CrowdSec AppSec can't import SecLang data files when using PmFromFile operator
#3455
Labels
Comments
|
@GNU-Plus-Windows-User: Thanks for opening an issue, it is currently awaiting triage. In the meantime, you can:
DetailsI am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository. |
|
Hey 👋🏻 So I tested Updating CRS to latest is also fine: I dont use CRS much so let me know if there any additional thing I have to do other than downloading and configuring appsec that need to be done to the CRS confs themselves. Could you ensure you only have one crowdsec binary (beware which may should two if /bin/ is symlinked): Just so it complete:
The key thing in the rules is |
|
@LaurenceJJones I have 2 binaries but they are not symlinked:
I'm doing it slightly differently, if I import via URL it's fine but if I import via a local file it's not: doesn't matter what CRS version you use, it's the same for all of them. |
|
So I managed to get it working, there two issues one coraza does not allow full paths so you cannot use also was generated by mr gpt, I used it and it worked on patching the files. |
|
@LaurenceJJones I just tested the workaround and now it works fine, although that confusing error message should be fixed. Do you want me to open up a separate issue about the error messages? |
Yeah you can, however, the error message is return from coraza about "invalid argument". I only found out about the full path error when I search the "invalid argument" in coraza issues. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
What happened?
When importing CRS via SecLang AppSec isn't able to correctly parse the data files, it assumes that it's SecLang rules when it's actually a data file.
FATAL crowdsec init: while loading acquisition config: while configuring datasource of type appsec from /etc/crowdsec/acquis.d/appsec.yaml (position 0): unable to initialize runner: unable to initialize inband engine : invalid WAF config from string: failed to compile the directive "secrule": readfile /var/lib/crowdsec/data/coreruleset/scanners-user-agents.data: invalid argumentWhat did you expect to happen?
I should be able to make use of the
pmFromFileoperatorHow can we reproduce it (as minimally and precisely as possible)?
Import a SecLang rules file that makes use of the
pmFromFileoperator or try to import CRS via SecLang.Anything else we need to know?
N/A
Crowdsec version
1.6.5
OS version
Ubuntu 24.04
Enabled collections and parsers
N/A
Acquisition config
N/A
Config show
Out of the box defaults
Prometheus metrics
N/A
Related custom configs versions (if applicable) : notification plugins, custom scenarios, parsers etc.
N/A
The text was updated successfully, but these errors were encountered: