fix coraza configuration to use the action variable

jcmoraisjr · Mar 14, 2024 · 082a0f3 · 082a0f3
1 parent 222a777
commit 082a0f3
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/rootfs/etc/templates/haproxy/haproxy.tmpl b/rootfs/etc/templates/haproxy/haproxy.tmpl
@@ -595,8 +595,14 @@ backend {{ $backend.ID }}
 {{- if eq $waf.Mode "deny" }}
 {{- range $pathIDs := $wafCfg.PathIDs $i }}
 {{- if $global.ModSecurity.UseCoraza }}
+    http-request redirect code 302 location %[var(txn.coraza.data)] if { var(txn.coraza.action) -m str redirect }
+    http-response redirect code 302 location %[var(txn.coraza.data)] if { var(txn.coraza.action) -m str redirect }
+    http-request deny deny_status 403 hdr waf-block "request"  if { var(txn.coraza.action) -m str deny }
+    http-response deny deny_status 403 hdr waf-block "response" if { var(txn.coraza.action) -m str deny }
+    http-request silent-drop if { var(txn.coraza.action) -m str drop }
+    http-response silent-drop if { var(txn.coraza.action) -m str drop }
     http-request deny deny_status 504 if { var(txn.coraza.error) -m int gt 0 }
-    http-request deny if !{ var(txn.coraza.fail) -m int eq 0 }
+    http-response deny deny_status 504 if { var(txn.coraza.error) -m int gt 0 }
 {{- else }}
     http-request deny if { var(txn.modsec.code) -m int gt 0 }
 {{- end }}