Skip to content

Commit 3eee5f7

Browse files
SebitoshSebitosh
committed
nginx + libmodsecurity3 infrastructure
Signed-off-by: Sebitosh <[email protected]>
1 parent 2bf51f8 commit 3eee5f7

40 files changed

+1157
-15
lines changed

‎README.md

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -703,13 +703,13 @@ SecAction "id:100020,phase:2 pass, setenv:'after=789'"
703703
* [albedo](https://github.com/coreruleset/albedo)
704704
* [go-ftw](https://github.com/coreruleset/go-ftw)
705705
* apache2 with the modsecurity and proxy modules for using the `apache2_ubuntu` + ModSecurity V2 infrastructure
706+
* libmodsecurity3 + nginx with the compiled dynamic modules, including the nginx connector, located at `/usr/lib/nginx/modules/` for using the `nginx_linux` + libmodsecurity3 infrastructure
706707

707708
To run the tests on a provided configuration, run the tool:
708709

709710
~~~bash
710-
$ ./mrts/mrts.py
711-
usage: mrts.py [-h] -i /path/to/infra/ -r /path/to/mrts/*.yaml -e /path/to/mrts/rules/ -t /path/to/mrts/tests/ [-c]
712-
[-f /path/to/mrts/ftw.mrts.config.yaml] [-v]
711+
$./mrts/mrts.py
712+
usage: mrts.py [-h] -i /path/to/infra/ -r /path/to/mrts/*.yaml -e /path/to/mrts/rules/ -t /path/to/mrts/tests/ [-c] [-f /path/to/mrts/ftw.mrts.config.yaml] [-v] [-F]
713713
mrts.py: error: the following arguments are required: -i/--infrastructure, -r/--rulesdef, -e/--expdir, -t/--testdir
714714
~~~
715715

@@ -721,6 +721,7 @@ As you can see there are few command line arguments.
721721
* `-c` - clean previously generated rule and test files
722722
* `-f` - `go-ftw` custom configuration file, if you don't want to use the default file provided in the infrastructure directory
723723
* `-v` - verbose output
724+
* `-F` - interrupt test set execution at first failed test
724725

725726
For running without a custom `go-ftw` configuration, run the `mrts.py` script from the root directory of the project (or else provide a ftw configuration file with a correct relative path).
726727

‎config_infra/nginx_linux/ftw.mrts.config.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
logfile: 'config_infra/nginx_linux/infra/log/error.log'
2+
logmarkerheadername: 'X-MRTS-TEST'
3+
logtype:
4+
name: 'nginx'
5+
timeregex: "^(\\d{4}/\\d{2}/\\d{2} \\d{2}:\\d{2}:\\d{2})"
6+
timeformat: "YYYY/MM/DD HH:mm:ss"

‎config_infra/nginx_linux/infra/fastcgi.conf

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
2+
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
3+
fastcgi_param QUERY_STRING $query_string;
4+
fastcgi_param REQUEST_METHOD $request_method;
5+
fastcgi_param CONTENT_TYPE $content_type;
6+
fastcgi_param CONTENT_LENGTH $content_length;
7+
8+
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
9+
fastcgi_param REQUEST_URI $request_uri;
10+
fastcgi_param DOCUMENT_URI $document_uri;
11+
fastcgi_param DOCUMENT_ROOT $document_root;
12+
fastcgi_param SERVER_PROTOCOL $server_protocol;
13+
fastcgi_param REQUEST_SCHEME $scheme;
14+
fastcgi_param HTTPS $https if_not_empty;
15+
16+
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
17+
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
18+
19+
fastcgi_param REMOTE_ADDR $remote_addr;
20+
fastcgi_param REMOTE_PORT $remote_port;
21+
fastcgi_param REMOTE_USER $remote_user;
22+
fastcgi_param SERVER_ADDR $server_addr;
23+
fastcgi_param SERVER_PORT $server_port;
24+
fastcgi_param SERVER_NAME $server_name;
25+
26+
# PHP only, required if PHP was built with --enable-force-cgi-redirect
27+
fastcgi_param REDIRECT_STATUS 200;

‎config_infra/nginx_linux/infra/fastcgi_params

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
2+
fastcgi_param QUERY_STRING $query_string;
3+
fastcgi_param REQUEST_METHOD $request_method;
4+
fastcgi_param CONTENT_TYPE $content_type;
5+
fastcgi_param CONTENT_LENGTH $content_length;
6+
7+
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
8+
fastcgi_param REQUEST_URI $request_uri;
9+
fastcgi_param DOCUMENT_URI $document_uri;
10+
fastcgi_param DOCUMENT_ROOT $document_root;
11+
fastcgi_param SERVER_PROTOCOL $server_protocol;
12+
fastcgi_param REQUEST_SCHEME $scheme;
13+
fastcgi_param HTTPS $https if_not_empty;
14+
15+
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
16+
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
17+
18+
fastcgi_param REMOTE_ADDR $remote_addr;
19+
fastcgi_param REMOTE_PORT $remote_port;
20+
fastcgi_param REMOTE_USER $remote_user;
21+
fastcgi_param SERVER_ADDR $server_addr;
22+
fastcgi_param SERVER_PORT $server_port;
23+
fastcgi_param SERVER_NAME $server_name;
24+
25+
# PHP only, required if PHP was built with --enable-force-cgi-redirect
26+
fastcgi_param REDIRECT_STATUS 200;

‎config_infra/nginx_linux/infra/koi-utf

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
2+
# This map is not a full koi8-r <> utf8 map: it does not contain
3+
# box-drawing and some other characters. Besides this map contains
4+
# several koi8-u and Byelorussian letters which are not in koi8-r.
5+
# If you need a full and standard map, use contrib/unicode2nginx/koi-utf
6+
# map instead.
7+
8+
charset_map koi8-r utf-8 {
9+
10+
80 E282AC ; # euro
11+
12+
95 E280A2 ; # bullet
13+
14+
9A C2A0 ; # &nbsp;
15+
16+
9E C2B7 ; # &middot;
17+
18+
A3 D191 ; # small yo
19+
A4 D194 ; # small Ukrainian ye
20+
21+
A6 D196 ; # small Ukrainian i
22+
A7 D197 ; # small Ukrainian yi
23+
24+
AD D291 ; # small Ukrainian soft g
25+
AE D19E ; # small Byelorussian short u
26+
27+
B0 C2B0 ; # &deg;
28+
29+
B3 D081 ; # capital YO
30+
B4 D084 ; # capital Ukrainian YE
31+
32+
B6 D086 ; # capital Ukrainian I
33+
B7 D087 ; # capital Ukrainian YI
34+
35+
B9 E28496 ; # numero sign
36+
37+
BD D290 ; # capital Ukrainian soft G
38+
BE D18E ; # capital Byelorussian short U
39+
40+
BF C2A9 ; # (C)
41+
42+
C0 D18E ; # small yu
43+
C1 D0B0 ; # small a
44+
C2 D0B1 ; # small b
45+
C3 D186 ; # small ts
46+
C4 D0B4 ; # small d
47+
C5 D0B5 ; # small ye
48+
C6 D184 ; # small f
49+
C7 D0B3 ; # small g
50+
C8 D185 ; # small kh
51+
C9 D0B8 ; # small i
52+
CA D0B9 ; # small j
53+
CB D0BA ; # small k
54+
CC D0BB ; # small l
55+
CD D0BC ; # small m
56+
CE D0BD ; # small n
57+
CF D0BE ; # small o
58+
59+
D0 D0BF ; # small p
60+
D1 D18F ; # small ya
61+
D2 D180 ; # small r
62+
D3 D181 ; # small s
63+
D4 D182 ; # small t
64+
D5 D183 ; # small u
65+
D6 D0B6 ; # small zh
66+
D7 D0B2 ; # small v
67+
D8 D18C ; # small soft sign
68+
D9 D18B ; # small y
69+
DA D0B7 ; # small z
70+
DB D188 ; # small sh
71+
DC D18D ; # small e
72+
DD D189 ; # small shch
73+
DE D187 ; # small ch
74+
DF D18A ; # small hard sign
75+
76+
E0 D0AE ; # capital YU
77+
E1 D090 ; # capital A
78+
E2 D091 ; # capital B
79+
E3 D0A6 ; # capital TS
80+
E4 D094 ; # capital D
81+
E5 D095 ; # capital YE
82+
E6 D0A4 ; # capital F
83+
E7 D093 ; # capital G
84+
E8 D0A5 ; # capital KH
85+
E9 D098 ; # capital I
86+
EA D099 ; # capital J
87+
EB D09A ; # capital K
88+
EC D09B ; # capital L
89+
ED D09C ; # capital M
90+
EE D09D ; # capital N
91+
EF D09E ; # capital O
92+
93+
F0 D09F ; # capital P
94+
F1 D0AF ; # capital YA
95+
F2 D0A0 ; # capital R
96+
F3 D0A1 ; # capital S
97+
F4 D0A2 ; # capital T
98+
F5 D0A3 ; # capital U
99+
F6 D096 ; # capital ZH
100+
F7 D092 ; # capital V
101+
F8 D0AC ; # capital soft sign
102+
F9 D0AB ; # capital Y
103+
FA D097 ; # capital Z
104+
FB D0A8 ; # capital SH
105+
FC D0AD ; # capital E
106+
FD D0A9 ; # capital SHCH
107+
FE D0A7 ; # capital CH
108+
FF D0AA ; # capital hard sign
109+
}

‎config_infra/nginx_linux/infra/koi-win

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
2+
charset_map koi8-r windows-1251 {
3+
4+
80 88 ; # euro
5+
6+
95 95 ; # bullet
7+
8+
9A A0 ; # &nbsp;
9+
10+
9E B7 ; # &middot;
11+
12+
A3 B8 ; # small yo
13+
A4 BA ; # small Ukrainian ye
14+
15+
A6 B3 ; # small Ukrainian i
16+
A7 BF ; # small Ukrainian yi
17+
18+
AD B4 ; # small Ukrainian soft g
19+
AE A2 ; # small Byelorussian short u
20+
21+
B0 B0 ; # &deg;
22+
23+
B3 A8 ; # capital YO
24+
B4 AA ; # capital Ukrainian YE
25+
26+
B6 B2 ; # capital Ukrainian I
27+
B7 AF ; # capital Ukrainian YI
28+
29+
B9 B9 ; # numero sign
30+
31+
BD A5 ; # capital Ukrainian soft G
32+
BE A1 ; # capital Byelorussian short U
33+
34+
BF A9 ; # (C)
35+
36+
C0 FE ; # small yu
37+
C1 E0 ; # small a
38+
C2 E1 ; # small b
39+
C3 F6 ; # small ts
40+
C4 E4 ; # small d
41+
C5 E5 ; # small ye
42+
C6 F4 ; # small f
43+
C7 E3 ; # small g
44+
C8 F5 ; # small kh
45+
C9 E8 ; # small i
46+
CA E9 ; # small j
47+
CB EA ; # small k
48+
CC EB ; # small l
49+
CD EC ; # small m
50+
CE ED ; # small n
51+
CF EE ; # small o
52+
53+
D0 EF ; # small p
54+
D1 FF ; # small ya
55+
D2 F0 ; # small r
56+
D3 F1 ; # small s
57+
D4 F2 ; # small t
58+
D5 F3 ; # small u
59+
D6 E6 ; # small zh
60+
D7 E2 ; # small v
61+
D8 FC ; # small soft sign
62+
D9 FB ; # small y
63+
DA E7 ; # small z
64+
DB F8 ; # small sh
65+
DC FD ; # small e
66+
DD F9 ; # small shch
67+
DE F7 ; # small ch
68+
DF FA ; # small hard sign
69+
70+
E0 DE ; # capital YU
71+
E1 C0 ; # capital A
72+
E2 C1 ; # capital B
73+
E3 D6 ; # capital TS
74+
E4 C4 ; # capital D
75+
E5 C5 ; # capital YE
76+
E6 D4 ; # capital F
77+
E7 C3 ; # capital G
78+
E8 D5 ; # capital KH
79+
E9 C8 ; # capital I
80+
EA C9 ; # capital J
81+
EB CA ; # capital K
82+
EC CB ; # capital L
83+
ED CC ; # capital M
84+
EE CD ; # capital N
85+
EF CE ; # capital O
86+
87+
F0 CF ; # capital P
88+
F1 DF ; # capital YA
89+
F2 D0 ; # capital R
90+
F3 D1 ; # capital S
91+
F4 D2 ; # capital T
92+
F5 D3 ; # capital U
93+
F6 C6 ; # capital ZH
94+
F7 C2 ; # capital V
95+
F8 DC ; # capital soft sign
96+
F9 DB ; # capital Y
97+
FA C7 ; # capital Z
98+
FB D8 ; # capital SH
99+
FC DD ; # capital E
100+
FD D9 ; # capital SHCH
101+
FE D7 ; # capital CH
102+
FF DA ; # capital hard sign
103+
}

‎config_infra/nginx_linux/infra/log/access.log

Whitespace-only changes.

‎config_infra/nginx_linux/infra/log/error.log

Whitespace-only changes.

‎config_infra/nginx_linux/infra/log/modsec_audit.log

Whitespace-only changes.

‎config_infra/nginx_linux/infra/mime.types

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
2+
types {
3+
text/html html htm shtml;
4+
text/css css;
5+
text/xml xml;
6+
image/gif gif;
7+
image/jpeg jpeg jpg;
8+
application/javascript js;
9+
application/atom+xml atom;
10+
application/rss+xml rss;
11+
12+
text/mathml mml;
13+
text/plain txt;
14+
text/vnd.sun.j2me.app-descriptor jad;
15+
text/vnd.wap.wml wml;
16+
text/x-component htc;
17+
18+
image/png png;
19+
image/tiff tif tiff;
20+
image/vnd.wap.wbmp wbmp;
21+
image/x-icon ico;
22+
image/x-jng jng;
23+
image/x-ms-bmp bmp;
24+
image/svg+xml svg svgz;
25+
image/webp webp;
26+
27+
application/font-woff woff;
28+
application/java-archive jar war ear;
29+
application/json json;
30+
application/mac-binhex40 hqx;
31+
application/msword doc;
32+
application/pdf pdf;
33+
application/postscript ps eps ai;
34+
application/rtf rtf;
35+
application/vnd.apple.mpegurl m3u8;
36+
application/vnd.ms-excel xls;
37+
application/vnd.ms-fontobject eot;
38+
application/vnd.ms-powerpoint ppt;
39+
application/vnd.wap.wmlc wmlc;
40+
application/vnd.google-earth.kml+xml kml;
41+
application/vnd.google-earth.kmz kmz;
42+
application/x-7z-compressed 7z;
43+
application/x-cocoa cco;
44+
application/x-java-archive-diff jardiff;
45+
application/x-java-jnlp-file jnlp;
46+
application/x-makeself run;
47+
application/x-perl pl pm;
48+
application/x-pilot prc pdb;
49+
application/x-rar-compressed rar;
50+
application/x-redhat-package-manager rpm;
51+
application/x-sea sea;
52+
application/x-shockwave-flash swf;
53+
application/x-stuffit sit;
54+
application/x-tcl tcl tk;
55+
application/x-x509-ca-cert der pem crt;
56+
application/x-xpinstall xpi;
57+
application/xhtml+xml xhtml;
58+
application/xspf+xml xspf;
59+
application/zip zip;
60+
61+
application/octet-stream bin exe dll;
62+
application/octet-stream deb;
63+
application/octet-stream dmg;
64+
application/octet-stream iso img;
65+
application/octet-stream msi msp msm;
66+
67+
application/vnd.openxmlformats-officedocument.wordprocessingml.document docx;
68+
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx;
69+
application/vnd.openxmlformats-officedocument.presentationml.presentation pptx;
70+
71+
audio/midi mid midi kar;
72+
audio/mpeg mp3;
73+
audio/ogg ogg;
74+
audio/x-m4a m4a;
75+
audio/x-realaudio ra;
76+
77+
video/3gpp 3gpp 3gp;
78+
video/mp2t ts;
79+
video/mp4 mp4;
80+
video/mpeg mpeg mpg;
81+
video/quicktime mov;
82+
video/webm webm;
83+
video/x-flv flv;
84+
video/x-m4v m4v;
85+
video/x-mng mng;
86+
video/x-ms-asf asx asf;
87+
video/x-ms-wmv wmv;
88+
video/x-msvideo avi;
89+
}

‎config_infra/nginx_linux/infra/modsecurity/main.conf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
2+
Include modsecurity/modsecurity.conf
3+
4+
Include mrts.load

0 commit comments

Comments
 (0)