like plugins ---

# --- Add sampling mode
# Read about sampling mode here https://corerule set.org/docs/concepts/sampling_mode/
# Read about sampling mode here https://coreruleset.org/docs/concepts/sampling_mode/
SecAction "id:900400,\
phase:1,\
pass,\
Expand Down Expand Up @@ -277,9 +277,9 @@ SecAction \
```


##### Using corerule set plugins
##### Using coreruleset plugins

Check failure on line 280 in calico-enterprise/threat/web-application-firewall.mdx

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'coreruleset'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'coreruleset'?", "location": {"path": "calico-enterprise/threat/web-application-firewall.mdx", "range": {"start": {"line": 280, "column": 13}}}, "severity": "ERROR"}

Let's go with an example plugin: [Wordpress Rule Exclusions](https://github.com/corerule set/wordpress-rule-exclusions-plugin/).
Let's go with an example plugin: [Wordpress Rule Exclusions](https://github.com/coreruleset/wordpress-rule-exclusions-plugin/).

Plugin files are the following:

Expand Down Expand Up @@ -328,7 +328,7 @@ kubectl create cm --dry-run=client \
kubectl replace -f rule set.configmap.yaml
```

Read more about the order of execution for plugins here: https://corerule set.org/docs/concepts/plugins/
Read more about the order of execution for plugins here: https://coreruleset.org/docs/concepts/plugins/

### View WAF events

Expand Down

0 comments on commit 933e614

Please sign in to comment.