modsecurity: Including custom rules file throws error about ingress-nginx

[k8s-ci-robot]

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[longwuyuan]

/remove-kind bug
/kind support

• Your issue description is not markdown formatted
• The controller pod's kubectl describe is absent
• Much of the info asked in a new issue template is absent
• You have not specified what document are you following for using custom modsec rules

So fix that issue description and see if you get comments based on useful data (if any)

[konmedia-devops]

@longwuyuan Thank you for your feedback. I updated format and content of the issue description.

[longwuyuan]

The error visible is

must have an ID. File: 0x7f791d3180f0 at line: 1

does your file have ID ?

[konmedia-devops]

@longwuyuan Yes. The error message refers to the rule id, as I understand it. All rules in the file have a rule id, and the same ruleset works, if I put it in the modsecurity-snippet inside the ingress instance. That's why I assume that the file is not readable.

[longwuyuan]

If you follow documentation, I can understand what you are trying and work with you.

for example follow these

• https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#enable-modsecurity
• https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#enable-owasp-modsecurity-crs
  And only then come to this one
• https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#modsecurity-snippet

But this is a absolute requirement

• Show the error of insufficient size

Next show the volume mounted but do not use the custom-rules. I want to see the volumes only

And then I too can debug the actual error of not being able to use the custom-rulesets from a volume

I can join a meet.jit.si session. We can sync on slack

[konmedia-devops]

@longwuyuan Thank you. I will prepare and get back to you.

[longwuyuan]

thank you

[longwuyuan]

/triage needs-information

[konmedia-devops]

@longwuyuan Thanks for your help. I try to answer your questions beforehand:

https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#enable-modsecurity
https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#enable-owasp-modsecurity-crs
And only then come to this one
https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#modsecurity-snippet

I followed the documentation and configured modsecurity like explained in these docs.

But this is a absolute requirement

Show the error of insufficient size

Failed to save resource: admission webhook "validate.nginx.ingress.kubernetes.io" denied the request:
-------------------------------------------------------------------------------
Error: exit status 1
2024/07/16 09:47:21 [emerg] 2357#2357: too long parameter, probably missing terminating "'" character in /tmp/nginx/nginx-cfg939531444:3640
nginx: [emerg] too long parameter, probably missing terminating "'" character in /tmp/nginx/nginx-cfg939531444:3640
nginx: configuration file /tmp/nginx/nginx-cfg939531444 test failed

As described in owasp-modsecurity/ModSecurity-nginx#210, nginx has a line limit of 4096 bytes in the configuration file: https://github.com/nginx/nginx/blob/master/src/core/ngx_conf_file.c
As the modsecurity-snippet is include within single quotes, a long snippet exceeds this line length.

Next show the volume mounted but do not use the custom-rules. I want to see the volumes only

...
    spec:
      volumes:
        - name: webhook-cert
          secret:
            secretName: ingress-nginx-admission
            defaultMode: 420
        - name: modsecurity-config-custom-default-ruleset-volume
          configMap:
            name: ingress-nginx-controller
            defaultMode: 420
        - name: modsecurity-config-custom-extended-ruleset-volume
          configMap:
            name: ingress-nginx-controller
            defaultMode: 420
        - name: modsecurity-config-custom-rule-removals-volume
          configMap:
            name: ingress-nginx-controller
            defaultMode: 420
    containers:
      - volumeMounts:
            - name: webhook-cert
              readOnly: true
              mountPath: /usr/local/certificates/
            - name: modsecurity-config-custom-default-ruleset-volume
              mountPath: /etc/modsecurity-rules/default.conf
              subPath: custom-default-ruleset
            - name: modsecurity-config-custom-extended-ruleset-volume
              mountPath: /etc/modsecurity-rules/extended.conf
              subPath: custom-extended-ruleset
            - name: modsecurity-config-custom-rule-removals-volume
              mountPath: /etc/modsecurity-rules/removals.conf
              subPath: custom-rule-removals
...

And then I too can debug the actual error of not being able to use the custom-rulesets from a volume

I can join a meet.jit.si session. We can sync on slack

Great. How can I reach you?

[longwuyuan]

I am on Kubernetes Slack in the ingress-nginx-users channel

[konmedia-devops]

@longwuyuan

I am on Kubernetes Slack in the ingress-nginx-users channel

I need an invitation, right? Sry, I am not familiar with Slack...

[longwuyuan]

channel ingress-nginx
slack kubernetes.slack.com
registration slack.kubernetes.io

[konmedia-devops]

Problem could be resolved. My rulesets still contained the escaping \ for the quotation marks, that are necessary in the modsecurity-snippet.