Skip to content

Commit 4951522

Browse files
fl0ppy-d1skfl0ppy-d1sk
authored
Merge pull request #84 from bunkerity/dev
Add support for new AppSec feature in CrowdSec plugin and update Coraza
2 parents 8b360dc + 2a6cc19 commit 4951522

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

60 files changed

+850
-573
lines changed

‎.github/workflows/codeql.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,13 @@ jobs:
1919
language: ["python", "go"]
2020
steps:
2121
- name: Checkout repository
22-
uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
22+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
2323
- name: Initialize CodeQL
24-
uses: github/codeql-action/init@ccf74c947955fd1cf117aef6a0e4e66191ef6f61 # v3.25.4
24+
uses: github/codeql-action/init@4fa2a7953630fd2f3fb380f21be14ede0169dd4f # v3.25.12
2525
with:
2626
languages: ${{ matrix.language }}
2727
config-file: ./.github/codeql.yml
2828
- name: Perform CodeQL Analysis
29-
uses: github/codeql-action/analyze@ccf74c947955fd1cf117aef6a0e4e66191ef6f61 # v3.25.4
29+
uses: github/codeql-action/analyze@4fa2a7953630fd2f3fb380f21be14ede0169dd4f # v3.25.12
3030
with:
3131
category: "/language:${{matrix.language}}"

‎.github/workflows/tests.yml

+7-4
Original file line numberDiff line numberDiff line change
@@ -17,18 +17,18 @@ jobs:
1717
runs-on: ubuntu-latest
1818
steps:
1919
- name: Checkout source code
20-
uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
20+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
2121

2222
- name: Get BW tag
2323
run: |
2424
if [ "$GITHUB_REF" = "refs/heads/main" ] ; then
25-
echo "BW_TAG=1.5.7" >> $GITHUB_ENV
25+
echo "BW_TAG=1.5.9" >> $GITHUB_ENV
2626
else
2727
echo "BW_TAG=dev" >> $GITHUB_ENV
2828
fi
2929
3030
- name: Login to Docker Hub
31-
uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
31+
uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
3232
with:
3333
username: ${{ secrets.DOCKER_USERNAME }}
3434
password: ${{ secrets.DOCKER_TOKEN }}
@@ -47,12 +47,15 @@ jobs:
4747

4848
- name: Run CrowdSec stream tests
4949
run: ./.tests/crowdsec.sh stream
50+
51+
- name: Run CrowdSec appsec tests
52+
run: ./.tests/crowdsec.sh appsec
5053

5154
- name: Run VirusTotal tests
5255
run: ./.tests/virustotal.sh
5356
env:
5457
VIRUSTOTAL_API_KEY: ${{ secrets.VIRUSTOTAL_API_KEY }}
5558

5659
- name: Build and push APIs
57-
if: env.BW_TAG == '1.5.7'
60+
if: env.BW_TAG == '1.5.9'
5861
run: ./.tests/build-push.sh "${{ env.BW_TAG }}"

‎.gitignore

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,4 @@
33
*.zip
44
env
55
node_modules
6-
style.css
6+
style.css

‎.pre-commit-config.yaml

+8-8
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
exclude: (^coraza/api/coreruleset|(^LICENSE.md|.svg)$)
44
repos:
55
- repo: https://github.com/pre-commit/pre-commit-hooks
6-
rev: c4a0b883114b00d8d76b479c820ce7950211c99b # frozen: v4.5.0
6+
rev: 2c9f875913ee60ca25ce70243dc24d5b6415598c # frozen: v4.6.0
77
hooks:
88
- id: trailing-whitespace
99
- id: end-of-file-fixer
@@ -12,7 +12,7 @@ repos:
1212
- id: check-case-conflict
1313

1414
- repo: https://github.com/ambv/black
15-
rev: e026c93888f91a47a9c9f4e029f3eb07d96375e6 # frozen: 24.1.1
15+
rev: 3702ba224ecffbcec30af640c149f231d90aebdb # frozen: 24.4.2
1616
hooks:
1717
- id: black
1818
name: Black Python Formatter
@@ -31,34 +31,34 @@ repos:
3131
exclude: ^crowdsec/lib/
3232

3333
- repo: https://github.com/lunarmodules/luacheck
34-
rev: 418f48976c73be697fe64b0eba9ea9821ac9bca8 # frozen: v1.1.2
34+
rev: cc089e3f65acdd1ef8716cc73a3eca24a6b845e4 # frozen: v1.2.0
3535
hooks:
3636
- id: luacheck
3737
exclude: ^crowdsec/lib/
3838
args: ["--std", "min", "--codes", "--ranges", "--no-cache"]
3939

4040
- repo: https://github.com/pycqa/flake8
41-
rev: 7d37d9032d0d161634be4554273c30efd4dea0b3 # frozen: 7.0.0
41+
rev: 1978e2b0de6efa0cb2a2b6f3f7986aa6569dd2be # frozen: 7.1.0
4242
hooks:
4343
- id: flake8
4444
name: Flake8 Python Linter
4545
args: ["--max-line-length=250", "--ignore=E266,E402,E722,W503"]
4646

4747
- repo: https://github.com/codespell-project/codespell
48-
rev: 6e41aba91fb32e9feb741a6258eefeb9c6e4a482 # frozen: v2.2.6
48+
rev: 193cd7d27cd571f79358af09a8fb8997e54f8fff # frozen: v2.3.0
4949
hooks:
5050
- id: codespell
5151
name: Codespell Spell Checker
52-
entry: codespell --ignore-regex="(tabEl|Widgits)" --skip src/ui/static/js/utils/flatpickr.js,CHANGELOG.md
52+
entry: codespell --ignore-regex="(tabEl|Widgits)" --skip */ui/template.html,src/ui/static/js/utils/flatpickr.js,CHANGELOG.md
5353
language: python
5454
types: [text]
5555

5656
- repo: https://github.com/gitleaks/gitleaks
57-
rev: 145400593c178304246371bc45290588bc72f43e # frozen: v8.18.2
57+
rev: 77c3c6a34b2577d71083442326c60b8fd58926ec # frozen: v8.18.4
5858
hooks:
5959
- id: gitleaks
6060

6161
- repo: https://github.com/koalaman/shellcheck-precommit
62-
rev: 3f77b826548d8dc2d26675f077361c92773b50a7 # frozen: v0.9.0
62+
rev: 2491238703a5d3415bb2b7ff11388bf775372f29 # frozen: v0.10.0
6363
hooks:
6464
- id: shellcheck

‎.tests/clamav/docker-compose.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ version: "3"
22

33
services:
44
bunkerweb:
5-
image: bunkerity/bunkerweb:1.5.7
5+
image: bunkerity/bunkerweb:1.5.8
66
ports:
77
- 80:8080
88
- 443:8443
@@ -27,7 +27,7 @@ services:
2727
- bw-services
2828

2929
bw-scheduler:
30-
image: bunkerity/bunkerweb-scheduler:1.5.7
30+
image: bunkerity/bunkerweb-scheduler:1.5.8
3131
depends_on:
3232
- bunkerweb
3333
- bw-docker

‎.tests/coraza.sh

+1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
#!/bin/bash
22

3+
# shellcheck disable=SC1091
34
. .tests/utils.sh
45

56
echo "ℹ️ Starting Coraza tests ..."

‎.tests/coraza/docker-compose.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ version: "3"
22

33
services:
44
bunkerweb:
5-
image: bunkerity/bunkerweb:1.5.7
5+
image: bunkerity/bunkerweb:1.5.8
66
ports:
77
- 80:8080
88
- 443:8443
@@ -26,7 +26,7 @@ services:
2626
- bw-services
2727

2828
bw-scheduler:
29-
image: bunkerity/bunkerweb-scheduler:1.5.7
29+
image: bunkerity/bunkerweb-scheduler:1.5.8
3030
depends_on:
3131
- bunkerweb
3232
- bw-docker

‎.tests/crowdsec.sh

+33-16
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,16 @@ do_and_check_cmd cp .tests/crowdsec/docker-compose.yml /tmp/bunkerweb-plugins/cr
1919
# Edit compose
2020
do_and_check_cmd sed -i "s@bunkerity/bunkerweb:.*\$@bunkerweb:tests@g" /tmp/bunkerweb-plugins/crowdsec/docker-compose.yml
2121
do_and_check_cmd sed -i "s@bunkerity/bunkerweb-scheduler:.*\$@bunkerweb-scheduler:tests@g" /tmp/bunkerweb-plugins/crowdsec/docker-compose.yml
22-
do_and_check_cmd sed -i "s@CROWDSEC_MODE=.*\$@CROWDSEC_MODE=$1@g" /tmp/bunkerweb-plugins/crowdsec/docker-compose.yml
22+
if [ $1 == "appsec" ] ; then
23+
do_and_check_cmd sed -i "s@CROWDSEC_MODE=.*\$@CROWDSEC_MODE=live@g" /tmp/bunkerweb-plugins/crowdsec/docker-compose.yml
24+
do_and_check_cmd sed -i "s@CROWDSEC_APPSEC_URL=.*\$@CROWDSEC_APPSEC_URL=http://crowdsec:7422@g" /tmp/bunkerweb-plugins/crowdsec/docker-compose.yml
25+
else
26+
do_and_check_cmd sed -i "s@CROWDSEC_MODE=.*\$@CROWDSEC_MODE=$1@g" /tmp/bunkerweb-plugins/crowdsec/docker-compose.yml
27+
fi
2328

2429
# Copy configs
2530
do_and_check_cmd cp .tests/crowdsec/acquis.yaml /tmp/bunkerweb-plugins/crowdsec
31+
do_and_check_cmd cp .tests/crowdsec/appsec.yaml /tmp/bunkerweb-plugins/crowdsec
2632
do_and_check_cmd cp .tests/crowdsec/syslog-ng.conf /tmp/bunkerweb-plugins/crowdsec
2733

2834
# Do the tests
@@ -58,23 +64,34 @@ if [ "$success" == "ko" ] ; then
5864
exit 1
5965
fi
6066

61-
# Run basic attack with dirb
62-
echo "ℹ️ Executing dirb ..."
63-
do_and_check_cmd sudo apt install -y dirb
64-
dirb http://localhost -H "Host: www.example.com" -H "User-Agent: LegitOne" -f > /dev/null 2>&1
67+
if [ "$1" != "appsec" ] ; then
68+
# Run basic attack with dirb
69+
echo "ℹ️ Executing dirb ..."
70+
do_and_check_cmd sudo apt install -y dirb
71+
dirb http://localhost -H "Host: www.example.com" -H "User-Agent: LegitOne" -f > /dev/null 2>&1
6572

66-
# Wait if are in stream mode
67-
if [ "$1" == "stream" ] ; then
68-
sleep 20
69-
fi
73+
# Wait if are in stream mode
74+
if [ "$1" == "stream" ] ; then
75+
sleep 20
76+
fi
7077

71-
# Expect a 403
72-
echo "ℹ️ Checking CS ..."
73-
success="ko"
74-
ret="$(curl -s -o /dev/null -w "%{http_code}" -H "Host: www.example.com" http://localhost)"
75-
# shellcheck disable=SC2181
76-
if [ $? -eq 0 ] && [ "$ret" -eq 403 ] ; then
77-
success="ok"
78+
# Expect a 403
79+
echo "ℹ️ Checking CS ..."
80+
success="ko"
81+
ret="$(curl -s -o /dev/null -w "%{http_code}" -H "Host: www.example.com" http://localhost)"
82+
# shellcheck disable=SC2181
83+
if [ $? -eq 0 ] && [ "$ret" -eq 403 ] ; then
84+
success="ok"
85+
fi
86+
else
87+
# Send a malicious pattern
88+
echo "ℹ️ Sending malicious pattern"
89+
success="ko"
90+
ret="$(curl -s -o /dev/null -w "%{http_code}" -H "Host: www.example.com" http://localhost/rpc2)"
91+
# shellcheck disable=SC2181
92+
if [ $? -eq 0 ] && [ "$ret" -eq 403 ] ; then
93+
success="ok"
94+
fi
7895
fi
7996

8097
# We're done

‎.tests/crowdsec/appsec.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
appsec_config: crowdsecurity/appsec-default
2+
labels:
3+
type: appsec
4+
listen_addr: 0.0.0.0:7422
5+
source: appsec

‎.tests/crowdsec/docker-compose.yml

+5-3
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ version: "3"
22

33
services:
44
bunkerweb:
5-
image: bunkerity/bunkerweb:1.5.7
5+
image: bunkerity/bunkerweb:1.5.8
66
ports:
77
- 80:8080
88
- 443:8443
@@ -15,6 +15,7 @@ services:
1515
- CROWDSEC_API=http://crowdsec:8080
1616
- CROWDSEC_API_KEY=s3cr3tb0unc3rk3y
1717
- CROWDSEC_MODE=
18+
- CROWDSEC_APPSEC_URL=
1819
- LOG_LEVEL=info
1920
- USE_MODSECURITY=no
2021
- USE_BLACKLIST=no
@@ -34,7 +35,7 @@ services:
3435
syslog-address: "udp://10.10.10.254:514"
3536

3637
bw-scheduler:
37-
image: bunkerity/bunkerweb-scheduler:1.5.7
38+
image: bunkerity/bunkerweb-scheduler:1.5.8
3839
depends_on:
3940
- bunkerweb
4041
- bw-docker
@@ -61,10 +62,11 @@ services:
6162
volumes:
6263
- cs-data:/var/lib/crowdsec/data
6364
- ./acquis.yaml:/etc/crowdsec/acquis.yaml
65+
- ./appsec.yaml:/etc/crowdsec/acquis.d/appsec.yaml
6466
- bw-logs:/var/log:ro
6567
environment:
6668
- BOUNCER_KEY_bunkerweb=s3cr3tb0unc3rk3y
67-
- COLLECTIONS=crowdsecurity/nginx
69+
- COLLECTIONS=crowdsecurity/nginx crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules crowdsecurity/appsec-crs
6870
- DISABLE_PARSERS=crowdsecurity/whitelists
6971
networks:
7072
- bw-universe

‎.tests/virustotal.sh

+1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
#!/bin/bash
22

3+
# shellcheck disable=SC1091
34
. .tests/utils.sh
45

56
echo "ℹ️ Starting VirusTotal tests ..."

‎.tests/virustotal/docker-compose.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ version: "3"
22

33
services:
44
bunkerweb:
5-
image: bunkerity/bunkerweb:1.5.7
5+
image: bunkerity/bunkerweb:1.5.8
66
ports:
77
- 80:8080
88
- 443:8443
@@ -28,7 +28,7 @@ services:
2828
- bw-services
2929

3030
bw-scheduler:
31-
image: bunkerity/bunkerweb-scheduler:1.5.7
31+
image: bunkerity/bunkerweb-scheduler:1.5.8
3232
depends_on:
3333
- bunkerweb
3434
- bw-docker

‎README.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,19 @@
33
</p>
44

55
<p align="center">
6-
<img src="https://img.shields.io/badge/bunkerweb-1.5.7-blue" />
6+
<img src="https://img.shields.io/badge/bunkerweb_plugins-1.6-blue" />
77
<img src="https://img.shields.io/github/last-commit/bunkerity/bunkerweb-plugins" />
88
<img src="https://img.shields.io/github/actions/workflow/status/bunkerity/bunkerweb-plugins/tests.yml?branch=dev&label=CI%2FCD%20dev" />
99
<img src="https://img.shields.io/github/actions/workflow/status/bunkerity/bunkerweb-plugins/tests.yml?branch=main&label=CI%2FCD%20main" />
1010
<img src="https://img.shields.io/github/issues/bunkerity/bunkerweb-plugins">
1111
<img src="https://img.shields.io/github/issues-pr/bunkerity/bunkerweb-plugins">
1212
</p>
1313

14-
This repository contains "official" plugins for the [BunkerWeb solution](https://github.com/bunkerity/bunkerweb). If you don't already know BunkerWeb, you should first read the [documentation](https://docs.bunkerweb.io).
14+
This repository contains "official" plugins for the [BunkerWeb solution](https://github.com/bunkerity/bunkerweb). If you don't already know BunkerWeb, you should first read the [documentation](https://docs.bunkerweb.io/?utm_campaign=self&utm_source=github).
1515

1616
# Prerequisites
1717

18-
The installation of external plugins is covered in the [plugins section](https://docs.bunkerweb.io/latest/plugins) of the documentation.
18+
The installation of external plugins is covered in the [plugins section](https://docs.bunkerweb.io/latest/plugins/?utm_campaign=self&utm_source=github) of the documentation.
1919

2020
# Plugins
2121

@@ -46,7 +46,7 @@ Please contact us at contact \[@\] bunkerity.com if you are interested.
4646

4747
To get free community support you can use the following media :
4848

49-
- The #help channel of BunkerWeb in the [Discord server](https://discord.com/invite/fTf46FmtyD)
49+
- The #help channel of BunkerWeb in the [Discord server](https://bunkerity.discord.com/?utm_campaign=self&utm_source=github)
5050
- The help category of [GitHub discussions](https://github.com/bunkerity/bunkerweb-plugins/discussions)
5151
- The [/r/BunkerWeb](https://www.reddit.com/r/BunkerWeb) subreddit
5252
- The [Server Fault](https://serverfault.com/) and [Super User](https://superuser.com/) forums

‎clamav/README.md

+11-11
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<img alt="BunkerWeb ClamAV diagram" src="https://github.com/bunkerity/bunkerweb-plugins/raw/main/clamav/docs/diagram.svg" />
55
</p>
66

7-
This [BunkerWeb](https://www.bunkerweb.io) plugin will automatically check if any uploaded file is detected by the ClamAV antivirus engine and deny the request if that's the case.
7+
This [BunkerWeb](https://www.bunkerweb.io/?utm_campaign=self&utm_source=github) plugin will automatically check if any uploaded file is detected by the ClamAV antivirus engine and deny the request if that's the case.
88

99
# Table of contents
1010

@@ -20,11 +20,11 @@ This [BunkerWeb](https://www.bunkerweb.io) plugin will automatically check if an
2020

2121
# Prerequisites
2222

23-
Please read the [plugins section](https://docs.bunkerweb.io/latest/plugins) of the BunkerWeb documentation first.
23+
Please read the [plugins section](https://docs.bunkerweb.io/latest/plugins/?utm_campaign=self&utm_source=github) of the BunkerWeb documentation first.
2424

2525
# Setup
2626

27-
See the [plugins section](https://docs.bunkerweb.io/latest/plugins) of the BunkerWeb documentation for the installation procedure depending on your integration.
27+
See the [plugins section](https://docs.bunkerweb.io/latest/plugins/?utm_campaign=self&utm_source=github) of the BunkerWeb documentation for the installation procedure depending on your integration.
2828

2929
## Docker
3030

@@ -34,7 +34,7 @@ version: '3'
3434
services:
3535

3636
bunkerweb:
37-
image: bunkerity/bunkerweb:1.5.7
37+
image: bunkerity/bunkerweb:1.5.9
3838
...
3939
environment:
4040
- USE_CLAMAV=yes
@@ -59,7 +59,7 @@ version: '3'
5959
services:
6060

6161
mybunker:
62-
image: bunkerity/bunkerweb:1.5.7
62+
image: bunkerity/bunkerweb:1.5.9
6363
...
6464
environment:
6565
- USE_CLAMAV=yes
@@ -132,12 +132,12 @@ metadata:
132132
133133
# Settings
134134
135-
| Setting |Default | Context |Multiple| Description |
136-
|----------------|--------|---------|--------|-------------------------------------------------------|
137-
|`USE_CLAMAV` |`no` |multisite|no |Activate automatic scan of uploaded files with ClamAV. |
138-
|`CLAMAV_HOST` |`clamav`|global |no |ClamAV hostname or IP address. |
139-
|`CLAMAV_PORT` |`3310` |global |no |ClamAV port. |
140-
|`CLAMAV_TIMEOUT`|`1000` |global |no |Network timeout (in ms) when communicating with ClamAV.|
135+
| Setting | Default | Context | Multiple | Description |
136+
| ---------------- | -------- | --------- | -------- | ------------------------------------------------------- |
137+
| `USE_CLAMAV` | `no` | multisite | no | Activate automatic scan of uploaded files with ClamAV. |
138+
| `CLAMAV_HOST` | `clamav` | global | no | ClamAV hostname or IP address. |
139+
| `CLAMAV_PORT` | `3310` | global | no | ClamAV port. |
140+
| `CLAMAV_TIMEOUT` | `1000` | global | no | Network timeout (in ms) when communicating with ClamAV. |
141141

142142
# TODO
143143

0 commit comments

Comments
 (0)