306 lines
9.7 KiB
Plaintext
306 lines
9.7 KiB
Plaintext
## Log destination
|
|
SecDefaultAction "phase:1,log,auditlog,pass"
|
|
SecDefaultAction "phase:2,log,auditlog,pass"
|
|
|
|
## Paranoia level
|
|
SecAction \
|
|
"id:900000,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:tx.blocking_paranoia_level={{ site.paranoia_level | default(caddy_waf_defaults.paranoia_level) }}"
|
|
{% if site.detection_paranoia_level | default(caddy_waf_defaults.detection_paranoia_level) != None %}
|
|
|
|
## Detection paranoia level
|
|
SecAction \
|
|
"id:900001,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:tx.detection_paranoia_level={{ site.detection_paranoia_level | default(caddy_waf_defaults.detection_paranoia_level) }}"
|
|
{% endif %}
|
|
|
|
## Enforce Body Processor URLENCODED
|
|
SecAction \
|
|
"id:900010,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:tx.enforce_bodyproc_urlencoded={{ site.enforce_bodyproc_urlencoded | default(caddy_waf_defaults.enforce_bodyproc_urlencoded) }}"
|
|
|
|
## Anomaly Scoring Mode Severity Levels
|
|
SecAction \
|
|
"id:900100,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:tx.critical_anomaly_score={{ site.critical_anomaly_score | default(caddy_waf_defaults.critical_anomaly_score) }},\
|
|
setvar:tx.error_anomaly_score={{ site.error_anomaly_score | default(caddy_waf_defaults.error_anomaly_score) }},\
|
|
setvar:tx.warning_anomaly_score={{ site.warning_anomaly_score | default(caddy_waf_defaults.warning_anomaly_score) }},\
|
|
setvar:tx.notice_anomaly_score={{ site.notice_anomaly_score | default(caddy_waf_defaults.notice_anomaly_score) }}"
|
|
|
|
## Anomaly Scoring Mode Blocking Threshold Levels
|
|
SecAction \
|
|
"id:900110,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:tx.inbound_anomaly_score_threshold={% if site.log_only | default(caddy_waf_defaults.log_only) %}1000{% else %}{{ site.inbound_anomaly_score_threshold | default(caddy_waf_defaults.inbound_anomaly_score_threshold) }}{% endif %},\
|
|
setvar:tx.outbound_anomaly_score_threshold={% if site.log_only | default(caddy_waf_defaults.log_only) %}1000{% else %}{{ site.outbound_anomaly_score_threshold | default(caddy_waf_defaults.outbound_anomaly_score_threshold) }}{% endif %}"
|
|
|
|
## Application Specific Rule Exclusions
|
|
# FIXME
|
|
# In CRS 4, these are no longer part of the CRS itself, but they are available
|
|
# as "CRS plugins". Some plugins improve support for web applications, and others
|
|
# may bring new functionality. Plugins are not installed by default, but can be
|
|
# downloaded from the plugin registry:
|
|
# https://github.com/coreruleset/plugin-registry
|
|
# For detailed information about using and installing plugins, please see:
|
|
# https://coreruleset.org/docs/concepts/plugins/
|
|
|
|
## Anomaly Score Reporting Level
|
|
# 0 - Reporting disabled
|
|
# 1 - Reporting for requests with a blocking anomaly score >= a threshold
|
|
# 2 - Reporting for requests with a detection anomaly score >= a threshold
|
|
# 3 - Reporting for requests with a blocking anomaly score greater than 0
|
|
# 4 - Reporting for requests with a detection anomaly score greater than 0
|
|
# 5 - Reporting for all requests
|
|
SecAction \
|
|
"id:900115,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:tx.reporting_level={{ site.reporting_level | default(caddy_waf_defaults.reporting_level) }}"
|
|
|
|
## Early Anomaly Scoring Mode Blocking
|
|
SecAction \
|
|
"id:900120,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:tx.early_blocking=0"
|
|
|
|
## Initialize Default Collections
|
|
SecAction \
|
|
"id:900130,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:tx.enable_default_collections=1"
|
|
|
|
## HTTP Policy Settings
|
|
SecAction \
|
|
"id:900200,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:'tx.allowed_methods={{ site.allowed_methods | default(caddy_waf_defaults.allowed_methods) | join(" ") }}'"
|
|
|
|
# Content-Types that a client is allowed to send in a request
|
|
SecAction \
|
|
"id:900220,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:'tx.allowed_request_content_type={{ site.allowed_request_content_type | default(caddy_waf_defaults.allowed_request_content_type) | join(" ") }}'"
|
|
|
|
## Allowed HTTP versions
|
|
SecAction \
|
|
"id:900230,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:'tx.allowed_http_versions={{ site.allowed_http_versions | default(caddy_waf_defaults.allowed_http_versions) | join(" ") }}'"
|
|
|
|
## Forbidden file extensions
|
|
SecAction \
|
|
"id:900240,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:'tx.restricted_extensions={{ site.restricted_extensions | default(caddy_waf_defaults.restricted_extensions) | join(" ") }}'"
|
|
|
|
## Restricted request headers
|
|
SecAction \
|
|
"id:900250,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:'tx.restricted_headers_basic={{ site.restricted_headers_basic | default(caddy_waf_defaults.restricted_headers_basic) | join(" ") }}'"
|
|
|
|
## Extended restricted request headers (forbidden at a higher paranoia level)
|
|
SecAction \
|
|
"id:900255,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:'tx.restricted_headers_extended={{ site.restricted_headers_extended | default(caddy_waf_defaults.restricted_headers_extended) | join(" ") }}'"
|
|
|
|
# Content-Types charsets that a client is allowed to send in a request
|
|
SecAction \
|
|
"id:900280,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:'tx.allowed_request_content_type_charset={{ caddy_waf_defaults.allowed_request_content_type_charset | default(caddy_waf_defaults.allowed_request_content_type_charset) | join(" ") }}'"
|
|
|
|
# Block request if number of arguments is too high
|
|
SecAction \
|
|
"id:900300,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:tx.max_num_args={{ site.max_num_args | default(caddy_waf_defaults.max_num_args) }}"
|
|
|
|
# Block request if the length of any argument name is too high
|
|
SecAction \
|
|
"id:900310,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:tx.arg_name_length={{ site.arg_name_length | default(caddy_waf_defaults.arg_name_length) }}"
|
|
|
|
# Block request if the length of any argument value is too high
|
|
SecAction \
|
|
"id:900320,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:tx.arg_length={{ site.arg_length | default(caddy_waf_defaults.arg_length) }}"
|
|
|
|
# Block request if the total length of all combined arguments is too high
|
|
SecAction \
|
|
"id:900330,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:tx.total_arg_length={{ site.total_arg_length | default(caddy_waf_defaults.total_arg_length) }}"
|
|
|
|
# Block request if the file size of any individual uploaded file is too high
|
|
SecAction \
|
|
"id:900340,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:tx.max_file_size={{ site.max_file_size | default(caddy_waf_defaults.max_file_size) }}"
|
|
|
|
# Block request if the total size of all combined uploaded files is too high
|
|
SecAction \
|
|
"id:900350,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:tx.combined_file_sizes={{ site.combined_file_sizes | default(caddy_waf_defaults.combined_file_sizes) }}"
|
|
|
|
## Easing In / Sampling Percentage
|
|
SecAction \
|
|
"id:900400,\
|
|
phase:1,\
|
|
pass,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:tx.sampling_percentage={{ site.sampling_percentage | default(caddy_waf_defaults.sampling_percentage) }}"
|
|
|
|
## Check UTF-8 encoding
|
|
SecAction \
|
|
"id:900950,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:tx.crs_validate_utf8_encoding=1"
|
|
|
|
## Skip Checking Responses
|
|
# CRS will perform analysis of the response contents if this is enabled and you have
|
|
# the directive `SecResponseBodyAccess On`.
|
|
# Warning: this feature is _enabled_ by default, but depending on your applications
|
|
# you might be targeted in a Request Filter Denial of Service (RFDoS) attack.
|
|
# References: https://blog.sicuranext.com/response-filter-denial-of-service-a-new-way-to-shutdown-a-website/
|
|
# Uncomment this rule to _skip checking responses_.
|
|
#SecAction \
|
|
# "id:900500,\
|
|
# phase:1,\
|
|
# pass,\
|
|
# t:none,\
|
|
# nolog,\
|
|
# tag:'OWASP_CRS',\
|
|
# ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
# setvar:tx.crs_skip_response_analysis=1"
|
|
|
|
## End of setup
|
|
SecAction \
|
|
"id:900990,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
tag:'OWASP_CRS',\
|
|
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
|
setvar:tx.crs_setup_version={{ caddy_owasp_crs_version | regex_replace('\.', '') }}"
|