Skip to content

Commit d0e1c57

Browse files
griggi-wsgriggi-ws
committed
change: mod_security - enable activated_rules management on debian; add: support for defining custom SecAction in addition to SecRule 
1 parent 818f99a commit d0e1c57

File tree

4 files changed

+111
-25
lines changed

4 files changed

+111
-25
lines changed

‎manifests/mod/security.pp‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,9 @@
1616
# @param custom_rules
1717
#
1818
# @param custom_rules_set
19-
#
19+
# Custom SecRule rules to be included
20+
# @param custom_actions_set
21+
# Custom SecAction rules to be included
2022
# @param modsec_dir
2123
# Defines the path where Puppet installs the modsec configuration and activated rules links.
2224
#
@@ -144,6 +146,7 @@
144146
Array[String] $activated_rules = $apache::params::modsec_default_rules,
145147
Boolean $custom_rules = $apache::params::modsec_custom_rules,
146148
Optional[Array[String]] $custom_rules_set = $apache::params::modsec_custom_rules_set,
149+
Optional[Array[String]] $custom_actions_set = undef,
147150
Stdlib::Absolutepath $modsec_dir = $apache::params::modsec_dir,
148151
String $modsec_secruleengine = $apache::params::modsec_secruleengine,
149152
Integer[0, 9] $debug_log_level = 0,
@@ -319,7 +322,7 @@
319322
owner => $apache::params::user,
320323
group => $apache::params::group,
321324
mode => $apache::file_mode,
322-
content => epp('apache/mod/security_custom.conf.epp', { 'custom_rules_set' => $custom_rules_set, }),
325+
content => epp('apache/mod/security_custom.conf.epp', { 'custom_rules_set' => $custom_rules_set, 'custom_actions_set' => $custom_actions_set, }),
323326
require => File["${modsec_dir}/custom_rules"],
324327
notify => Class['apache::service'],
325328
}
@@ -373,7 +376,7 @@
373376
notify => Class['apache::service'],
374377
}
375378

376-
unless $facts['os']['name'] == 'SLES' or $facts['os']['name'] == 'Debian' or $facts['os']['name'] == 'Ubuntu' {
379+
unless $facts['os']['name'] == 'SLES' {
377380
apache::security::rule_link { $activated_rules: }
378381
}
379382
}

‎manifests/params.pp‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -486,25 +486,25 @@
486486
$secpcrematchlimitrecursion = 1500
487487
$modsec_secruleengine = 'On'
488488
$modsec_default_rules = [
489-
'crawlers-user-agents.data',
490-
'iis-errors.data',
491-
'java-code-leakages.data',
492-
'java-errors.data',
493-
'lfi-os-files.data',
494-
'php-config-directives.data',
495-
'php-errors.data',
496-
'php-function-names-933150.data',
497-
'php-function-names-933151.data',
498-
'php-variables.data',
499-
'restricted-files.data',
500-
'scanners-headers.data',
501-
'scanners-urls.data',
502-
'scanners-user-agents.data',
503-
'scripting-user-agents.data',
504-
'sql-errors.data',
505-
'sql-function-names.data',
506-
'unix-shell.data',
507-
'windows-powershell-commands.data',
489+
'rules/crawlers-user-agents.data',
490+
'rules/iis-errors.data',
491+
'rules/java-code-leakages.data',
492+
'rules/java-errors.data',
493+
'rules/lfi-os-files.data',
494+
'rules/php-config-directives.data',
495+
'rules/php-errors.data',
496+
'rules/php-function-names-933150.data',
497+
'rules/php-function-names-933151.data',
498+
'rules/php-variables.data',
499+
'rules/restricted-files.data',
500+
'rules/scanners-headers.data',
501+
'rules/scanners-urls.data',
502+
'rules/scanners-user-agents.data',
503+
'rules/scripting-user-agents.data',
504+
'rules/sql-errors.data',
505+
'rules/sql-function-names.data',
506+
'rules/unix-shell.data',
507+
'rules/windows-powershell-commands.data',
508508
]
509509
$alias_icons_path = '/usr/share/apache2/icons'
510510
$error_documents_path = '/usr/share/apache2/error'

‎spec/classes/mod/security_spec.rb‎

Lines changed: 79 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,7 @@
155155
}
156156
end
157157

158-
describe 'with parameters' do
158+
describe 'with custom rules' do
159159
let :params do
160160
{
161161
custom_rules: true,
@@ -173,6 +173,24 @@
173173
it { is_expected.to contain_file('/etc/httpd/modsecurity.d/custom_rules/custom_01_rules.conf').with_content %r{^\s*.*"id:199999,phase:1,nolog,allow,ctl:ruleEngine=off"$} }
174174
end
175175

176+
describe 'with custom actions' do
177+
let :params do
178+
{
179+
custom_rules: true,
180+
custom_actions_set: ['id:199999,phase:1,pass,nolog,t:none,initcol:global=global']
181+
}
182+
end
183+
184+
it {
185+
expect(subject).to contain_file('/etc/httpd/modsecurity.d/custom_rules').with(
186+
ensure: 'directory', path: '/etc/httpd/modsecurity.d/custom_rules',
187+
owner: 'apache', group: 'apache'
188+
)
189+
}
190+
191+
it { is_expected.to contain_file('/etc/httpd/modsecurity.d/custom_rules/custom_01_rules.conf').with_content %r{^\s*.*id:199999,phase:1,pass,nolog,t:none,initcol:global=global$} }
192+
end
193+
176194
describe 'with CRS parameters' do
177195
let :params do
178196
{
@@ -284,6 +302,15 @@
284302
)
285303
}
286304

305+
it { is_expected.to contain_apache__security__rule_link('rules/crawlers-user-agents.data') }
306+
307+
it {
308+
expect(subject).to contain_file('crawlers-user-agents.data').with(
309+
path: '/etc/modsecurity/activated_rules/crawlers-user-agents.data',
310+
target: '/usr/share/modsecurity-crs/rules/crawlers-user-agents.data',
311+
)
312+
}
313+
287314
it {
288315
expect(subject).to contain_file('/etc/modsecurity/security_crs.conf').with(
289316
path: '/etc/modsecurity/security_crs.conf',
@@ -302,7 +329,7 @@
302329
}
303330
end
304331

305-
describe 'with parameters' do
332+
describe 'with custom rules' do
306333
let :params do
307334
{
308335
custom_rules: true,
@@ -320,6 +347,56 @@
320347
it { is_expected.to contain_file('/etc/modsecurity/custom_rules/custom_01_rules.conf').with_content %r{\s*.*"id:199999,phase:1,nolog,allow,ctl:ruleEngine=off"$} }
321348
end
322349

350+
describe 'with custom actions' do
351+
let :params do
352+
{
353+
custom_rules: true,
354+
custom_actions_set: ['id:199999,phase:1,pass,nolog,t:none,initcol:global=global']
355+
}
356+
end
357+
358+
it {
359+
expect(subject).to contain_file('/etc/modsecurity/custom_rules').with(
360+
ensure: 'directory', path: '/etc/modsecurity/custom_rules',
361+
owner: 'www-data', group: 'www-data'
362+
)
363+
}
364+
365+
it { is_expected.to contain_file('/etc/modsecurity/custom_rules/custom_01_rules.conf').with_content %r{\s*.*id:199999,phase:1,pass,nolog,t:none,initcol:global=global$} }
366+
end
367+
368+
describe 'with absolute path to activated rule' do
369+
let :params do
370+
{
371+
activated_rules: ['/tmp/foo/bar.conf']
372+
}
373+
end
374+
375+
it { is_expected.to contain_apache__security__rule_link('/tmp/foo/bar.conf') }
376+
377+
it {
378+
expect(subject).to contain_file('bar.conf').with(
379+
path: '/etc/modsecurity/activated_rules/bar.conf',
380+
target: '/tmp/foo/bar.conf',
381+
)
382+
}
383+
end
384+
describe 'with relative path to activated rule' do
385+
let :params do
386+
{
387+
activated_rules: ['rules/bar.conf']
388+
}
389+
end
390+
391+
it { is_expected.to contain_apache__security__rule_link('rules/bar.conf') }
392+
it {
393+
expect(subject).to contain_file('bar.conf').with(
394+
path: '/etc/modsecurity/activated_rules/bar.conf',
395+
target: '/usr/share/modsecurity-crs/rules/bar.conf',
396+
)
397+
}
398+
end
399+
323400
describe 'with mod security version' do
324401
let :params do
325402
{

‎templates/mod/security_custom.conf.epp‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,12 @@
11
# This file is managed by puppet, any direct modification will be overwritten.
2+
<% if $custom_actions_set and !($custom_actions_set.empty) { -%>
3+
<% $custom_actions_set.each |$secaction| { -%>
4+
SecAction <%= $secaction %>
5+
<% } -%>
6+
<% } -%>
7+
28
<% if $custom_rules_set and !($custom_rules_set.empty) { -%>
39
<% $custom_rules_set.each |$secrule| { -%>
410
SecRule <%= $secrule %>
511
<% } -%>
6-
<% } -%>
12+
<% } -%>

0 commit comments

Comments
 (0)