|
Packit Service |
384592 |
### SecAudit* directive tests
|
|
Packit Service |
384592 |
|
|
Packit Service |
384592 |
# SecAuditEngine
|
|
Packit Service |
384592 |
{
|
|
Packit Service |
384592 |
type => "config",
|
|
Packit Service |
384592 |
comment => "SecAuditEngine On",
|
|
Packit Service |
384592 |
conf => qq(
|
|
Packit Service |
384592 |
SecAuditEngine On
|
|
Packit Service |
384592 |
SecAuditLog $ENV{AUDIT_LOG}
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
match_log => {
|
|
Packit Service |
384592 |
audit => [ qr/./, 1 ],
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
match_response => {
|
|
Packit Service |
384592 |
status => qr/^200$/,
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
request => new HTTP::Request(
|
|
Packit Service |
384592 |
GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
{
|
|
Packit Service |
384592 |
type => "config",
|
|
Packit Service |
384592 |
comment => "SecAuditEngine Off",
|
|
Packit Service |
384592 |
conf => qq(
|
|
Packit Service |
384592 |
SecAuditEngine Off
|
|
Packit Service |
384592 |
SecAuditLog $ENV{AUDIT_LOG}
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
match_log => {
|
|
Packit Service |
384592 |
-audit => [ qr/./, 1 ],
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
match_response => {
|
|
Packit Service |
384592 |
status => qr/^200$/,
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
request => new HTTP::Request(
|
|
Packit Service |
384592 |
GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
{
|
|
Packit Service |
384592 |
type => "config",
|
|
Packit Service |
384592 |
comment => "SecAuditEngine RelevantOnly (pos)",
|
|
Packit Service |
384592 |
conf => qq(
|
|
Packit Service |
384592 |
SecRuleEngine On
|
|
Packit Service |
384592 |
SecAuditEngine RelevantOnly
|
|
Packit Service |
384592 |
SecAuditLog $ENV{AUDIT_LOG}
|
|
Packit Service |
384592 |
SecDebugLog $ENV{DEBUG_LOG}
|
|
Packit Service |
384592 |
SecDebugLogLevel 9
|
|
Packit Service |
384592 |
SecResponseBodyAccess On
|
|
Packit Service |
384592 |
SecDefaultAction "phase:2,log,auditlog,pass"
|
|
Packit Service |
384592 |
SecRule REQUEST_URI "." "phase:4,deny,id:500251"
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
match_log => {
|
|
Packit Service |
384592 |
audit => [ qr/./, 1 ],
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
match_response => {
|
|
Packit Service |
384592 |
status => qr/^403$/,
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
request => new HTTP::Request(
|
|
Packit Service |
384592 |
GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
{
|
|
Packit Service |
384592 |
type => "config",
|
|
Packit Service |
384592 |
comment => "SecAuditEngine RelevantOnly (neg)",
|
|
Packit Service |
384592 |
conf => qq(
|
|
Packit Service |
384592 |
SecAuditEngine RelevantOnly
|
|
Packit Service |
384592 |
SecAuditLog $ENV{AUDIT_LOG}
|
|
Packit Service |
384592 |
SecResponseBodyAccess On
|
|
Packit Service |
384592 |
SecDefaultAction "phase:2,log,auditlog,pass"
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
match_log => {
|
|
Packit Service |
384592 |
-audit => [ qr/./, 1 ],
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
match_response => {
|
|
Packit Service |
384592 |
status => qr/^200$/,
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
request => new HTTP::Request(
|
|
Packit Service |
384592 |
GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
|
|
Packit Service |
384592 |
# SecAuditLogType & SecAuditLogStorageDir
|
|
Packit Service |
384592 |
{
|
|
Packit Service |
384592 |
type => "config",
|
|
Packit Service |
384592 |
comment => "SecAuditLogType Serial",
|
|
Packit Service |
384592 |
conf => qq(
|
|
Packit Service |
384592 |
SecAuditEngine On
|
|
Packit Service |
384592 |
SecAuditLog $ENV{AUDIT_LOG}
|
|
Packit Service |
384592 |
SecAuditLogType Serial
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
match_log => {
|
|
Packit Service |
384592 |
audit => [ qr/./, 1 ],
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
match_response => {
|
|
Packit Service |
384592 |
status => qr/^404$/,
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
request => new HTTP::Request(
|
|
Packit Service |
384592 |
GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/bogus",
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
{
|
|
Packit Service |
384592 |
type => "config",
|
|
Packit Service |
384592 |
comment => "SecAuditLogType Concurrent",
|
|
Packit Service |
384592 |
conf => qq(
|
|
Packit Service |
384592 |
SecAuditEngine On
|
|
Packit Service |
384592 |
SecAuditLog $ENV{AUDIT_LOG}
|
|
Packit Service |
384592 |
SecAuditLogType Concurrent
|
|
Packit Service |
384592 |
SecAuditLogStorageDir "$ENV{LOGS_DIR}/audit"
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
test => sub {
|
|
Packit Service |
384592 |
### Perl code to parse the audit log entry and verify
|
|
Packit Service |
384592 |
### that the concurrent audit log exists and contains
|
|
Packit Service |
384592 |
### the correct data.
|
|
Packit Service |
384592 |
###
|
|
Packit Service |
384592 |
### TODO: Need some API for this :)
|
|
Packit Service |
384592 |
###
|
|
Packit Service |
384592 |
### FIXME: Just workable with apache, the timing to load auditlog from nginx
|
|
Packit Service |
384592 |
### is not correct, so the test is failing even when it should pass.
|
|
Packit Service |
384592 |
### Disabling it for now until we figure out a way to handle that.
|
|
Packit Service |
384592 |
|
|
Packit Service |
384592 |
# Parse log
|
|
Packit Service |
384592 |
#my $alogre = qr/^(?:\S+)\ (?:\S+)\ (?:\S+)\ (?:\S+)\ \[(?:[^:]+):(?:\d+:\d+:\d+)\ (?:[^\]]+)\]\ \"(?:.*)\"\ (?:\d+)\ (?:\S+)\ \"(?:.*)\"\ \"(?:.*)\"\ (\S+)\ \"(?:.*)\"\ (\S+)\ (?:\d+)\ (?:\d+)\ (?:\S+)(?:.*)$/m;
|
|
Packit Service |
384592 |
#my $alog = match_log("audit", $alogre, 1);
|
|
Packit Service |
384592 |
#chomp $alog;
|
|
Packit Service |
384592 |
#dbg("Alog: $alog\n");
|
|
Packit Service |
384592 |
#my @log = ($alog =~ m/$alogre/);
|
|
Packit Service |
384592 |
#my($id, $fn) = ($log[0], $log[1]);
|
|
Packit Service |
384592 |
#if (!$id or !$fn) {
|
|
Packit Service |
384592 |
#dbg("LOG ENTRY: $alog");
|
|
Packit Service |
384592 |
#die "Failed to parse audit log: $ENV{AUDIT_LOG}\n";
|
|
Packit Service |
384592 |
#}
|
|
Packit Service |
384592 |
|
|
Packit Service |
384592 |
# Verify concurrent log exists
|
|
Packit Service |
384592 |
#my $alogdatafn = "$ENV{LOGS_DIR}/audit$fn";
|
|
Packit Service |
384592 |
#if (! -e "$alogdatafn") {
|
|
Packit Service |
384592 |
#die "Audit log does not exist: $alogdatafn\n";
|
|
Packit Service |
384592 |
#}
|
|
Packit Service |
384592 |
|
|
Packit Service |
384592 |
# Verify concurrent log contents
|
|
Packit Service |
384592 |
#if (defined match_file($alogdatafn, qr/^--[^-]+-A--.*$id.*-Z--$/s)) {
|
|
Packit Service |
384592 |
#return 0;
|
|
Packit Service |
384592 |
#}
|
|
Packit Service |
384592 |
|
|
Packit Service |
384592 |
# Error
|
|
Packit Service |
384592 |
#dbg("LOGDATA: \"$FILE{$alogdatafn}{buf}\"");
|
|
Packit Service |
384592 |
#die "Audit log data did not match.\n";
|
|
Packit Service |
384592 |
return 0;
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
match_response => {
|
|
Packit Service |
384592 |
status => qr/^200$/,
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
request => new HTTP::Request(
|
|
Packit Service |
384592 |
GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
|
|
Packit Service |
384592 |
# SecAuditLogRelevantStatus
|
|
Packit Service |
384592 |
{
|
|
Packit Service |
384592 |
type => "config",
|
|
Packit Service |
384592 |
comment => "SecAuditLogRelevantStatus (pos)",
|
|
Packit Service |
384592 |
conf => qq(
|
|
Packit Service |
384592 |
SecAuditEngine RelevantOnly
|
|
Packit Service |
384592 |
SecAuditLog $ENV{AUDIT_LOG}
|
|
Packit Service |
384592 |
SecAuditLogRelevantStatus "^4"
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
match_log => {
|
|
Packit Service |
384592 |
audit => [ qr/./, 1 ],
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
match_response => {
|
|
Packit Service |
384592 |
status => qr/^404$/,
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
request => new HTTP::Request(
|
|
Packit Service |
384592 |
GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/bogus",
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
{
|
|
Packit Service |
384592 |
type => "config",
|
|
Packit Service |
384592 |
comment => "SecAuditLogRelevantStatus (neg)",
|
|
Packit Service |
384592 |
conf => qq(
|
|
Packit Service |
384592 |
SecAuditEngine RelevantOnly
|
|
Packit Service |
384592 |
SecAuditLog $ENV{AUDIT_LOG}
|
|
Packit Service |
384592 |
SecAuditLogRelevantStatus "^4"
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
match_log => {
|
|
Packit Service |
384592 |
-audit => [ qr/./, 1 ],
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
match_response => {
|
|
Packit Service |
384592 |
status => qr/^200$/,
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
request => new HTTP::Request(
|
|
Packit Service |
384592 |
GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
|
|
Packit Service |
384592 |
# SecAuditLogParts
|
|
Packit Service |
384592 |
{
|
|
Packit Service |
384592 |
type => "config",
|
|
Packit Service |
384592 |
comment => "SecAuditLogParts (minimal)",
|
|
Packit Service |
384592 |
conf => qq(
|
|
Packit Service |
384592 |
SecAuditEngine On
|
|
Packit Service |
384592 |
SecAuditLog $ENV{AUDIT_LOG}
|
|
Packit Service |
384592 |
SecRequestBodyAccess On
|
|
Packit Service |
384592 |
SecResponseBodyAccess On
|
|
Packit Service |
384592 |
SecAuditLogParts "AZ"
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
match_log => {
|
|
Packit Service |
384592 |
audit => [ qr/-A--.*-Z--/s, 1 ],
|
|
Packit Service |
384592 |
-audit => [ qr/-[B-Y]--/, 1 ],
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
match_response => {
|
|
Packit Service |
384592 |
status => qr/^200$/,
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
request => new HTTP::Request(
|
|
Packit Service |
384592 |
POST => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
|
|
Packit Service |
384592 |
[
|
|
Packit Service |
384592 |
"Content-Type" => "application/x-www-form-urlencoded",
|
|
Packit Service |
384592 |
],
|
|
Packit Service |
384592 |
"a=1r&=2",
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
{
|
|
Packit Service |
384592 |
type => "config",
|
|
Packit Service |
384592 |
comment => "SecAuditLogParts (default)",
|
|
Packit Service |
384592 |
conf => qq(
|
|
Packit Service |
384592 |
SecAuditEngine On
|
|
Packit Service |
384592 |
SecAuditLog $ENV{AUDIT_LOG}
|
|
Packit Service |
384592 |
SecRequestBodyAccess On
|
|
Packit Service |
384592 |
SecResponseBodyAccess On
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
match_log => {
|
|
Packit Service |
384592 |
audit => [ qr/-A--.*-B--.*-F--.*-H--.*-Z--/s, 1 ],
|
|
Packit Service |
384592 |
-audit => [ qr/-[DEGIJK]--/, 1 ],
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
match_response => {
|
|
Packit Service |
384592 |
status => qr/^200$/,
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
request => new HTTP::Request(
|
|
Packit Service |
384592 |
POST => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
|
|
Packit Service |
384592 |
[
|
|
Packit Service |
384592 |
"Content-Type" => "application/x-www-form-urlencoded",
|
|
Packit Service |
384592 |
],
|
|
Packit Service |
384592 |
"a=1r&=2",
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
{
|
|
Packit Service |
384592 |
type => "config",
|
|
Packit Service |
384592 |
comment => "SecAuditLogParts (all)",
|
|
Packit Service |
384592 |
conf => qq(
|
|
Packit Service |
384592 |
SecRuleEngine On
|
|
Packit Service |
384592 |
SecAuditEngine On
|
|
Packit Service |
384592 |
SecAuditLog $ENV{AUDIT_LOG}
|
|
Packit Service |
384592 |
SecRequestBodyAccess On
|
|
Packit Service |
384592 |
SecResponseBodyAccess On
|
|
Packit Service |
384592 |
SecAuditLogParts "ABCDEFGHIJKZ"
|
|
Packit Service |
384592 |
SecAction "phase:4,log,auditlog,allow,id:500086"
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
match_log => {
|
|
Packit Service |
384592 |
audit => [ qr/-A--.*-B--.*-C--.*-F--.*-E--.*-H--.*-K--.*-Z--/s, 1 ],
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
match_response => {
|
|
Packit Service |
384592 |
status => qr/^200$/,
|
|
Packit Service |
384592 |
},
|
|
Packit Service |
384592 |
request => new HTTP::Request(
|
|
Packit Service |
384592 |
POST => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
|
|
Packit Service |
384592 |
[
|
|
Packit Service |
384592 |
"Content-Type" => "application/x-www-form-urlencoded",
|
|
Packit Service |
384592 |
],
|
|
Packit Service |
384592 |
"a=1r&=2",
|
|
Packit Service |
384592 |
),
|
|
Packit Service |
384592 |
},
|