From 83663ee63df3226e9e037bb97e9c18e247d65c92 Mon Sep 17 00:00:00 2001 From: Felipe Zipitria Date: Sat, 30 Jan 2021 22:23:00 -0300 Subject: [PATCH] feat(build): add multi image build Signed-off-by: Felipe Zipitria --- .github/workflows/buildimage.yml | 25 +++++------ .github/workflows/verifyimage.yml | 18 ++++---- .gitignore | 1 + Makefile | 19 +++++++++ README.md | 42 ++++++++++++++++--- {3.3-apache => apache}/Dockerfile | 28 ++++++------- .../extra/httpd-logging-after-modsec.conf | 0 .../extra/httpd-logging-before-modsec.conf | 0 .../conf/extra/httpd-modsecurity.conf | 0 {3.3-apache => apache}/docker-entrypoint.sh | 0 {3.3-nginx => nginx}/Dockerfile | 29 +++++++------ {3.3-nginx => nginx}/docker-entrypoint.sh | 0 {3.3-nginx => nginx}/nginx.conf | 0 src/release.sh | 25 +++++++++++ 14 files changed, 132 insertions(+), 55 deletions(-) create mode 100644 .gitignore create mode 100644 Makefile rename {3.3-apache => apache}/Dockerfile (64%) rename {3.3-apache => apache}/conf/extra/httpd-logging-after-modsec.conf (100%) rename {3.3-apache => apache}/conf/extra/httpd-logging-before-modsec.conf (100%) rename {3.3-apache => apache}/conf/extra/httpd-modsecurity.conf (100%) rename {3.3-apache => apache}/docker-entrypoint.sh (100%) rename {3.3-nginx => nginx}/Dockerfile (61%) rename {3.3-nginx => nginx}/docker-entrypoint.sh (100%) rename {3.3-nginx => nginx}/nginx.conf (100%) create mode 100755 src/release.sh diff --git a/.github/workflows/buildimage.yml b/.github/workflows/buildimage.yml index 23fe49ac..d923539e 100644 --- a/.github/workflows/buildimage.yml +++ b/.github/workflows/buildimage.yml @@ -3,14 +3,16 @@ on: push: branches: - master +env: + DEFAULT_VERSION: 'v3.3.0' + DEFAULT_SERVER: 'apache' jobs: build: runs-on: ubuntu-latest strategy: matrix: - image: - - 3.3-apache - - 3.3-nginx + version: ['v3.3.0'] + server: ['apache', 'nginx'] steps: - uses: actions/checkout@v1 with: @@ -21,15 +23,14 @@ jobs: -u "${{ secrets.dockerhub_user }}" -p "${{ secrets.dockerhub_token }}" - - name: Build ${{ matrix.image }} - run: docker build . -f ${{ matrix.image }}/Dockerfile - --tag owasp/modsecurity-crs:${{ matrix.image }} - --tag owasp/modsecurity-crs:$(echo ${{ matrix.image }} | sed 's/.*-//') + - name: Build ${{ matrix.version }}-${{ matrix.server }} + run: make VERSIONS=${{ matrix.version }} SERVERS=${{ matrix.server }} - - name: Set default tag for ${{ matrix.image }} - if: endsWith(matrix.image, '-apache') - run: docker tag owasp/modsecurity-crs:${{ matrix.image }} - owasp/modsecurity-crs:$(echo ${{ matrix.image }} | sed 's/-.*//') + # As we build multiple versions now, we need one to be the default + - name: Set default tag for ${{ matrix.version }}-${{ matrix.server }} + if: matrix.server == env.DEFAULT_SERVER && matrix.version == env.DEFAULT_VERSION + run: docker tag owasp/modsecurity-crs:${{ matrix.version }}-${{ matrix.server }} + owasp/modsecurity-crs:${{ matrix.server }} - - name: Push ${{ matrix.image }} + - name: Push ${{ matrix.version }}-${{ matrix.server }} run: docker push owasp/modsecurity-crs diff --git a/.github/workflows/verifyimage.yml b/.github/workflows/verifyimage.yml index 6c20f727..c0a5df1d 100644 --- a/.github/workflows/verifyimage.yml +++ b/.github/workflows/verifyimage.yml @@ -7,21 +7,21 @@ jobs: build: runs-on: ubuntu-latest strategy: + # Remember to match these with the buildimage.yml action matrix: - image: - - 3.3-apache - - 3.3-nginx + version: ['v3.3.0'] + server: ['apache', 'nginx'] steps: - uses: actions/checkout@v1 with: fetch-depth: 1 - - name: Build ${{ matrix.image }} - run: docker build . -f ${{ matrix.image }}/Dockerfile --tag test + - name: Build ${{ matrix.version }}-${{ matrix.server }} + run: make VERSIONS=${{ matrix.version }} SERVERS=${{ matrix.server }} TAG=test - - name: Run ${{ matrix.image }} - run: docker run -d --name ${{ matrix.image }} test + - name: Run ${{ matrix.version }}-${{ matrix.server }} + run: docker run -d --name ${{ matrix.version }}-${{ matrix.server }} test:${{ matrix.version }}-${{ matrix.server }} - - name: Verify ${{ matrix.image }} + - name: Verify ${{ matrix.version }}-${{ matrix.server }} run: | - [ $(docker inspect ${{ matrix.image }} --format='{{.State.Running}}') = 'true' ] + [ $(docker inspect ${{ matrix.version }}-${{ matrix.server }} --format='{{.State.Running}}') = 'true' ] diff --git a/.gitignore b/.gitignore new file mode 100644 index 00000000..501a8be8 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +v*-{apache,nginx}/ diff --git a/Makefile b/Makefile new file mode 100644 index 00000000..753c29e9 --- /dev/null +++ b/Makefile @@ -0,0 +1,19 @@ +VERSIONS = v3.3.0 +SERVERS = apache nginx +TAG = owasp/modsecurity-crs + +TARGETS = $(foreach server,$(SERVERS),$(foreach version,$(VERSIONS),$(addsuffix -$(server),$(version)))) +IMAGES = $(addprefix image/, $(TARGETS)) + +.PHONY: clean + +all: $(TARGETS) $(IMAGES) + +v%: $(addsufix /Dockerfile, $(SERVERS)) + ./src/release.sh "v$*" + +image/%: $(TARGETS) + docker build --tag $(TAG):$* -f $*/Dockerfile . + +clean: + rm -rfv v* diff --git a/README.md b/README.md index d304e73f..b35ea1ba 100644 --- a/README.md +++ b/README.md @@ -2,17 +2,17 @@ [![dockeri.co](http://dockeri.co/image/owasp/modsecurity-crs)](https://hub.docker.com/r/owasp/modsecurity-crs/) -[![Build Status](https://img.shields.io/endpoint.svg?url=https%3A%2F%2Factions-badge.atrox.dev%2FCRS-support%2Fmodsecurity-crs-docker%2Fbadge%3Fref%3Dmaster&style=flat)](https://actions-badge.atrox.dev/CRS-support/modsecurity-crs-docker/goto?ref=master -) [![GitHub issues](https://img.shields.io/github/issues-raw/CRS-support/modsecurity-crs-docker.svg)](https://github.com/CRS-support/modsecurity-crs-docker/issues -) [![GitHub PRs](https://img.shields.io/github/issues-pr-raw/CRS-support/modsecurity-crs-docker.svg)](https://github.com/CRS-support/modsecurity-crs-docker/pulls -) [![License](https://img.shields.io/github/license/CRS-support/modsecurity-crs-docker.svg)](https://github.com/CRS-support/modsecurity-crs-docker/blob/master/LICENSE) +[![Build Status](https://img.shields.io/endpoint.svg?url=https%3A%2F%2Factions-badge.atrox.dev%2Fcoreruleset%2Fmodsecurity-crs-docker%2Fbadge%3Fref%3Dmaster&style=flat)](https://actions-badge.atrox.dev/coreruleset/modsecurity-crs-docker/goto?ref=master +) [![GitHub issues](https://img.shields.io/github/issues-raw/coreruleset/modsecurity-crs-docker.svg)](https://github.com/coreruleset/modsecurity-crs-docker/issues +) [![GitHub PRs](https://img.shields.io/github/issues-pr-raw/coreruleset/modsecurity-crs-docker.svg)](https://github.com/coreruleset/modsecurity-crs-docker/pulls +) [![License](https://img.shields.io/github/license/coreruleset/modsecurity-crs-docker.svg)](https://github.com/coreruleset/modsecurity-crs-docker/blob/master/LICENSE) ## What is the Core Rule Set The Core Rule Set (CRS) is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. -## Example +## Examples ``` docker build -t owasp/modsecurity-crs . @@ -26,6 +26,38 @@ docker build -t owasp/modsecurity-crs . docker run -p 80:80 -ti -e PARANOIA=4 -e PROXY=1 --rm owasp/modsecurity-crs ``` +## Building + +Image building requires `make`, or you can do the same by calling the `src/release.sh` helper with the version release you want and the web server, e.g: + +```bash +$ ./src/release.sh "v3.3.0-apache" +$ docker build --tag owasp/modsecurity-crs:v3.3.0-apache -f v3.3.0-apache/Dockerfile . +``` + +If you call `make` without arguments, will build all releases and web server combinations. + +Or use `make VERSIONS=v3.3.0-rc1` and it will get the proper release and build the container. + +You can also add your local tag, or override the build: + +```bash +make VERSIONS=v3.3.0 SERVERS=nginx TAG=mytag +``` + +## CRS Versions + +> Hey, I used some specific git version with the containers? What happened? + +You can achieve the same results just by getting any version you want, and using docker volumes. See this example: + +```bash +$ git clone https://github.com/coreruleset/coreruleset.git myrules +$ cd myrules +$ git checkout ac2a0d1 +$ docker run -p 80:80 -ti -e PARANOIA=4 -v ./rules:/opt/owasp-crs/rules:ro --rm owasp/modsecurity-crs +``` + ## Apache The Apache webserver is configured via the `httpd-modsecurity.conf` file overriding directives from the base file. diff --git a/3.3-apache/Dockerfile b/apache/Dockerfile similarity index 64% rename from 3.3-apache/Dockerfile rename to apache/Dockerfile index ebe8e3f3..a3c09216 100644 --- a/3.3-apache/Dockerfile +++ b/apache/Dockerfile @@ -2,9 +2,7 @@ FROM owasp/modsecurity:2 LABEL maintainer="Chaim Sanders " -ARG COMMIT=v3.3/dev -ARG BRANCH=v3.3/dev -ARG REPO=coreruleset/coreruleset +ARG RELEASE=%%RELEASE%% ENV PARANOIA=1 \ ANOMALY_INBOUND=5 \ @@ -28,23 +26,25 @@ ENV PARANOIA=1 \ COPY src/etc/modsecurity.d/*.conf /etc/modsecurity.d/ COPY src/opt/modsecurity/activate-rules.sh /opt/modsecurity/ -COPY 3.3-apache/conf/extra/*.conf /usr/local/apache2/conf/extra/ -COPY 3.3-apache/docker-entrypoint.sh / +COPY apache/conf/extra/*.conf /usr/local/apache2/conf/extra/ +COPY apache/docker-entrypoint.sh / +# Change default shell to bash +SHELL ["/bin/bash", "-o", "pipefail", "-c"] + +# hadolint ignore=DL3008,SC2016 RUN apt-get update \ - && apt-get -y install \ + && apt-get -y install --no-install-recommends \ ca-certificates \ - git \ + curl \ iproute2 \ && mkdir /opt/owasp-crs \ - && cd /opt/owasp-crs \ - && git init \ - && git remote add origin https://github.com/${REPO} \ - && git fetch --depth 1 origin ${BRANCH} \ - && git checkout ${COMMIT} \ - && mv -v crs-setup.conf.example crs-setup.conf \ + && curl -SL https://github.com/coreruleset/coreruleset/archive/${RELEASE}.tar.gz \ + | tar -zxf - --strip-components=1 -C /opt/owasp-crs \ + && mv -v /opt/owasp-crs/crs-setup.conf.example /opt/owasp-crs/crs-setup.conf \ && ln -sv /opt/owasp-crs /etc/modsecurity.d/ \ - && sed -i -E 's/(Listen) [0-9]+/\1 ${PORT}/g' /usr/local/apache2/conf/httpd.conf + && sed -i -E 's/(Listen) [0-9]+/\1 ${PORT}/g' /usr/local/apache2/conf/httpd.conf \ + && rm -rf /var/lib/apt/lists/* ENTRYPOINT ["/docker-entrypoint.sh"] CMD ["apachectl", "-D", "FOREGROUND"] diff --git a/3.3-apache/conf/extra/httpd-logging-after-modsec.conf b/apache/conf/extra/httpd-logging-after-modsec.conf similarity index 100% rename from 3.3-apache/conf/extra/httpd-logging-after-modsec.conf rename to apache/conf/extra/httpd-logging-after-modsec.conf diff --git a/3.3-apache/conf/extra/httpd-logging-before-modsec.conf b/apache/conf/extra/httpd-logging-before-modsec.conf similarity index 100% rename from 3.3-apache/conf/extra/httpd-logging-before-modsec.conf rename to apache/conf/extra/httpd-logging-before-modsec.conf diff --git a/3.3-apache/conf/extra/httpd-modsecurity.conf b/apache/conf/extra/httpd-modsecurity.conf similarity index 100% rename from 3.3-apache/conf/extra/httpd-modsecurity.conf rename to apache/conf/extra/httpd-modsecurity.conf diff --git a/3.3-apache/docker-entrypoint.sh b/apache/docker-entrypoint.sh similarity index 100% rename from 3.3-apache/docker-entrypoint.sh rename to apache/docker-entrypoint.sh diff --git a/3.3-nginx/Dockerfile b/nginx/Dockerfile similarity index 61% rename from 3.3-nginx/Dockerfile rename to nginx/Dockerfile index 4aefe9ae..35417999 100644 --- a/3.3-nginx/Dockerfile +++ b/nginx/Dockerfile @@ -2,9 +2,7 @@ FROM owasp/modsecurity:3 LABEL maintainer="Chaim Sanders " -ARG COMMIT=v3.3/dev -ARG BRANCH=v3.3/dev -ARG REPO=coreruleset/coreruleset +ARG RELEASE=%%RELEASE%% ENV PARANOIA=1 \ ANOMALY_INBOUND=5 \ @@ -25,25 +23,26 @@ ENV PARANOIA=1 \ MODSEC_PCRE_MATCH_LIMIT=100000 \ MODSEC_PCRE_MATCH_LIMIT_RECURSION=100000 -COPY 3.3-nginx/docker-entrypoint.sh / -COPY 3.3-nginx/nginx.conf /etc/nginx/nginx.conf COPY src/opt/modsecurity/activate-rules.sh /opt/modsecurity/ COPY src/etc/modsecurity.d/*.conf /etc/modsecurity.d/ +COPY nginx/docker-entrypoint.sh / +COPY nginx/nginx.conf /etc/nginx/nginx.conf +# Change default shell to bash +SHELL ["/bin/bash", "-o", "pipefail", "-c"] + +# hadolint ignore=DL3008,SC2016 RUN apt-get update \ - && apt-get -y install \ + && apt-get -y install --no-install-recommends \ ca-certificates \ - git \ + curl \ iproute2 \ - moreutils \ && mkdir /opt/owasp-crs \ - && cd /opt/owasp-crs \ - && git init \ - && git remote add origin https://github.com/${REPO} \ - && git fetch --depth 1 origin ${BRANCH} \ - && git checkout ${COMMIT} \ - && mv -v crs-setup.conf.example crs-setup.conf \ - && ln -sv /opt/owasp-crs /etc/modsecurity.d/ + && curl -SL https://github.com/coreruleset/coreruleset/archive/${RELEASE}.tar.gz \ + | tar -zxf - --strip-components=1 -C /opt/owasp-crs \ + && mv -v /opt/owasp-crs/crs-setup.conf.example /opt/owasp-crs/crs-setup.conf \ + && ln -sv /opt/owasp-crs /etc/modsecurity.d/ \ + && rm -rf /var/lib/apt/lists/* ENTRYPOINT ["/docker-entrypoint.sh"] CMD ["nginx", "-g", "daemon off;"] diff --git a/3.3-nginx/docker-entrypoint.sh b/nginx/docker-entrypoint.sh similarity index 100% rename from 3.3-nginx/docker-entrypoint.sh rename to nginx/docker-entrypoint.sh diff --git a/3.3-nginx/nginx.conf b/nginx/nginx.conf similarity index 100% rename from 3.3-nginx/nginx.conf rename to nginx/nginx.conf diff --git a/src/release.sh b/src/release.sh new file mode 100755 index 00000000..077ca8a4 --- /dev/null +++ b/src/release.sh @@ -0,0 +1,25 @@ +#!/bin/bash + +# Release will use master branch as stable + +set -e + +target="$1" + +if [ -z "$target" ]; then + echo "usage: $0 vX.Y-(apache|nginx)" >&2 + exit 1 +fi + +# relases might be release candidates, which are named with '-rcX' +release="${target%-*}" +server="${target#*-}" +server_no_rc="${server#*-}" + +cd "$(dirname "$0")/.." +mkdir -p "${target}" + + +sed -e "s,%%RELEASE%%,${release},g" \ + "${server_no_rc}/Dockerfile" > "${target}/Dockerfile" +