Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add waf default core ruleset as configmap #3643

Open
wants to merge 5 commits into
base: master
Choose a base branch
from

Conversation

LorcanMcVeigh
Copy link
Contributor

Description

For PR author

  • Tests for change.
  • If changing pkg/apis/, run make gen-files
  • If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

  • Milestone set according to targeted release.
  • Appropriate labels:
    • kind/bug if this is a bugfix.
    • kind/enhancement if this is a a new feature.
    • enterprise if this PR applies to Calico Enterprise only.

Copy link
Contributor

@gantony gantony left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Beside the comment, need to update tigera.conf too to make this work together:
replace Include @owasp_crs/*.conf with Include /etc/modsecurity-ruleset/coreruleset-default/*.conf.

pkg/render/applicationlayer/applicationlayer.go Outdated Show resolved Hide resolved
Copy link
Member

@electricjesus electricjesus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

overall looks good, just wanted to know about a few things first

pkg/render/applicationlayer/embed/embed.go Show resolved Hide resolved
@@ -48,23 +48,27 @@ func AsMap() (map[string]string, error) {
return err
}

if b, err := fs.ReadFile(FS, path); err != nil {
if d.Name()[0] == '@' {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not sure why this is done? are we skipping any directories prefixed with '@'? I thought rules were in a directory named '@owasp-' something

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes that works by accident, need to make the logic clearer.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"by accident" i think you mean "very skilfully"

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changing this turned out to be easier than anticipated 😄
image

@radTuti radTuti modified the milestones: v1.37.0, v1.38.0 Dec 13, 2024
@gantony
Copy link
Contributor

gantony commented Dec 13, 2024

Replaced by #3649.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants