jcchavezs
commented
1 year ago What is the log you configured in envoy?
On Tue, 20 Jun 2023, 11:02 Erictang, @.***> wrote:
I set the Wasm EnvoyFilter as follows, and the config_dump is also effective, but I used sqlmap zaproxy to simulate the attack, and I did not see the log output of wasm denial of the attack, even if SecDebugLogLevel is set to 9,
I checked http_filters and confirmed that the inbound configuration on port 15006 has loaded the type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm rule
Why can't I see the wasm denial attack log? Is it because envoy.filters.http.wasm has not taken effect? Because the system also has a default istio.metadata_exchange wasm configuration? But my customized envoy.filters.http.wasm is INSERT_BEFORE priority
istio version 1.17.2
apiVersion: networking.istio.io/v1alpha3 kind: EnvoyFilter metadata: name: httpconnectionmanager spec: configPatches:
applyTo: HTTP_FILTER match: listener: filterChain: filter: name: envoy.filters.network.http_connection_manager patch: operation: INSERT_BEFORE value: name: envoy.filters.http.wasm typed_config: @.': type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm config: configuration: @.': type.googleapis.com/google.protobuf.StringValue value: | { "directives_map": { "default": [ "SecDebugLogLevel 9", "SecRuleEngine On", "SecAuditEngine RelevantOnly", "SecAuditLogParts ABIJDEFHZ", "SecAuditLogType Concurrent", "SecAuditLogRelevantStatus ^(1[0-9]{2}|2[0-9]{2}|3[0-8][0-9]|39[0-9]|40[0-3]|405|5[0-9]{2})$", "Include @crs-setup-demo-conf", "Include @owasp_crs/*.conf" ] }, "default_directives": "default" } root_id: my-wasm-root-id vm_config: code: local: filename: /data/coraza/main.wasm runtime: envoy.wasm.runtime.v8 vm_id: my-wasm-vm-id
{ "name": "envoy.filters.network.http_connection_manager", "typed_config": { ***@***.***": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager", "stat_prefix": "InboundPassthroughClusterIpv4", "route_config": { "name": "InboundPassthroughClusterIpv4", "virtual_hosts": [ { "name": "inbound|http|0", "domains": [ "*" ], "routes": [ { "match": { "prefix": "/" }, "route": { "cluster": "InboundPassthroughClusterIpv4", "timeout": "0s", "max_stream_duration": { "max_stream_duration": "0s", "grpc_timeout_header_max": "0s" } }, "decorator": { "operation": ":0/*" }, "name": "default" } ] } ], "validate_clusters": false }, "http_filters": [ { "name": "envoy.filters.http.wasm", "typed_config": { ***@***.***": "type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm", "config": { "root_id": "my-wasm-root-id", "vm_config": { "vm_id": "my-wasm-vm-id", "runtime": "envoy.wasm.runtime.v8", "code": { "local": { "filename": "/data/coraza/main.wasm" } } }, "configuration": { ***@***.***": "type.googleapis.com/google.protobuf.StringValue", "value": "{\n \"directives_map\": {\n \"default\": [\n \"SecDebugLogLevel 9\",\n \"SecRuleEngine On\",\n \"SecAuditEngine RelevantOnly\",\n \"SecAuditLogParts ABIJDEFHZ\",\n \"SecAuditLogType Concurrent\", \n \"SecAuditLogRelevantStatus ^(1[0-9]{2}|2[0-9]{2}|3[0-8][0-9]|39[0-9]|40[0-3]|405|5[0-9]{2})$\",\n \"Include @crs-setup-demo-conf\",\n \"Include @owasp_crs/*.conf\"\n ]\n },\n \"default_directives\": \"default\"\n }\n" } } } }, { "name": "istio.metadata_exchange", "typed_config": { ***@***.***": "type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm", "config": { "vm_config": { "runtime": "envoy.wasm.runtime.null", "code": { "local": { "inline_string": "envoy.wasm.metadata_exchange" } } }, "configuration": { ***@***.***": "type.googleapis.com/envoy.tcp.metadataexchange.config.MetadataExchange" } } } },— Reply to this email directly, view it on GitHub https://github.com/corazawaf/coraza-proxy-wasm/issues/208, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAXOYAXRIAHYYJYCURG3ECTXMFRITANCNFSM6AAAAAAZM6UGSA . You are receiving this because you are subscribed to this thread.Message ID: @.***>
ericinfra
I set the Wasm EnvoyFilter as follows, and the config_dump is also effective, but I used sqlmap zaproxy to simulate the attack, and I did not see the log output of wasm denial of the attack, even if SecDebugLogLevel is set to 9,
I checked http_filters and confirmed that the inbound configuration on port 15006 has loaded the type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm rule
Why can't I see the wasm denial attack log? Is it because envoy.filters.http.wasm has not taken effect? Because the system also has a default istio.metadata_exchange wasm configuration? But my customized envoy.filters.http.wasm is INSERT_BEFORE priority
istio version 1.17.2