Enables CRS early blocking

[M4tteoP]

Running the CRS in Anomaly Scoring Mode (default mode), the anomaly score evaluation happens at the end of phase 2 (request body) and phase 4 (response body). Enabling early blocking, the evaluation will happen also at the end of phase 1 (request header) and phase 3 (response headers).
I think that this feature is really handy for proxy-wasm in order to mitigate malicious payloads sent upstream: the earlier we raise an interruption, the better (See also #128).

As a matter of example: CRS rule 913100 is triggered at phase 1 and looks for malicious User-Agents.
Request: curl -I --user-agent "Grabber/0.1 (X11; U; Linux i686; en-US; rv:1.7)" -H "Host: localhost" -H "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5" localhost:8080

Before (early blocking disabled):
The request is just blocked at http_response_headers phase, at that time the request already reached upstream.

Coraza: Warning. Inbound Anomaly Score Exceeded (Total Score: 5)
wasm log coraza-filter my_vm_id: 2 interrupted, action "deny", phase "http_response_headers"

After (early blocking disabled):
The request is blocked at http_request_headers phase, right after the detection. It happens before sending anything upstream.

Coraza: Warning. Inbound Anomaly Score Exceeded in phase 1 (Total Score: 5)
wasm log coraza-filter my_vm_id: 2 interrupted, action "deny", phase "http_request_headers"

[jcchavezs]

I guess this PR is enabling it only for two rules but ideally we should enable for all of them? Can we enable this globally?

…

On Wed, 11 Jan 2023, 00:55 Anuraag Agrawal, ***@***.***> wrote: ***@***.**** approved this pull request. — Reply to this email directly, view it on GitHub <#129 (review)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAXOYAWTEBIAAQKJIPQI5M3WRXZH3ANCNFSM6AAAAAATXBXHUQ> . You are receiving this because your review was requested.Message ID: ***@***.***>

[anuraaga]

@jcchavezs The rules in this PR are configuration rules, they don't match and just set configuration globally