Skip to content

Commit a70cd51

Browse files
fzipifzipi
committed
fix: update script with variables from v3 and v4
Signed-off-by: Felipe Zipitria <[email protected]>
1 parent 9e8ff42 commit a70cd51

File tree

5 files changed

+62
-14
lines changed

5 files changed

+62
-14
lines changed

‎nginx/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -225,7 +225,7 @@ COPY src/etc/modsecurity.d/setup.conf /etc/nginx/templates/modsecurity.d/setup.c
225225
COPY nginx/docker-entrypoint.d/*.sh /docker-entrypoint.d/
226226
COPY src/opt/modsecurity/activate-plugins.sh /docker-entrypoint.d/94-activate-plugins.sh
227227
COPY src/opt/modsecurity/configure-rules.sh /docker-entrypoint.d/95-configure-rules.sh
228-
COPY src/opt/modsecurity/configure-rules.conf /docker-entrypoint.d/
228+
COPY src/opt/modsecurity/configure-rules.*.conf /docker-entrypoint.d/
229229
# We use the templating mechanism from the nginx image here.
230230
COPY nginx/templates /etc/nginx/templates/
231231
COPY src/bin/* /usr/local/bin/

‎nginx/Dockerfile-alpine‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -225,7 +225,7 @@ COPY src/etc/modsecurity.d/setup.conf /etc/nginx/templates/modsecurity.d/setup.c
225225
COPY nginx/docker-entrypoint.d/*.sh /docker-entrypoint.d/
226226
COPY src/opt/modsecurity/activate-plugins.sh /docker-entrypoint.d/94-activate-plugins.sh
227227
COPY src/opt/modsecurity/configure-rules.sh /docker-entrypoint.d/95-configure-rules.sh
228-
COPY src/opt/modsecurity/configure-rules.conf /docker-entrypoint.d/
228+
COPY src/opt/modsecurity/configure-rules.*.conf /docker-entrypoint.d/
229229
# We use the templating mechanism from the nginx image here.
230230
COPY nginx/templates /etc/nginx/templates/
231231
COPY src/bin/* /usr/local/bin/

‎src/opt/modsecurity/configure-rules.sh‎

Lines changed: 31 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,28 @@ if [ -n "${CONFIG_FILE}" ]; then
2525
setup_conf_path="${CONFIG_FILE}"
2626
fi
2727

28+
# Detect CRS version based on the config file content
29+
detect_crs_version() {
30+
if grep -q "tx\.blocking_paranoia_level" "${setup_conf_path}"; then
31+
echo "v4"
32+
elif grep -q "tx\.paranoia_level" "${setup_conf_path}"; then
33+
echo "v3"
34+
else
35+
echo "Unknown CRS version"
36+
exit 10
37+
fi
38+
}
39+
40+
# Get the CRS version
41+
CRS_VERSION="$(detect_crs_version)"
42+
echo "Detected CRS config file version: ${CRS_VERSION}"
43+
2844
set_value() {
2945
rule="${1}"
3046
var_name="${2}"
3147
tx_var_name="${3}"
3248
var_value="${4}"
49+
3350
echo "Configuring ${rule} for ${var_name} with ${tx_var_name}=${var_value}"
3451

3552
# For each rule, we do one pass to uncomment the rule (up to first blank line after the rule),
@@ -40,7 +57,7 @@ set_value() {
4057
ed -s "${setup_conf_path}" <<EOF 2 > /dev/null
4158
/id:${rule}/
4259
-
43-
.,/^#\?$/ s/#//
60+
.,/^$/ s/#//
4461
wq
4562
EOF
4663
fi
@@ -52,8 +69,8 @@ EOF
5269
# Use `#` as pattern delimiter, as `/` is part of some variable values.
5370
ed -s "${setup_conf_path}" <<EOF 2 > /dev/null
5471
/id:${rule}/
55-
/setvar:'\?tx\.${tx_var_name}=/
56-
s#=[^,'"]\+#=${var_value}#
72+
/setvar:[']*tx\.${tx_var_name}=/
73+
s#=[^,'"]*#=${var_value}#
5774
wq
5875
EOF
5976
}
@@ -68,8 +85,7 @@ can_set() {
6885

6986
if ! grep -q "id:${rule}" "${setup_conf_path}"; then
7087
return 1
71-
fi
72-
if grep -Eq "setvar:'?tx\.${tx_var_name}" "${setup_conf_path}"; then
88+
elif ! grep -Eq "setvar:'?tx\.${tx_var_name}" "${setup_conf_path}"; then
7389
return 1
7490
fi
7591
return 0
@@ -96,6 +112,14 @@ get_tx_var_name() {
96112
echo "${1}" | awk -F'\|' '{print $4}'
97113
}
98114

115+
get_tx_var_name() {
116+
echo "${1}" | awk -F'\|' '{print $4}'
117+
}
118+
119+
get_test_value() {
120+
echo "${1}" | awk -F'\|' '{print $5}'
121+
}
122+
99123
while read -r line; do
100124
if [ -z "${line}" ] || echo "${line}" | grep -Eq "^#"; then
101125
continue
@@ -106,23 +130,20 @@ while read -r line; do
106130
var_value="$(get_var_value "${line}")"
107131
rule="$(get_rule "${line}")"
108132
tx_var_name="$(get_tx_var_name "${line}")"
109-
133+
110134
if should_set "${var_value}" "${tx_var_name}"; then
111135
if ! can_set "${rule}" "${tx_var_name}"; then
112136
if [ "${legacy}" = "true" ]; then
113137
echo "Legacy variable ${var_name} (${rule}) set but nothing found to substitute. Skipping"
114138
continue
115-
elif [ "${legacy}" = "false" -a "${rule}" != "900000" ]; then
116-
echo "Non-legacy variable ${var_name} (${rule}) set but nothing found to substitute. Skipping"
117-
continue
118139
fi
119140
echo "Failed to find rule ${rule} to set ${tx_var_name}=${var_value} for ${var_name} in ${setup_conf_path}. Aborting"
120141
exit 1
121142
fi
122143

123144
set_value "${rule}" "${var_name}" "${tx_var_name}" "${var_value}"
124145
fi
125-
done < "${DIRECTORY}/configure-rules.conf"
146+
done < "${DIRECTORY}/configure-rules.${CRS_VERSION}.conf"
126147

127148
# Add SecDefaultActions
128149
var="${MODSEC_DEFAULT_PHASE1_ACTION}"

‎src/opt/modsecurity/configure-rules.v3.conf‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Format: <legacy (0|1)>|<env var>|<rule ID>|<tx var name>|<test value>
2+
# The octothorpe (#) designates a comment, comments are ignored
3+
# See `.github/workflows/configure-rules-for-test.sh` for how the test value is used.
4+
5+
# Superceded by BLOCKING_PARANOIA
6+
true|PARANOIA|900000|paranoia_level|4
7+
false|BLOCKING_PARANOIA|900000|paranoia_level|4
8+
# Superceded by DETECTION_PARANOIA
9+
true|EXECUTING_PARANOIA|900001|executing_paranoia_level|4
10+
false|DETECTION_PARANOIA|900001|executing_paranoia_level|4
11+
false|ENFORCE_BODYPROC_URLENCODED|900010|enforce_bodyproc_urlencoded|0
12+
false|ANOMALY_INBOUND|900110|inbound_anomaly_score_threshold|6
13+
false|ANOMALY_OUTBOUND|900110|outbound_anomaly_score_threshold|6
14+
false|ALLOWED_METHODS|900200|allowed_methods|GET OPTIONS
15+
false|ALLOWED_REQUEST_CONTENT_TYPE|900220|allowed_request_content_type|application/json
16+
false|ALLOWED_REQUEST_CONTENT_TYPE_CHARSET|900280|allowed_request_content_type_charset|utf-8
17+
false|ALLOWED_HTTP_VERSIONS|900230|allowed_http_versions|1.1
18+
false|RESTRICTED_EXTENSIONS|900240|restricted_extensions|.exe/
19+
false|RESTRICTED_HEADERS_BASIC|900250|restricted_headers_basic|/if/
20+
false|RESTRICTED_HEADERS_EXTENDED|900255|restricted_headers_extended|/x-some-header/
21+
false|MAX_NUM_ARGS|900300|max_num_args|100
22+
false|ARG_NAME_LENGTH|900310|arg_name_length|200
23+
false|ARG_LENGTH|900320|arg_length|300
24+
false|TOTAL_ARG_LENGTH|900330|total_arg_length|400
25+
false|MAX_FILE_SIZE|900340|max_file_size|500
26+
false|COMBINED_FILE_SIZES|900350|combined_file_sizes|600
27+
false|VALIDATE_UTF8_ENCODING|900950|crs_validate_utf8_encoding|0

‎src/opt/modsecurity/configure-rules.conf‎ renamed to ‎src/opt/modsecurity/configure-rules.v4.conf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
# See `.github/workflows/configure-rules-for-test.sh` for how the test value is used.
44

55
# Superceded by BLOCKING_PARANOIA
6-
true|PARANOIA|900000|paranoia_level|4
7-
true|BLOCKING_PARANOIA|900000|paranoia_level|4
6+
true|PARANOIA|900000|blocking_paranoia_level|4
7+
true|PARANOIA|900001|detection_paranoia_level|4
88
false|BLOCKING_PARANOIA|900000|blocking_paranoia_level|4
99
# Superceded by DETECTION_PARANOIA
1010
true|EXECUTING_PARANOIA|900001|executing_paranoia_level|4

0 commit comments

Comments
 (0)