projekte/edgeguard-native
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(waf): continue-on-error + timeout 1s + alle CRS-Dateien — v1.2.73

Browse Source 
- SPOE-Config: option continue-on-error — HAProxy blockt nie wegen
  SPOE-Timeout (z.B. CRS-Engine-Load beim ersten Request). Ohne dieses
  Flag waren alle Requests geblockt wenn der WAF-Agent kurz nicht
  antwortete, auch für Domains ohne WAF-Konfiguration.
- SPOE-Config: timeout processing 50ms → 1s — CRS-Load braucht >50ms
- postinst: *.conf → * beim CRS-Copy — .data-Dateien wurden nicht
  mitkopiert, SecRule @pmFromFile scanners-user-agents.data fehlte

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Debian
2026-06-02 22:30:17 +02:00
parent 05ac3344fa
commit 884c52a8f3
3 changed files with 20 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
VERSION
View File

@@ -1 +1 @@
1.2.72 1.2.73

29
internal/haproxy/haproxy.go
View File

@@ -142,19 +142,26 @@ func (g *Generator) Render(ctx context.Context) error {
} }
// spoeCfg is the static SPOE configuration for edgeguard-waf. // spoeCfg is the static SPOE configuration for edgeguard-waf.
// It tells HAProxy which variables to forward and where the agent listens. // HAProxy 3.x format: [<engine-name>] section + spoe-agent / spoe-message
// (no square brackets around spoe-agent/spoe-message keywords).
// spoeCfg uses `option continue-on-error` so that HAProxy never blocks
// a request when the SPOE agent is slow or unavailable. Without this,
// a timeout during CRS engine initialization would block all traffic,
// including domains without WAF configured.
const spoeCfg = `# Generated by edgeguard-api. DO NOT EDIT. const spoeCfg = `# Generated by edgeguard-api. DO NOT EDIT.
[spoe-agent edgeguard-waf-agent] [edgeguard-waf]
messages edgeguard-waf-req spoe-agent edgeguard-waf-agent
option var-prefix waf messages edgeguard-waf-req
timeout hello 100ms option var-prefix waf
timeout idle 30s option continue-on-error
timeout processing 50ms timeout hello 100ms
use-backend spoe-edgeguard-waf timeout idle 30s
timeout processing 1s
use-backend spoe-edgeguard-waf
[spoe-message edgeguard-waf-req] spoe-message edgeguard-waf-req
args src=src method=method uri=url ver=req.ver headers=req.hdrs host=req.hdr(host) args src=src method=method uri=url ver=req.ver headers=req.hdrs host=req.hdr(host)
event on-frontend-http-request event on-frontend-http-request
` `
// View is what the template consumes. Routes per domain are pre- // View is what the template consumes. Routes per domain are pre-

2
packaging/debian/edgeguard-api/DEBIAN/postinst
View File

@@ -812,7 +812,7 @@ EOSQL
CRS_SRC="${CRS_TMP}/coreruleset-${CRS_VERSION}" CRS_SRC="${CRS_TMP}/coreruleset-${CRS_VERSION}"
if [ -f "${CRS_SRC}/crs-setup.conf.example" ]; then if [ -f "${CRS_SRC}/crs-setup.conf.example" ]; then
install -m 0644 "${CRS_SRC}/crs-setup.conf.example" "${WAF_CRS_DIR}/crs-setup.conf" install -m 0644 "${CRS_SRC}/crs-setup.conf.example" "${WAF_CRS_DIR}/crs-setup.conf"
install -m 0644 "${CRS_SRC}/rules/"*.conf "${WAF_CRS_DIR}/rules/" 2>/dev/null || true install -m 0644 "${CRS_SRC}/rules/"* "${WAF_CRS_DIR}/rules/" 2>/dev/null || true
chown -R "$EG_USER":"$EG_USER" "$WAF_CRS_DIR" chown -R "$EG_USER":"$EG_USER" "$WAF_CRS_DIR"
echo "postinst: OWASP CRS v${CRS_VERSION} installed to ${WAF_CRS_DIR}" echo "postinst: OWASP CRS v${CRS_VERSION} installed to ${WAF_CRS_DIR}"
else else