GUI editor to tame mod_security rules

⌈⌋ ⎇ branch:  modseccfg


Check-in [0e3331e93e]

Many hyperlinks are disabled.
Use anonymous login to enable hyperlinks.

Overview
Comment:Use SPDX id in license:
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA3-256: 0e3331e93e464b182ee5eca565af6f8c145fe6ca69ac2e7db4eb86b61d8a299c
User & Date: mario 2020-11-30 06:37:22
Context
2020-12-01
16:16
Detect libinjection message check-in: e51cb45f39 user: mario tags: trunk
2020-11-30
06:37
Use SPDX id in license: check-in: 0e3331e93e user: mario tags: trunk
06:37
Fix writer.append() parameters in recipe. check-in: 4e836e93aa user: mario tags: trunk
Changes
Hide Diffs Unified Diffs Ignore Whitespace Patch

Changes to modseccfg/__init__.py. 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

# encoding: utf-8
# api: python
# type: init
# title: modseccfg
# description: Editor to tame mod_security rulesets
# version: 0.4.1
# state:   prototype
# support: none
# license: ASL
# depends: python:pysimplegui (>= 3.0), python:pluginconf (>= 0.7.3),
#     python:appdirs (>= 1.3), python (>= 3.6), deb:python3-tk, bin:sshfs
# priority: core
# url: https://fossil.include-once.org/modseccfg/
# faq: https://fossil.include-once.org/modseccfg/doc/trunk/FAQ.md
# category: config
# classifiers: x11, http






|


|








1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

# encoding: utf-8
# api: python
# type: init
# title: modseccfg
# description: Editor to tame mod_security rulesets
# version: 0.4.5
# state:   prototype
# support: none
# license: Apache-2.0
# depends: python:pysimplegui (>= 3.0), python:pluginconf (>= 0.7.3),
#     python:appdirs (>= 1.3), python (>= 3.6), deb:python3-tk, bin:sshfs
# priority: core
# url: https://fossil.include-once.org/modseccfg/
# faq: https://fossil.include-once.org/modseccfg/doc/trunk/FAQ.md
# category: config
# classifiers: x11, http
︙︙

Changes to modseccfg/advise.py. 

1
2
3
4
5
6
7

8
9
10
11
12
13
14

# encoding: utf-8
# api: modseccfg
# version: 0.3
# type: data
# category: log
# title: log advise
# description: Some simple pattern detection for common log entries

#
# Basically just some keyword lookups to explain the logs.
# Now that's fun, because herein we pattern-match the mod_security
# logs for potential problems.
#
# Doesn't really make sense yet. Requires way more advisory links
# like for the PCRE backtracking or other common issues.








>








1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

# encoding: utf-8
# api: modseccfg
# version: 0.3
# type: data
# category: log
# title: log advise
# description: Some simple pattern detection for common log entries
# license: Apache-2.0
#
# Basically just some keyword lookups to explain the logs.
# Now that's fun, because herein we pattern-match the mod_security
# logs for potential problems.
#
# Doesn't really make sense yet. Requires way more advisory links
# like for the PCRE backtracking or other common issues.
︙︙

Changes to modseccfg/crsoptions.py. 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

# api: modseccfg
# encoding: utf-8
# type: function
# category: config
# title: CRS options
# description: config window for CoreRuleSet setvar flags
# version: 0.3
# depends: pluginconf (>= 0.7.3)
# config:
#    { name: crsopt_defaults, type: bool, value: 0, description: "Use defaults in place of existing *.conf options" }
#    { name: crsopt_undefine, type: bool, value: 1, description: "Undefine previous config rules per setvar" }
# license: ASL
# author: OWASP CRS team (options and descriptions)
#
# Basically like SecOptions, but for CRS options (from crs-setup.conf).
# But this module will not replace them, but inject a combined SecAction,
# which overrides all variables in one swoop.
#
# Hence it requires declaring an id. Default is 5999 in the user range.












|








1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

# api: modseccfg
# encoding: utf-8
# type: function
# category: config
# title: CRS options
# description: config window for CoreRuleSet setvar flags
# version: 0.3
# depends: pluginconf (>= 0.7.3)
# config:
#    { name: crsopt_defaults, type: bool, value: 0, description: "Use defaults in place of existing *.conf options" }
#    { name: crsopt_undefine, type: bool, value: 1, description: "Undefine previous config rules per setvar" }
# license: Apache-2.0
# author: OWASP CRS team (options and descriptions)
#
# Basically like SecOptions, but for CRS options (from crs-setup.conf).
# But this module will not replace them, but inject a combined SecAction,
# which overrides all variables in one swoop.
#
# Hence it requires declaring an id. Default is 5999 in the user range.
︙︙

Changes to modseccfg/editor.py. 

1
2
3
4
5
6

7
8
9
10
11
12
13

# api: modseccfg
# type: function
# category: gui
# title: editor
# description: simple text window to edit *.conf file
# version: 0.3

# config:
#    { name: editor, type: str, value: "", description: External editor to use }
#    { name: editor_font, type: list, value: "Mono,12", description: "Font,Size" }
# state: beta
#
# Just a textbox really.








>








1
2
3
4
5
6
7
8
9
10
11
12
13
14

# api: modseccfg
# type: function
# category: gui
# title: editor
# description: simple text window to edit *.conf file
# version: 0.3
# license: Apache-2.0
# config:
#    { name: editor, type: str, value: "", description: External editor to use }
#    { name: editor_font, type: list, value: "Mono,12", description: "Font,Size" }
# state: beta
#
# Just a textbox really.
︙︙

Changes to modseccfg/ruleinfo.py. 

1
2
3
4
5
6
7
8
9

10
11
12
13
14
15
16

# encoding: utf8
# api: modseccfg
# type: function
# category: gui
# title: Rule Info
# description: displays details (params/flags) of mod_security rule
# version: 0.2
# config:
#    { name: info_log_count, type: int, value: 7, description: Number of log entries to show. }

#
# Brings up a text window to visualise SecRule flags and options.
# Highlights some interesting flags, and appends recent log entries
# about the rule when available.
#












>








1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

# encoding: utf8
# api: modseccfg
# type: function
# category: gui
# title: Rule Info
# description: displays details (params/flags) of mod_security rule
# version: 0.2
# config:
#    { name: info_log_count, type: int, value: 7, description: Number of log entries to show. }
# license: Apache-2.0
#
# Brings up a text window to visualise SecRule flags and options.
# Highlights some interesting flags, and appends recent log entries
# about the rule when available.
#
︙︙

Changes to modseccfg/secoptions.py. 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

# api: modseccfg
# encoding: utf-8
# type: function
# category: config
# title: SecOption directives
# description: config window for core mod_security directives
# version: 0.2
# config: -
# license: ASL
# author: Mod_Sec team (options and their documentation)
#
# Autogenerated list of mod_security directives and flags.
# Binds it to pluginconf.gui and writer.update
#
## WARNING: NEEDS PATCHED PLUGINCONF.GUI (plugins= param)










|








1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

# api: modseccfg
# encoding: utf-8
# type: function
# category: config
# title: SecOption directives
# description: config window for core mod_security directives
# version: 0.2
# config: -
# license: Apache-2.0
# author: Mod_Sec team (options and their documentation)
#
# Autogenerated list of mod_security directives and flags.
# Binds it to pluginconf.gui and writer.update
#
## WARNING: NEEDS PATCHED PLUGINCONF.GUI (plugins= param)
︙︙

Changes to modseccfg/vhosts.py. 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

# api: modseccfg
# encoding: utf-8
# title: *.conf scanner
# description: Compiles a list of relevant apache/vhost files and Sec* settings
# type: tokenizer
# category: apache
# version: 0.6
# config:
#    { name: envvars, value: "/etc/default/apache2", type: str, description: "Look up APACHE_ENV vars from shell script", help: "Mostly applies to Debian derivates. Other distros usually embed SetEnv directives for log paths." }
# license: ASL
#
# Runs once to scan for an vhost* and mod_security config files.
# Uses `apache2ctl -t -D DUMP_INCLUDES` to find all includes,
# and regexes for Sec*Rules or *Log locations and ServerNames.
#
# This should yield any mod_security and vhost-relevant sections.
# The list is kept in `vhosts`. And secrule declarations+options










|








1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

# api: modseccfg
# encoding: utf-8
# title: *.conf scanner
# description: Compiles a list of relevant apache/vhost files and Sec* settings
# type: tokenizer
# category: apache
# version: 0.6
# config:
#    { name: envvars, value: "/etc/default/apache2", type: str, description: "Look up APACHE_ENV vars from shell script", help: "Mostly applies to Debian derivates. Other distros usually embed SetEnv directives for log paths." }
# license: Apache-2.0
#
# Runs once to scan for an vhost* and mod_security config files.
# Uses `apache2ctl -t -D DUMP_INCLUDES` to find all includes,
# and regexes for Sec*Rules or *Log locations and ServerNames.
#
# This should yield any mod_security and vhost-relevant sections.
# The list is kept in `vhosts`. And secrule declarations+options
︙︙