feat: improve rule configuration

.github/workflows/configure-rules-for-test.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+
+# The purpose of this script is to test that `configure-rules.sh` will run
+# successfully for all variables that we configure.
+
+set -e
+
+conf_file="${1}"
+env_file="${2}"
+
+if [ -f "${env_file}" ]; then
+  rm "${env_file}"
+fi
+
+while read -r line; do
+  if [ -z "${line}" ] || echo "${line}" | grep -Eq "^#"; then
+    continue
+  fi
+
+  var_name="$(cut -d'|' -f2 <<< "${line}")"
+  test_value="$(cut -d'|' -f5 <<< "${line}")"
+  echo "Setting ${var_name}=${test_value}"
+  echo "${var_name}=${test_value}" >> "${env_file}"
+done < "${conf_file}"

.github/workflows/verifyimage.yml

@@ -62,8 +62,16 @@ jobs:
 
       - name: Run ${{ matrix.target }}
         run: |
+          . .github/workflows/configure-rules-for-test.sh \
+            src/opt/modsecurity/configure-rules.conf \
+            "$(pwd)/${{ matrix.target }}.env"
           echo "Starting container ${{ matrix.target }}"
-          docker run --pull "never" -d --name ${{ matrix.target }}-test "${REPO}:${{ matrix.target }}"
+          docker run \
+            --pull "never" \
+            -d \
+            --name ${{ matrix.target }}-test \
+            --env-file "${{ matrix.target }}.env" \
+            "${REPO}:${{ matrix.target }}"
           sleep 30
           docker logs ${{ matrix.target }}-test
 

apache/Dockerfile

@@ -158,7 +158,7 @@ COPY src/etc/modsecurity.d/*.conf /etc/modsecurity.d/
 COPY src/bin/* /usr/local/bin/
 COPY apache/conf/extra/*.conf /usr/local/apache2/conf/extra/
 COPY src/etc/modsecurity.d/*.conf /etc/modsecurity.d/
-COPY src/opt/modsecurity/activate-*.sh /opt/modsecurity/
+COPY src/opt/modsecurity/* /opt/modsecurity/
 COPY apache/docker-entrypoint.sh /
 
 RUN set -eux; \
@@ -167,6 +167,7 @@ RUN set -eux; \
     apt-get install -qq -y --no-install-recommends --no-install-suggests \
         ca-certificates \
         curl \
+        ed \
         gnupg \
         iproute2 \
         libcurl3-gnutls \

apache/Dockerfile-alpine

@@ -166,7 +166,7 @@ COPY --from=build /usr/local/apache2/ModSecurity-${MODSEC2_VERSION}/unicode.mapp
 COPY --from=crs_release /opt/owasp-crs /opt/owasp-crs
 COPY src/etc/modsecurity.d/*.conf /etc/modsecurity.d/
 COPY src/bin/* /usr/local/bin/
-COPY src/opt/modsecurity/activate-*.sh /opt/modsecurity/
+COPY src/opt/modsecurity/* /opt/modsecurity/
 COPY apache/conf/extra/*.conf /usr/local/apache2/conf/extra/
 COPY apache/docker-entrypoint.sh /
 
@@ -176,6 +176,7 @@ RUN set -eux; \
     apk add --no-cache \
         ca-certificates \
         curl \
+        ed \
         gnupg \
         iproute2 \
         libfuzzy2 \

apache/docker-entrypoint.sh

@@ -3,7 +3,7 @@
 /usr/local/bin/generate-certificate /usr/local/apache2
 /usr/local/bin/check-low-port
 
-. /opt/modsecurity/activate-plugins.sh
-. /opt/modsecurity/activate-rules.sh
+/opt/modsecurity/activate-plugins.sh
+/opt/modsecurity/configure-rules.sh
 
 exec "$@"

docker-bake.hcl

@@ -47,14 +47,6 @@ variable "lua-modules-debian" {
   ]
 }
 
-variable "lua-modules-luarocks" {
-  default = [
-    "lua-resty-openidc",
-    "lua-zlib",
-    "luasocket"
-  ]
-}
-
 variable "REPOS" {
     # List of repositories to tag
     default = [

nginx/Dockerfile

@@ -192,7 +192,6 @@ ENV \
     SSL_VERIFY=off \
     WORKER_CONNECTIONS=1024 \
     # CRS specific variables
-    PARANOIA=1 \
     ANOMALY_INBOUND=5 \
     ANOMALY_OUTBOUND=4 \
     BLOCKING_PARANOIA=1
@@ -208,7 +207,8 @@ COPY src/etc/modsecurity.d/modsecurity-override.conf /etc/nginx/templates/modsec
 COPY src/etc/modsecurity.d/setup.conf /etc/nginx/templates/modsecurity.d/setup.conf.template
 COPY nginx/docker-entrypoint.d/*.sh /docker-entrypoint.d/
 COPY src/opt/modsecurity/activate-plugins.sh /docker-entrypoint.d/94-activate-plugins.sh
-COPY src/opt/modsecurity/activate-rules.sh /docker-entrypoint.d/95-activate-rules.sh
+COPY src/opt/modsecurity/configure-rules.sh /docker-entrypoint.d/95-configure-rules.sh
+COPY src/opt/modsecurity/configure-rules.conf /docker-entrypoint.d/
 # We use the templating mechanism from the nginx image here.
 COPY nginx/templates /etc/nginx/templates/
 COPY src/bin/* /usr/local/bin/
@@ -221,6 +221,7 @@ RUN set -eux; \
     LD_LIBRARY_PATH="" apt-get install -y -qq --no-install-recommends --no-install-suggests \
         ca-certificates \
         curl \
+        ed \
         libcurl4-gnutls-dev \
         libfuzzy2 \
         liblua${LUA_VERSION} \

nginx/Dockerfile-alpine

@@ -200,7 +200,8 @@ COPY src/etc/modsecurity.d/modsecurity-override.conf /etc/nginx/templates/modsec
 COPY src/etc/modsecurity.d/setup.conf /etc/nginx/templates/modsecurity.d/setup.conf.template
 COPY nginx/docker-entrypoint.d/*.sh /docker-entrypoint.d/
 COPY src/opt/modsecurity/activate-plugins.sh /docker-entrypoint.d/94-activate-plugins.sh
-COPY src/opt/modsecurity/activate-rules.sh /docker-entrypoint.d/95-activate-rules.sh
+COPY src/opt/modsecurity/configure-rules.sh /docker-entrypoint.d/95-configure-rules.sh
+COPY src/opt/modsecurity/configure-rules.conf /docker-entrypoint.d/
 # We use the templating mechanism from the nginx image here.
 COPY nginx/templates /etc/nginx/templates/
 COPY src/bin/* /usr/local/bin/
@@ -211,6 +212,7 @@ RUN set -eux; \
     apk add --no-cache \
         curl \
         curl-dev \
+        ed \
         libfuzzy2 \
         libmaxminddb-dev \
         libstdc++ \

renovate.json

@@ -96,18 +96,6 @@
       ],
       "depNameTemplate": "coreruleset/coreruleset",
       "datasourceTemplate": "github-releases"
-    },
-    {
-      "description": "Docs: OpenResty",
-      "customType": "regex",
-      "fileMatch": [
-        "^README\\.md$"
-      ],
-      "matchStrings": [
-        "OpenResty (?<currentValue>\\d+\\.\\d+\\.\\d+(\\.\\d+)?)"
-      ],
-      "depNameTemplate": "openresty/openresty",
-      "datasourceTemplate": "docker"
     }
   ]
 }

src/opt/modsecurity/activate-plugins.sh

@@ -1,5 +1,7 @@
 #!/bin/sh -e
 
+printf "# # #\nRunning CRS plugin activation\n- - -\n\n"
+
 # Check if crs-setup.conf is overriden
 if [ -n "${MANUAL_MODE}" ]; then
   echo "Using manual config mode"
@@ -25,3 +27,4 @@ for suffix in "config" "before" "after"; do
     fi
 done
 
+printf -- "- - -\nFinished CRS plugin activation\n# # #\n\n"

src/opt/modsecurity/configure-rules.conf

@@ -0,0 +1,29 @@
+# Format: <legacy (0|1)>|<env var>|<rule ID>|<tx var name>|<test value>
+# The octothorpe (#) designates a comment, comments are ignored
+# See `.github/workflows/configure-rules-for-test.sh` for how the test value is used.
+
+# Superceded by BLOCKING_PARANOIA
+true|PARANOIA|900000|blocking_paranoia_level|4
+true|PARANOIA|900001|detection_paranoia_level|4
+false|BLOCKING_PARANOIA|900000|blocking_paranoia_level|4
+# Superceded by DETECTION_PARANOIA
+true|EXECUTING_PARANOIA|900001|executing_paranoia_level|4
+false|DETECTION_PARANOIA|900001|detection_paranoia_level|4
+false|ENFORCE_BODYPROC_URLENCODED|900010|enforce_bodyproc_urlencoded|0
+false|INBOUND_ANOMALY|900110|inbound_anomaly_score_threshold|6
+false|OUTBOUND_ANOMALY|900110|outbound_anomaly_score_threshold|6
+false|ALLOWED_METHODS|900200|allowed_methods|GET OPTIONS
+false|ALLOWED_REQUEST_CONTENT_TYPE|900220|allowed_request_content_type|application/json
+false|ALLOWED_REQUEST_CONTENT_TYPE_CHARSET|900280|allowed_request_content_type_charset|utf-8
+false|ALLOWED_HTTP_VERSIONS|900230|allowed_http_versions|1.1
+false|RESTRICTED_EXTENSIONS|900240|restricted_extensions|.exe/
+false|RESTRICTED_HEADERS_BASIC|900250|restricted_headers_basic|/if/
+false|RESTRICTED_HEADERS_EXTENDED|900255|restricted_headers_extended|/x-some-header/
+false|MAX_NUM_ARGS|900300|max_num_args|100
+false|ARG_NAME_LENGTH|900310|arg_name_length|200
+false|ARG_LENGTH|900230|arg_length|300
+false|TOTAL_ARG_LENGTH|900330|total_arg_length|400
+false|MAX_FILE_SIZE|900340|max_file_size|500
+false|COMBINED_FILE_SIZES|900350|combined_file_sizes|600
+false|VALIDATE_UTF8_ENCODING|900950|crs_validate_utf8_encoding|0
+false|REPORTING_LEVEL|900115|reporting_level|5