Skip to content

fix(waf): fail closed when Coraza inspection fails - #168

Merged
bihius merged 3 commits into
fix/spoe-debuggingfrom
fix/coraza-degraded-mode
Apr 26, 2026
Merged

fix(waf): fail closed when Coraza inspection fails#168
bihius merged 3 commits into
fix/spoe-debuggingfrom
fix/coraza-degraded-mode

Conversation

@bihius

@bihius bihius commented Apr 26, 2026

Copy link
Copy Markdown
Owner

Summary

  • Fail closed with 503 Service Unavailable when HAProxy sees a Coraza/SPOE processing error.
  • Add degraded-mode response signals with X-WAF-Degraded and X-WAF-Error.
  • Raise degraded requests to HAProxy err log level before backend routing.
  • Document operator-facing degraded behavior and keep backend status reporting deferred to Runtime and Deployed Configuration Status Endpoint #69.
  • Extend config-level regression tests for degraded-mode behavior.

Closes #80

Validation

  • uv run pytest --cov=app
  • uv run mypy app/
  • uv run ruff check app/ tests/unit/test_waf_debug_reference_config.py
  • pnpm run type-check
  • pnpm run lint
  • docker run --rm -v "$PWD/configs/haproxy:/usr/local/etc/haproxy:ro" haproxy:3.0-alpine haproxy -c -f /usr/local/etc/haproxy/haproxy.cfg

Notes

@bihius
bihius force-pushed the fix/coraza-degraded-mode branch from 4f9feeb to 71f272f Compare April 26, 2026 08:47
@bihius
bihius marked this pull request as ready for review April 26, 2026 08:49
Copilot AI review requested due to automatic review settings April 26, 2026 08:49

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Implements an explicit degraded-mode strategy in the HAProxy ↔ Coraza SPOE reference config: when SPOE/WAF inspection errors occur, HAProxy now fails closed with a 503 and adds operator-facing response signals, with accompanying documentation and regression tests.

Changes:

  • Update HAProxy reference config to fail closed (503) when txn.coraza.error is present, add X-WAF-Degraded / X-WAF-Error, and raise log level to err.
  • Update SPOE agent config comments and HAProxy README to document degraded-mode behaviour and troubleshooting expectations.
  • Extend unit regression tests to assert the degraded-mode behaviour is present in the reference config/docs.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File Description
src/backend/tests/unit/test_waf_debug_reference_config.py Adds regression assertions for fail-closed degraded mode and documents expectations in tests.
configs/haproxy/haproxy.cfg Adds fail-closed handling for txn.coraza.error, including response headers and err log level.
configs/haproxy/coraza.cfg Updates comments to reflect the new fail-closed behaviour when SPOE errors occur.
configs/haproxy/README.md Documents degraded-mode semantics, observability signals, and troubleshooting guidance.

Comment thread src/backend/tests/unit/test_waf_debug_reference_config.py Outdated
Comment thread src/backend/tests/unit/test_waf_debug_reference_config.py Outdated
bihius and others added 2 commits April 26, 2026 10:53
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Copilot AI added a commit that referenced this pull request Apr 26, 2026
The test `test_reference_haproxy_config_fails_closed_on_spoe_errors` was
asserting an exact full-line string including quoted header names/values.
The reference `configs/haproxy/haproxy.cfg` uses unquoted header tokens and
also includes `content-type text/plain string` which caused the assertion
to fail.

Apply PR #168 changes (haproxy.cfg fail-closed SPOE error handling,
coraza.cfg comment update, README degraded-mode section) and replace the
brittle exact-line assertion with semantic checks:
- locate the `http-request return status 503` line
- verify both X-WAF-Degraded and X-WAF-Error headers appear on that line
  (tolerating quoted or unquoted forms)
- verify the `if { var(txn.coraza.error) -m found }` condition is present

Closes the CI failure in PR #168.

Agent-Logs-Url: https://github.com/bihius/guard-proxy/sessions/cfcb5738-a176-45f4-b37c-8c9207680170

Co-authored-by: bihius <119067436+bihius@users.noreply.github.com>
@bihius
bihius merged commit 5cc582a into fix/spoe-debugging Apr 26, 2026
3 of 5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants