Will this replace the HAProxy bouncer?

[WilliamDEdwards]

During a search for an HAProxy WAF, I came across the HAProxy bouncer. From what I understand:

• The bouncer talks to the Security Engine
• The Security Engine can optionally be extended with AppSec component
• AppSec is short for 'Application Security', which is what CrowdSec calls its WAF
• When the Security Engine can is extended with the AppSec component, the bouncer must support it

As far as I can see, the HAProxy bouncer does not support AppSec, effectively not providing a WAF. This hunch is confirmed by:

• HAProxy is not mentioned as a supported web server in the AppSec documentation.
• The HAProxy bouncer documentation talks only about 'checking IPs', not full-fledged WAF functionality. E.g.: "This component leverages haproxy lua's API to check e IP address against the local API."
• The blog doesn't mention 'WAF' nor 'AppSec'

I did however come across this experimental SPOA repository, which says it provides 'WAF protection'.

Is it safe to assume that this project will replace the Lua-based bouncer (as SPOA is native to HAProxy)? If so, is there a timeline? The roadmap does not mention it.

[LaurenceJJones]

Is it safe to assume that this project will replace the Lua-based bouncer (as SPOA is native to HAProxy)? If so, is there a timeline? The roadmap does not mention it.

Yes our plan since there is alot of limitation of the lua-based bouncer to use this implementation as the primary integration into HAProxy since we not reliant (so heavily) on the lua code and as you said SPOA is natively supported which means better integration.

At the moment, the roadmap doesnt have a confirmed timeline as we are currently rolling out features to CrowdSec itself and this has taken a lot of resources, since we have to ensure backwards compatibility.

Once we have released 1.6.4 which should hopefully be tomorrow, we can take a step back and evaluate a proper timeline such as:

• Beta
• GA

[WilliamDEdwards]

Hi @LaurenceJJones,

Does CrowdSec take bounties? The ability to use its WAF with HAProxy would be very useful. Coraza SPOA - which seems to be the only full-fledged alternative - is still 'experimental'.

Thanks for the information!

[LaurenceJJones]

Does CrowdSec take bounties? The ability to use its WAF with HAProxy would be very useful. Coraza SPOA - which seems to be the only full-fledged alternative - is still 'experimental'.

In what regards, as we offer bounties? if so we feel bounties takes away from the spirit of open source and community contributions, we know this is a wanted feature for HAProxy so it is at the top of our todo lists.

[WilliamDEdwards]

If it's already at the top of the todo, then there's no need for a bounty ;). Thanks for the answer.