updates to CRS v4.0.0 - Githubissues

M4tteoP commented 9 months ago

~~draft: I would merge first https://github.com/corazawaf/coraza-proxy-wasm/pull/259 and rebase on top of it~~

jcchavezs commented 9 months ago

I wonder up to what point we need to maintain a copy of CRS here vs using coreruleset-coraza. Any clue on what is stopping us @M4tteoP ?

M4tteoP commented 9 months ago

I wonder up to what point we need to maintain a copy of CRS here vs using coreruleset-coraza. Any clue on what is stopping us @M4tteoP ?

We should give it a go (maybe the next PR just be about it and not deal with ftw changes?). I think we should mostly think about aliases. For proxy-wasm purposes, we need custom coraza recommended and crs-setup.conf

inssein commented 8 months ago

Curious if we can pick this back up since 4.1 came out today.

M4tteoP commented 8 months ago

From a coraza-proxy-wasm standpoint, I think this is ready to be merged.

We should elaborate a bit on what we want about the CRS versions that we are going to ship. From now on, CRS will release a new minor version about every month and more rarely LTS versions. We might decide to:

Try to keep that pace here, with basically a release every month with the latest rules loaded (that means also possible new FPs, less tested things)

or

Stick with LTS versions, and simplify the experience of users who may want a specific CRS version to build it on their own. For that, we should definitely take advantage of coreruleset-coraza tagging every version there and relying on it

inssein commented 8 months ago

I was just thinking maybe you wanted to pull in 4.1 since its out, but we can go step by step too.

jcchavezs commented 7 months ago

@M4tteoP can we merge this?

corazawaf / coraza-proxy-wasm

updates to CRS v4.0.0 #260