fix: keel-overlay-coraza: no blank pages under gzip, and its state hook declared #25

Merged

marcos-mendez merged 3 commits from fix/coraza-gzip-empty-body into 19.x

2026-10-01 18:27:55 -03:00

marcos-mendez commented

2026-10-01 17:18:12 -03:00

(Migrated from github.com)

Until Keel-Linux/libnginx-mod-http-coraza#3 is released: with the response headers held for phase 4, a static file asked for with gzip is an empty gzip stream while sendfile is on (libnginx-mod-http-coraza#2), so browsers get blank pages whenever Coraza is enabled.

keel.conf (the Coraza-enabled http context) now says coraza_delay_response_headers off. Evidence, on a container of the Keel Web step 7 image with 0.21.0-0keel1, a server that sets neither directive:

keel.conf	gzip body	CRS payload	phase 4 `deny`
as shipped	0 of 2500 bytes	403	403
`sendfile off`	`nginx -t`: "sendfile" directive is duplicate
`coraza_delay_response_headers off`	2500 of 2500	403	connection reset (still blocked)

sendfile off cannot be set from conf.d/ without editing Debian's nginx.conf; the delay off keeps the WAF blocking and loses only the clean error page of a phase 4 deny. keel-overlay-coraza 0.1.1. The line goes once 0.21.0-0keel2 is installed (with it, the delay on gives a whole gzip body and a clean phase 4 403).

Test plan

overlay-web.bats, new test "with Coraza on, a static page asked for with gzip comes back whole": fails on 0.1.0 (625 bytes plain, 0 through gzip), passes with this keel.conf; the state enabled, state disabled and rollback tests pass too (run in the container above)
CI: packages and the web job

Second commit: the Coraza manifest declares `hooks.state`

keel 0.15.0 (Keel-Linux/keel#63, after its review) runs a state hook only when the overlay manifest declares it; the handbook erratum is Keel-Linux/handbook#35. The manifest now names /usr/lib/keel/overlays/coraza/state, the package depends on keel (>= 0.15.0), and the web job builds keel at the head of #63 (a510b9f) until it merges; re-pin to the merge commit then. New test: "the coraza manifest declares its state hook" (failed before, passes now, in the same container). Merge after keel#63.

Until Keel-Linux/libnginx-mod-http-coraza#3 is released: with the response headers held for phase 4, a static file asked for with gzip is an empty gzip stream while `sendfile` is on (libnginx-mod-http-coraza#2), so browsers get blank pages whenever Coraza is enabled. `keel.conf` (the Coraza-enabled http context) now says `coraza_delay_response_headers off`. Evidence, on a container of the Keel Web step 7 image with 0.21.0-0keel1, a server that sets neither directive: | keel.conf | gzip body | CRS payload | phase 4 `deny` | | --- | --- | --- | --- | | as shipped | 0 of 2500 bytes | 403 | 403 | | `sendfile off` | `nginx -t`: "sendfile" directive is duplicate | | | | `coraza_delay_response_headers off` | 2500 of 2500 | 403 | connection reset (still blocked) | `sendfile off` cannot be set from `conf.d/` without editing Debian's `nginx.conf`; the delay off keeps the WAF blocking and loses only the clean error page of a phase 4 deny. keel-overlay-coraza 0.1.1. The line goes once 0.21.0-0keel2 is installed (with it, the delay on gives a whole gzip body and a clean phase 4 403). ## Test plan - [x] `overlay-web.bats`, new test "with Coraza on, a static page asked for with gzip comes back whole": fails on 0.1.0 (625 bytes plain, 0 through gzip), passes with this `keel.conf`; the `state enabled`, `state disabled` and rollback tests pass too (run in the container above) - [ ] CI: packages and the `web` job ## Second commit: the Coraza manifest declares `hooks.state` keel 0.15.0 (Keel-Linux/keel#63, after its review) runs a state hook only when the overlay manifest declares it; the handbook erratum is Keel-Linux/handbook#35. The manifest now names `/usr/lib/keel/overlays/coraza/state`, the package depends on keel (>= 0.15.0), and the web job builds keel at the head of #63 (a510b9f) until it merges; re-pin to the merge commit then. New test: "the coraza manifest declares its state hook" (failed before, passes now, in the same container). Merge after keel#63.