Unable to load embedded CRS

[TheDcoder]

This issue is very similar to #169 except for the fact that it happens on Linux (Rocky 9.5 specifically), here is the exact error line:

Error: loading http app module: provision http: server srv1: setting up route handlers: route 0: loading handler modules: position 0: loading module 'subroute': provision http.handlers.subroute: setting up subroutes: route 0: loading handler modules: position 0: loading module 'waf': provision http.handlers.waf: invalid WAF config: open @coraza.conf-recommended: no such file or directory

And this is my WAF config:

(waf) {
        coraza_waf {
                directives `
                Include @coraza.conf-recommended
                Include @crs-setup.conf.example
                Include @owasp_crs/*.conf
                SecRuleEngine On
                `
        }
}

I tested it with a fresh xcaddy build:

$ caddy-custom --version
v2.10.0 h1:fonubSaQKF1YANl8TXqGcn4IbIRUDdfAkpcsfI/vX5U=

[TheDcoder]

I just realized that I forgot to include load_oswap_crs in the config, so I did that:

(waf) {
        coraza_waf {
                load_owasp_crs
                directives `
                        Include @coraza.conf-recommended
                        Include @crs-setup.conf.example
                        Include @owasp_crs/*.conf
                        SecRuleEngine On
                `
        }
}

But I now get a different error:

invalid key for filter directive: load_owasp_crs

[TheDcoder]

Figured it out thanks to #74, had to compile with --with github.com/corazawaf/coraza-caddy/v2 instead of --with github.com/corazawaf/coraza-caddy.

I'm not a Go developer so I don't understand why the final /v2 is required, does it point to a specific version? Why doesn't just getting the main branch work?

[jptosso]

Hey! This behavior is controlled by caddy, they point to a specific tag

[TheDcoder]

@jptosso Thanks for the reply, but it still compiles without the tag and even parses the rules. Only the load_owasp_crs directive doesn't work 😕

[jptosso]

It's misspelled, it's load_owasp_crs

[TheDcoder]

@jptosso Forgive my dyslexia, however I did copy and paste the correct spelling in the config, and it started working after I rebuilt it with no changes in config.

[M4tteoP]

Is this issue solved? Can we go ahead and close it? Thanks!

[louis-lau]

@TheDcoder It's just how go module syntax works: https://go.dev/ref/mod#major-version-suffixes

Referring to the latest commit in a branch like main isn't supported, but you can point to a specific commit. Should all be there in the docs. It's not very intuitive if you're not used to it.