Skip to content

Commit 75ad355

Browse files
david22swandavid22swan
authored
Merge pull request #2353 from Vincevrp/secresponsebodylimitaction
Parameterize SecRequestBodyLimitAction and SecResponseBodyLimitAction
2 parents e836d56 + 36898de commit 75ad355

File tree

3 files changed

+60
-40
lines changed

3 files changed

+60
-40
lines changed

‎manifests/mod/security.pp

Lines changed: 50 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -98,8 +98,16 @@
9898
# @param secrequestbodyaccess
9999
# Toggle SecRequestBodyAccess On or Off
100100
#
101+
# @param secrequestbodylimitaction
102+
# Controls what happens once a request body limit, configured with
103+
# SecRequestBodyLimit, is encountered
104+
#
101105
# @param secresponsebodyaccess
102106
# Toggle SecResponseBodyAccess On or Off
107+
#
108+
# @param secresponsebodylimitaction
109+
# Controls what happens once a response body limit, configured with
110+
# SecResponseBodyLimitAction, is encountered.
103111
#
104112
# @param manage_security_crs
105113
# Toggles whether to manage ModSecurity Core Rule Set
@@ -124,44 +132,46 @@
124132
# @see https://coreruleset.org/docs/ for addional documentation
125133
#
126134
class apache::mod::security (
127-
Stdlib::Absolutepath $logroot = $apache::params::logroot,
128-
Integer $version = $apache::params::modsec_version,
129-
Optional[String] $crs_package = $apache::params::modsec_crs_package,
130-
Array[String] $activated_rules = $apache::params::modsec_default_rules,
131-
Boolean $custom_rules = $apache::params::modsec_custom_rules,
132-
Optional[Array[String]] $custom_rules_set = $apache::params::modsec_custom_rules_set,
133-
Stdlib::Absolutepath $modsec_dir = $apache::params::modsec_dir,
134-
String $modsec_secruleengine = $apache::params::modsec_secruleengine,
135-
String $audit_log_relevant_status = '^(?:5|4(?!04))',
136-
String $audit_log_parts = $apache::params::modsec_audit_log_parts,
137-
String $audit_log_type = $apache::params::modsec_audit_log_type,
138-
Optional[Stdlib::Absolutepath] $audit_log_storage_dir = undef,
139-
Integer $secpcrematchlimit = $apache::params::secpcrematchlimit,
140-
Integer $secpcrematchlimitrecursion = $apache::params::secpcrematchlimitrecursion,
141-
String $allowed_methods = 'GET HEAD POST OPTIONS',
142-
String $content_types = 'application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|application/x-amf',
143-
String $restricted_extensions = '.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/',
144-
String $restricted_headers = '/Proxy-Connection/ /Lock-Token/ /Content-Range/ /Translate/ /via/ /if/',
145-
String $secdefaultaction = 'deny',
146-
Integer $inbound_anomaly_threshold = 5,
147-
Integer $outbound_anomaly_threshold = 4,
148-
Integer $critical_anomaly_score = 5,
149-
Integer $error_anomaly_score = 4,
150-
Integer $warning_anomaly_score = 3,
151-
Integer $notice_anomaly_score = 2,
152-
Integer $secrequestmaxnumargs = 255,
153-
Integer $secrequestbodylimit = 13107200,
154-
Integer $secrequestbodynofileslimit = 131072,
155-
Integer $secrequestbodyinmemorylimit = 131072,
156-
Integer[1,4] $paranoia_level = 1,
157-
Integer[1,4] $executing_paranoia_level = $paranoia_level,
158-
Enum['On', 'Off'] $secrequestbodyaccess = 'On',
159-
Enum['On', 'Off'] $secresponsebodyaccess = 'Off',
160-
Boolean $manage_security_crs = true,
161-
Boolean $enable_dos_protection = true,
162-
Integer[1, default] $dos_burst_time_slice = 60,
163-
Integer[1, default] $dos_counter_threshold = 100,
164-
Integer[1, default] $dos_block_timeout = 600,
135+
Stdlib::Absolutepath $logroot = $apache::params::logroot,
136+
Integer $version = $apache::params::modsec_version,
137+
Optional[String] $crs_package = $apache::params::modsec_crs_package,
138+
Array[String] $activated_rules = $apache::params::modsec_default_rules,
139+
Boolean $custom_rules = $apache::params::modsec_custom_rules,
140+
Optional[Array[String]] $custom_rules_set = $apache::params::modsec_custom_rules_set,
141+
Stdlib::Absolutepath $modsec_dir = $apache::params::modsec_dir,
142+
String $modsec_secruleengine = $apache::params::modsec_secruleengine,
143+
String $audit_log_relevant_status = '^(?:5|4(?!04))',
144+
String $audit_log_parts = $apache::params::modsec_audit_log_parts,
145+
String $audit_log_type = $apache::params::modsec_audit_log_type,
146+
Optional[Stdlib::Absolutepath] $audit_log_storage_dir = undef,
147+
Integer $secpcrematchlimit = $apache::params::secpcrematchlimit,
148+
Integer $secpcrematchlimitrecursion = $apache::params::secpcrematchlimitrecursion,
149+
String $allowed_methods = 'GET HEAD POST OPTIONS',
150+
String $content_types = 'application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|application/x-amf',
151+
String $restricted_extensions = '.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/',
152+
String $restricted_headers = '/Proxy-Connection/ /Lock-Token/ /Content-Range/ /Translate/ /via/ /if/',
153+
String $secdefaultaction = 'deny',
154+
Integer $inbound_anomaly_threshold = 5,
155+
Integer $outbound_anomaly_threshold = 4,
156+
Integer $critical_anomaly_score = 5,
157+
Integer $error_anomaly_score = 4,
158+
Integer $warning_anomaly_score = 3,
159+
Integer $notice_anomaly_score = 2,
160+
Integer $secrequestmaxnumargs = 255,
161+
Integer $secrequestbodylimit = 13107200,
162+
Integer $secrequestbodynofileslimit = 131072,
163+
Integer $secrequestbodyinmemorylimit = 131072,
164+
Integer[1,4] $paranoia_level = 1,
165+
Integer[1,4] $executing_paranoia_level = $paranoia_level,
166+
Enum['On', 'Off'] $secrequestbodyaccess = 'On',
167+
Enum['On', 'Off'] $secresponsebodyaccess = 'Off',
168+
Enum['Reject', 'ProcessPartial'] $secrequestbodylimitaction = 'Reject',
169+
Enum['Reject', 'ProcessPartial'] $secresponsebodylimitaction = 'ProcessPartial',
170+
Boolean $manage_security_crs = true,
171+
Boolean $enable_dos_protection = true,
172+
Integer[1, default] $dos_burst_time_slice = 60,
173+
Integer[1, default] $dos_counter_threshold = 100,
174+
Integer[1, default] $dos_block_timeout = 600,
165175
) inherits apache::params {
166176
include apache
167177

@@ -228,6 +238,8 @@
228238
# - secrequestbodyinmemorylimit
229239
# - secrequestbodyaccess
230240
# - secresponsebodyaccess
241+
# - secrequestbodylimitaction
242+
# - secresponsebodylimitaction
231243
file { 'security.conf':
232244
ensure => file,
233245
content => template('apache/mod/security.conf.erb'),

‎spec/classes/mod/security_spec.rb

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,8 @@
8181
secdefaultaction: 'deny,status:406,nolog,auditlog',
8282
secrequestbodyaccess: 'Off',
8383
secresponsebodyaccess: 'On',
84+
secrequestbodylimitaction: 'ProcessPartial',
85+
secresponsebodylimitaction: 'Reject',
8486
}
8587
end
8688

@@ -90,6 +92,8 @@
9092
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecAuditLogStorageDir /var/log/httpd/audit$} }
9193
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecRequestBodyAccess Off$} }
9294
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecResponseBodyAccess On$} }
95+
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecRequestBodyLimitAction ProcessPartial$} }
96+
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecResponseBodyLimitAction Reject$} }
9397
it { is_expected.to contain_file('/etc/httpd/modsecurity.d/security_crs.conf').with_content %r{^\s*SecDefaultAction "phase:2,deny,status:406,nolog,auditlog"$} }
9498
it {
9599
is_expected.to contain_file('bar.conf').with(
@@ -249,6 +253,8 @@
249253
secdefaultaction: 'deny,status:406,nolog,auditlog',
250254
secrequestbodyaccess: 'Off',
251255
secresponsebodyaccess: 'On',
256+
secrequestbodylimitaction: 'ProcessPartial',
257+
secresponsebodylimitaction: 'Reject',
252258
}
253259
end
254260

@@ -259,6 +265,8 @@
259265
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecAuditLogStorageDir /var/log/httpd/audit$} }
260266
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecRequestBodyAccess Off$} }
261267
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecResponseBodyAccess On$} }
268+
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecRequestBodyLimitAction ProcessPartial$} }
269+
it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecResponseBodyLimitAction Reject$} }
262270
it { is_expected.to contain_file('/etc/modsecurity/security_crs.conf').with_content %r{^\s*SecDefaultAction "phase:2,deny,status:406,nolog,auditlog"$} }
263271
it {
264272
is_expected.to contain_file('bar.conf').with(

‎templates/mod/security.conf.erb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
SecRequestBodyLimit <%= @secrequestbodylimit %>
1111
SecRequestBodyNoFilesLimit <%= @secrequestbodynofileslimit %>
1212
SecRequestBodyInMemoryLimit <%= @secrequestbodyinmemorylimit %>
13-
SecRequestBodyLimitAction Reject
13+
SecRequestBodyLimitAction <%= @secrequestbodylimitaction %>
1414
SecRule REQBODY_ERROR "!@eq 0" \
1515
"id:'200001', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"
1616
SecRule MULTIPART_STRICT_ERROR "!@eq 0" \
@@ -43,7 +43,7 @@
4343
SecResponseBodyAccess <%= @secresponsebodyaccess %>
4444
SecResponseBodyMimeType text/plain text/html text/xml
4545
SecResponseBodyLimit 524288
46-
SecResponseBodyLimitAction ProcessPartial
46+
SecResponseBodyLimitAction <%= @secresponsebodylimitaction %>
4747
SecDebugLogLevel 0
4848
SecAuditEngine RelevantOnly
4949
SecAuditLogRelevantStatus "<%= @audit_log_relevant_status %>"

0 commit comments

Comments
 (0)