Description
Describe the bug
v3 of ModSecurity - pulling from master branch.
Running mod security on Nginx inside docker container using ModSecurity nginx connector and getting the following error when the container starts up:
"modsecurity_rules_file" directive Rules error. File: /etc/nginx/modsec/modsecurity.conf. Line: 192. Column: 17. Failed to load locate the unicode map file from: unicode.mapping 20127 Looking at: 'unicode.mapping 20127', 'unicode.mapping 20127', '/etc/nginx/modsec/unicode.mapping 20127', '/etc/nginx/modsec/unicode.mapping 20127'. in /etc/nginx/nginx.conf:17
nginx.conf (/etc/nginx/nginx.conf)
load_module modules/ngx_http_modsecurity_module.so;
error_log /dev/stdout ${LOG_LEVEL};
events {
worker_connections 1024;
}
http {
access_log /dev/stdout;
server_tokens off;
server {
listen 443 ssl;
server_name waf;
ssl_certificate certs/cert.pem;
ssl_certificate_key certs/key.pem;
modsecurity on;
modsecurity_rules_file /etc/nginx/modsec/main.conf;
location / {
proxy_pass https://${LOCATION_ADDRESS};
modsecurity on;
}
error_page 403 404 405 500 501 502 503 504 /error/error.html;
location ^~ /error/ {
internal;
root /usr/share/nginx;
modsecurity off;
}
location = /amihealthy {
return 200;
}
}
}
Dockerfile
FROM nginx:1.15.3-alpine
RUN set -xe && \
apk --no-cache update && \
apk add --no-cache --virtual .build-deps \
gcc \
libc-dev \
make \
openssl-dev \
pcre-dev \
zlib-dev \
linux-headers \
curl \
gnupg \
libxslt-dev \
gd-dev \
perl-dev \
py-pip \
py-setuptools \
&& apk add --no-cache --virtual .libmodsecurity-deps \
pcre-dev \
libxml2-dev \
automake \
autoconf \
g++ \
flex \
bison \
yajl-dev \
# dependencies that should not be removed
&& apk add --no-cache \
libtool \
doxygen \
geoip \
geoip-dev \
yajl \
libstdc++ \
git \
sed \
python
# install aws cli
RUN set -xe && \
pip --no-cache-dir install --upgrade pip && \
pip --no-cache-dir install awscli
# install modsecurity
WORKDIR /opt/ModSecurity
RUN set -xe && \
git clone -b v3/master --single-branch https://github.com/SpiderLabs/ModSecurity . && \
git submodule init && \
git submodule update && \
./build.sh && \
./configure && make && make install
# install nginx connector
WORKDIR /opt
RUN git clone --depth 1 https://github.com/SpiderLabs/ModSecurity-nginx.git && \
wget http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz && \
tar zxvf nginx-$NGINX_VERSION.tar.gz
WORKDIR /opt/nginx-$NGINX_VERSION
RUN set -xe && \
./configure --with-compat --add-dynamic-module=../ModSecurity-nginx && \
make modules && \
cp objs/ngx_http_modsecurity_module.so /etc/nginx/modules
# install owasp ruleset
WORKDIR /opt
RUN set -xe && \
git clone -b v3.0/master https://github.com/SpiderLabs/owasp-modsecurity-crs && \
mv owasp-modsecurity-crs/ /usr/local/
RUN set -xe && \
mkdir /etc/nginx/modsec && \
rm -fr /etc/nginx/nginx.conf
COPY conf/nginx/nginx.conf /etc/nginx/nginx.conf.template
COPY conf/modsec/ /etc/nginx/modsec/
COPY conf/owasp/ /usr/local/owasp-modsecurity-crs/
COPY error/ /usr/share/nginx/error/
COPY certs/ /etc/nginx/certs/
# remove unnecessary stuff
RUN set -xe && \
apk del .build-deps && \
apk del .libmodsecurity-deps && \
rm -fr ModSecurity && \
rm -fr ModSecurity-nginx && \
rm -fr nginx-$NGINX_VERSION.tar.gz && \
rm -fr nginx-$NGINX_VERSION && \
rm -fr /etc/nginx/conf.d
# execute stuff
COPY ./setupEnvAndStart.sh /etc/nginx/
RUN chmod +x /etc/nginx/setupEnvAndStart.sh
CMD ["sh", "-c", ". /etc/nginx/setupEnvAndStart.sh"]
setupEnvAndStart.sh
#! /bin/bash
config=<config>
for i in $(echo $config | sed "s/,/ /g")
do
export $i
done
envsubst < /etc/nginx/nginx.conf.template > /etc/nginx/nginx.conf
exec nginx -g 'daemon off;'
modsecurity.conf
Used the modsecurity.conf-recommended
Logs and dumps
[emerg] 1#1: "modsecurity_rules_file" directive Rules error. File: /etc/nginx/modsec/modsecurity.conf. Line: 192. Column: 17. Failed to load locate the unicode map file from: unicode.mapping 20127 Looking at: 'unicode.mapping 20127', 'unicode.mapping 20127', '/etc/nginx/modsec/unicode.mapping 20127', '/etc/nginx/modsec/unicode.mapping 20127'. in /etc/nginx/nginx.conf:17
nginx: [emerg] "modsecurity_rules_file" directive Rules error. File: /etc/nginx/modsec/modsecurity.conf. Line: 192. Column: 17. Failed to load locate the unicode map file from: unicode.mapping 20127 Looking at: 'unicode.mapping 20127', 'unicode.mapping 20127', '/etc/nginx/modsec/unicode.mapping 20127', '/etc/nginx/modsec/unicode.mapping 20127'. in /etc/nginx/nginx.conf:17
To Reproduce
Steps to reproduce the behavior:
docker build on the Dockerfile.
Add config values in setupEnvAndStart.sh for variables listed in the nginx.conf above
docker run on resulting image (exposing port 443)
Expected behavior
Nginx should start up without errors, instead it errors as above
Server (please complete the following information):
- ModSecurity version (and connector): ModSecurity v3.0.2 (but pulled from v3/master at build time) with nginx-connector v1.0.0
- WebServer: nginx-1.15.3
- OS (and distro): RHEL 7.5
Rule Set (please complete the following information):
v3.0/master https://github.com/SpiderLabs/owasp-modsecurity-crs
Additional context
This has previously worked - on 23/10/18 this was built with image size of 451.11 MB...today's (25/10/18) build is 462.04 MB - no additional config was included from our end.