Customize ModSecurity to be used in Locations #3309

diazjf · 2018-10-27T05:24:19Z

Allows ModSecurity to be configured per location. The
following annotations will be added:

enable-modsecurity
enable-owasp-core-rules
modsecurity-transaction-id

diazjf · 2018-10-27T05:24:28Z

/hold

diazjf · 2018-11-01T16:47:25Z

Error: exit status 1
2018/10/31 20:54:44 [notice] 1588#1588: ModSecurity-nginx v1.0.0
2018/10/31 20:54:44 [emerg] 1588#1588: "modsecurity_rules_file" directive Rules error. File: /etc/nginx/modsecurity/modsecurity.conf. Line: 234. Column: 17. Failed to load locate the unicode map file from: unicode.mapping 20127 Looking at: 'unicode.mapping 20127', 'unicode.mapping 20127', '/etc/nginx/modsecurity/unicode.mapping 20127', '/etc/nginx/modsecurity/unicode.mapping 20127'.  in /tmp/nginx-cfg183879158:325
nginx: [emerg] "modsecurity_rules_file" directive Rules error. File: /etc/nginx/modsecurity/modsecurity.conf. Line: 234. Column: 17. Failed to load locate the unicode map file from: unicode.mapping 20127 Looking at: 'unicode.mapping 20127', 'unicode.mapping 20127', '/etc/nginx/modsecurity/unicode.mapping 20127', '/etc/nginx/modsecurity/unicode.mapping 20127'.  in /tmp/nginx-cfg183879158:325
nginx: configuration file /tmp/nginx-cfg183879158 test failed

Seeing the following error. @aledbf when will the fix for #3329 be pushed to master?

aledbf · 2018-11-01T17:06:37Z

@diazjf we need to wait for owasp-modsecurity/ModSecurity#1941

diazjf · 2018-11-02T04:15:32Z

Fix for ModSecurity Library seen in the following link owasp-modsecurity/ModSecurity#1941

diazjf · 2018-11-02T18:32:05Z

images/nginx/rootfs/build.sh

@@ -413,14 +413,19 @@ git submodule update
 cd "$BUILD_PATH"
 git clone -b v3/master --single-branch https://github.com/SpiderLabs/ModSecurity
 cd ModSecurity/
-git checkout 973c1f1028429452308bcbce7df8a6283dc59ffe
+git checkout 18cdffdbca75e6b9f790f6df2807a32cd805c0a0


@aledbf Can the e2e test image obtain the changes in this PR?

@diazjf please remove this change ^^ and rebase from master to use the latest change introduced in #3353 and #3354

diazjf · 2018-11-04T05:18:00Z

images/nginx/rootfs/build.sh

@@ -421,6 +421,11 @@ sh build.sh
 make
 make install

+# Copy over modsecurity.conf


------------------------------------------------------------------------------- W1104 04:52:36.972626 9 queue.go:130] requeuing configmap-change, err ------------------------------------------------------------------------------- Error: exit status 1 2018/11/04 04:52:36 [notice] 1600#1600: ModSecurity-nginx v1.0.0 2018/11/04 04:52:36 [emerg] 1600#1600: "modsecurity_rules_file" directive Rules error. File: /etc/nginx/modsecurity/modsecurity.conf. Line: 236. Column: 17. Failed to locate the unicode map file from: unicode.mapping Looking at: 'unicode.mapping', 'unicode.mapping', '/etc/nginx/modsecurity/unicode.mapping', '/etc/nginx/modsecurity/unicode.mapping'. in /tmp/nginx-cfg215230822:325 nginx: [emerg] "modsecurity_rules_file" directive Rules error. File: /etc/nginx/modsecurity/modsecurity.conf. Line: 236. Column: 17. Failed to locate the unicode map file from: unicode.mapping Looking at: 'unicode.mapping', 'unicode.mapping', '/etc/nginx/modsecurity/unicode.mapping', '/etc/nginx/modsecurity/unicode.mapping'. in /tmp/nginx-cfg215230822:325 nginx: configuration file /tmp/nginx-cfg215230822 test failed -------------------------------------------------------------------------------

I think we still need these changes in the image.

@aledbf ^^

@diazjf please remove the second commit and rebase from master. The image is updated with the latest version of the modules and the mapping file in #3357

Also, if a change is required in the nginx image, that needs to be done in a separate PR.

diazjf · 2018-11-05T19:11:31Z

/hold cancel

diazjf · 2018-11-05T19:11:49Z

/assign @aledbf

docs/user-guide/nginx-configuration/annotations.md

aledbf · 2018-11-06T12:34:21Z

@diazjf besides the on/off comment this lgtm. Please change the value of the annotations and we are ok to merge

diazjf · 2018-11-06T17:35:28Z

@aledbf added to your comment and rebased with master.

The following annotations will be added: - enable-modsecurity - enable-owasp-core-rules - modsecurity-transaction-id Fixes kubernetes#3167

diazjf · 2018-11-07T16:24:47Z

@aledbf ready!

aledbf · 2018-11-07T17:26:18Z

/lgtm
/approve

k8s-ci-robot · 2018-11-07T17:26:24Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aledbf, diazjf

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [aledbf]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

aledbf · 2018-11-07T17:26:24Z

@diazjf thanks!

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Oct 27, 2018

k8s-ci-robot requested a review from aledbf October 27, 2018 05:24

k8s-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Oct 27, 2018

k8s-ci-robot requested a review from ElvinEfendi October 27, 2018 05:24

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Oct 27, 2018

diazjf force-pushed the modsecurity-location branch from f5c4dd4 to 357ffbd Compare October 30, 2018 21:15

diazjf changed the title ~~Customize ModSecurity to be used in locations~~ Customize ModSecurity to be used in Locations Oct 30, 2018

diazjf force-pushed the modsecurity-location branch 5 times, most recently from 6637952 to a8bdbd1 Compare October 31, 2018 20:30

diazjf force-pushed the modsecurity-location branch 2 times, most recently from 034efec to 1d94edd Compare November 2, 2018 04:13

diazjf force-pushed the modsecurity-location branch 4 times, most recently from cd500ea to f85ac12 Compare November 2, 2018 17:16

diazjf commented Nov 2, 2018

View reviewed changes

diazjf force-pushed the modsecurity-location branch 2 times, most recently from 2cc91cc to 42f429d Compare November 4, 2018 05:16

diazjf commented Nov 4, 2018

View reviewed changes

aledbf mentioned this pull request Nov 4, 2018

Unknown directive "modsecurity_rules" in /tmp/nginx-cfg128224059:398 #3329

Closed

diazjf force-pushed the modsecurity-location branch 3 times, most recently from b6fed2f to 351727e Compare November 5, 2018 17:51

diazjf force-pushed the modsecurity-location branch from 351727e to 0bd9342 Compare November 5, 2018 18:36

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 5, 2018

k8s-ci-robot assigned aledbf Nov 5, 2018

diazjf mentioned this pull request Nov 5, 2018

Enhance Global ModSecurity Features #3308

Closed

aledbf reviewed Nov 6, 2018

View reviewed changes

docs/user-guide/nginx-configuration/annotations.md Outdated Show resolved Hide resolved

diazjf force-pushed the modsecurity-location branch from 0bd9342 to c53a9bd Compare November 6, 2018 17:34

diazjf force-pushed the modsecurity-location branch 5 times, most recently from a33f49b to 1934654 Compare November 7, 2018 01:47

Allows ModSecurity to be configured per location

5195600

The following annotations will be added: - enable-modsecurity - enable-owasp-core-rules - modsecurity-transaction-id Fixes kubernetes#3167

diazjf force-pushed the modsecurity-location branch from 1934654 to 5195600 Compare November 7, 2018 04:24

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 7, 2018

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 7, 2018

k8s-ci-robot merged commit d97999c into kubernetes:master Nov 7, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Customize ModSecurity to be used in Locations #3309

Customize ModSecurity to be used in Locations #3309

diazjf commented Oct 27, 2018 •

edited

Loading

diazjf commented Oct 27, 2018

diazjf commented Nov 1, 2018

aledbf commented Nov 1, 2018

diazjf commented Nov 2, 2018

diazjf Nov 2, 2018

aledbf Nov 3, 2018

diazjf Nov 4, 2018

aledbf Nov 4, 2018 •

edited

Loading

diazjf Nov 5, 2018

diazjf commented Nov 5, 2018

diazjf commented Nov 5, 2018

aledbf commented Nov 6, 2018

diazjf commented Nov 6, 2018

diazjf commented Nov 7, 2018

aledbf commented Nov 7, 2018

k8s-ci-robot commented Nov 7, 2018

aledbf commented Nov 7, 2018

Customize ModSecurity to be used in Locations #3309

Customize ModSecurity to be used in Locations #3309

Conversation

diazjf commented Oct 27, 2018 • edited Loading

diazjf commented Oct 27, 2018

diazjf commented Nov 1, 2018

aledbf commented Nov 1, 2018

diazjf commented Nov 2, 2018

diazjf Nov 2, 2018

Choose a reason for hiding this comment

aledbf Nov 3, 2018

Choose a reason for hiding this comment

diazjf Nov 4, 2018

Choose a reason for hiding this comment

aledbf Nov 4, 2018 • edited Loading

Choose a reason for hiding this comment

diazjf Nov 5, 2018

Choose a reason for hiding this comment

diazjf commented Nov 5, 2018

diazjf commented Nov 5, 2018

aledbf commented Nov 6, 2018

diazjf commented Nov 6, 2018

diazjf commented Nov 7, 2018

aledbf commented Nov 7, 2018

k8s-ci-robot commented Nov 7, 2018

aledbf commented Nov 7, 2018

diazjf commented Oct 27, 2018 •

edited

Loading

aledbf Nov 4, 2018 •

edited

Loading