-
-
Notifications
You must be signed in to change notification settings - Fork 240
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
updates tests to CRS 4.5, albedo (#1122)
* wip: crs 4.5, albedo * wip * test timeout * Fix timeout to make CI work * wip moving to overrides * removes rule added to overrides * rebase * some progress * uses albedo as a library * finalizes some notes and comments, deps
- Loading branch information
Showing
10 changed files
with
160 additions
and
107 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| go 1.22 | ||
| go 1.22.3 | ||
|
|
||
| use ( | ||
| . | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| version: "v0.0.0" | ||
| meta: | ||
| engine: "coraza" | ||
| platform: "go" | ||
| annotations: | ||
| - purpose: "Overrides for CRS test suite running against Coraza deployed as a Go middleware" | ||
| test_overrides: | ||
| # - rule_id: 920100 | ||
| # test_ids: [5] | ||
| # reason: "Invalid uri, Coraza not reached - 301 returned" | ||
| # output: | ||
| # status: 301 | ||
| - rule_id: 920100 | ||
| test_ids: [8] | ||
| reason: | | ||
| On Apache is not allowed to put a colon in the path. Go/http allows it. | ||
| Note that the colon is a legal character in a regular path segment, according to the RFC. | ||
| output: | ||
| status: 200 | ||
| log: | ||
| no_expect_ids: [920100] | ||
| - rule_id: 920270 | ||
| test_ids: [4] | ||
| reason: "Rule works, Apache test expects status 400" | ||
| output: | ||
| log: | ||
| expect_ids: [920270] | ||
| - rule_id: 920274 | ||
| test_ids: [1] | ||
| reason: "Host validation. Apache expects status 400. Coraza correctly triggers the rule 920274" | ||
| output: | ||
| log: | ||
| expect_ids: [920274] | ||
| - rule_id: 920290 | ||
| test_ids: [1] | ||
| reason: "TODO" | ||
| output: | ||
| log: | ||
| expect_ids: [920280] # TODO: understand why 920280 (Missing Host Header) is triggered and not 920290 (Empty Host header). See what go-ftw sends. | ||
| - rule_id: 920290 | ||
| test_ids: [4] | ||
| reason: "TODO" | ||
| output: | ||
| log: | ||
| expect_ids: [920280] # TODO: understand why 920280 (Missing Host Header) is triggered and not 920290 (Empty Host header). See what go-ftw sends. | ||
| - rule_id: 920430 | ||
| test_ids: [8] | ||
| reason: "Go/http does not allow HTTP/3.0 - 505 HTTP Version Not Supported" | ||
| output: | ||
| status: 505 | ||
| log: | ||
| no_expect_ids: [920430] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,13 +1,19 @@ | ||
| # Tests should not just be ignored via .ftw.yml, but new expectations for each test should be set. | ||
| # Avoid as much as possible adding new entries here, in favor of .ftw-overrides.yml | ||
| --- | ||
| testoverride: | ||
| ignore: | ||
| 920100-4: 'Invalid uri, Coraza not reached - 404 page not found' | ||
| 920100-5: 'Invalid uri, Coraza not reached - 404 page not found' | ||
| 920100-8: 'Go/http allows a colon in the path. Test expects status 400 or 403 (Apache behaviour)' | ||
| 920270-4: 'Rule works, log contains 920270. Test expects status 400 (Apache behaviour)' | ||
| 920272-5: 'Rule works, log contains 920272. Test expects status 400 (Apache behaviour)' | ||
| 920290-1: 'Rule works, log contains 920290. Test expects status 400 (Apache behaviour)' | ||
| 920290-4: 'Go/http returns 400 Bad Request: missing required Host header' | ||
| 920430-8: 'Go/http does not allow HTTP/3.0 - 505 HTTP Version Not Supported' | ||
| 932200-13: 'wip' | ||
| 930110-7: 'CRS issue: https://github.com/coreruleset/coreruleset/issues/3736' | ||
|
|
||
| # TODO: investigate | ||
| 932200-13: 'Failing only in multiphase evalution' | ||
| 932300-10: 'Failing only in multiphase evalution' | ||
| 933120-2: 'Failing only in multiphase evalution' | ||
| 920280-3: '' | ||
| 920430-3: '' | ||
| 920430-5: '' | ||
| 920430-9: '' | ||
| 920610-2: 'fragments, Coraza might just happly accept them. Run and check it.' | ||
| 920620-1: 'Rule checks if multiple Content-Type headers are kepts. Go/http might keep them and trigger the rule. Run and check it.' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.