Update import_apache_waf.py

import_apache_waf.py

@@ -3,120 +3,117 @@ import subprocess
 import logging
 from pathlib import Path
 import shutil
+import filecmp  # Import for file comparison
 
-# Configure logging
+# --- Configuration ---
-logging.basicConfig(
+LOG_LEVEL = logging.INFO  # DEBUG, INFO, WARNING, ERROR
-    level=logging.INFO,
+WAF_DIR = Path(os.getenv("WAF_DIR", "waf_patterns/apache")).resolve()
-    format="%(asctime)s - %(levelname)s - %(message)s",
+APACHE_WAF_DIR = Path(os.getenv("APACHE_WAF_DIR", "/etc/modsecurity.d/")).resolve()
-    handlers=[logging.StreamHandler()],
+APACHE_CONF = Path(os.getenv("APACHE_CONF", "/etc/apache2/apache2.conf")).resolve()
-)
+INCLUDE_STATEMENT = "IncludeOptional /etc/modsecurity.d/*.conf"
+BACKUP_DIR = Path(os.getenv("BACKUP_DIR", "/etc/modsecurity.d/backup")).resolve()
 
-# Constants (configurable via environment variables)
+
-WAF_DIR = Path(os.getenv("WAF_DIR", "waf_patterns/apache")).resolve()  # Source directory for WAF files
+# --- Logging Setup ---
-APACHE_WAF_DIR = Path(os.getenv("APACHE_WAF_DIR", "/etc/modsecurity.d/")).resolve()  # Target directory
+logging.basicConfig(level=LOG_LEVEL, format="%(asctime)s - %(levelname)s - %(message)s")
-APACHE_CONF = Path(os.getenv("APACHE_CONF", "/etc/apache2/apache2.conf")).resolve()  # Apache config file
+logger = logging.getLogger(__name__)
-INCLUDE_STATEMENT = "IncludeOptional /etc/modsecurity.d/*.conf"  # Include directive
 
 
 def copy_waf_files():
-    """
+    """Copies WAF files, handling existing files and creating backups."""
-    Copy Apache WAF configuration files to the target directory.
+    logger.info("Copying Apache WAF patterns...")
 
-    Raises:
+    # Ensure target directory exists
-        Exception: If there is an error copying files.
-    """
-    logging.info("Copying Apache WAF patterns...")
-
-    try:
-        # Ensure the target directory exists
     APACHE_WAF_DIR.mkdir(parents=True, exist_ok=True)
-        logging.info(f"[+] Created or verified directory: {APACHE_WAF_DIR}")
+    logger.info(f"Target directory: {APACHE_WAF_DIR}")
+
+    # Ensure backup directory exists
+    BACKUP_DIR.mkdir(parents=True, exist_ok=True)
+    logger.info(f"Backup directory: {BACKUP_DIR}")
 
-        # Copy .conf files from source to target directory
     for conf_file in WAF_DIR.glob("*.conf"):
         dst_path = APACHE_WAF_DIR / conf_file.name
 
-            if dst_path.exists():
-                logging.warning(f"[!] File already exists: {dst_path}")
-                continue
-
         try:
-                shutil.copy2(conf_file, dst_path)
+            if dst_path.exists():
-                logging.info(f"[+] Copied {conf_file} to {APACHE_WAF_DIR}")
+                # Compare files.  If identical, skip.  If different, backup and replace.
-            except Exception as e:
+                if filecmp.cmp(conf_file, dst_path, shallow=False):
-                logging.error(f"[!] Failed to copy {conf_file}: {e}")
+                    logger.info(f"Skipping {conf_file.name} (identical file exists).")
-                raise
+                    continue  # Identical file, skip
-    except Exception as e:
+
-        logging.error(f"[!] Error copying WAF files: {e}")
+                # Different file exists: create backup
-        raise
+                backup_path = BACKUP_DIR / f"{dst_path.name}.{int(time.time())}"  # Timestamped backup
+                logger.warning(f"Existing file {dst_path.name} differs. Backing up to {backup_path}")
+                shutil.copy2(dst_path, backup_path)  # Backup existing file
+
+            # Copy the new file (or overwrite if it was different)
+            shutil.copy2(conf_file, dst_path)  # Copy with metadata
+            logger.info(f"Copied {conf_file.name} to {dst_path}")
+
+        except OSError as e:
+            logger.error(f"Error copying {conf_file.name}: {e}")
+            raise  # Re-raise for critical error handling
 
 
 def update_apache_conf():
-    """
+    """Ensures the include statement is present, avoiding duplicates."""
-    Ensure the WAF include statement is present in the Apache configuration file.
+    logger.info("Checking Apache configuration for WAF include...")
-
-    Raises:
-        Exception: If there is an error updating the Apache configuration.
-    """
-    logging.info("Ensuring WAF patterns are included in apache2.conf...")
 
     try:
-        # Read the current configuration
         with open(APACHE_CONF, "r") as f:
-            config = f.read()
+            config_lines = f.readlines()
 
-        # Append include statement if not present
+        # Check if the include statement *already* exists.
-        if INCLUDE_STATEMENT not in config:
+        include_present = any(INCLUDE_STATEMENT in line for line in config_lines)
-            logging.info("Adding WAF include to apache2.conf...")
+
+        if not include_present:
+            # Append the include statement to the *end* of the file.
             with open(APACHE_CONF, "a") as f:
-                f.write(f"\n{INCLUDE_STATEMENT}\n")
+                f.write(f"\n{INCLUDE_STATEMENT}\n")  # Add a newline for safety
-            logging.info("[+] WAF include statement added to apache2.conf.")
+            logger.info(f"Added include statement to {APACHE_CONF}")
         else:
-            logging.info("WAF patterns already included in apache2.conf.")
+            logger.info("Include statement already present.")
-    except Exception as e:
+
-        logging.error(f"[!] Error updating Apache configuration: {e}")
+    except FileNotFoundError:
+        logger.error(f"Apache configuration file not found: {APACHE_CONF}")
+        raise  # Critical error
+    except OSError as e:
+        logger.error(f"Error updating Apache configuration: {e}")
         raise
 
 
 def reload_apache():
-    """
+    """Tests the Apache configuration and reloads if valid."""
-    Reload Apache to apply the new WAF rules.
+    logger.info("Reloading Apache...")
-
-    Raises:
-        Exception: If there is an error reloading Apache.
-    """
-    logging.info("Reloading Apache to apply new WAF rules...")
 
     try:
-        # Test Apache configuration
+        # Test configuration
-        subprocess.run(["apachectl", "configtest"], check=True)
+        subprocess.run(["apachectl", "configtest"], check=True, capture_output=True, text=True)
-        logging.info("[+] Apache configuration test passed.")
+        logger.info("Apache configuration test successful.")
 
         # Reload Apache
-        subprocess.run(["systemctl", "reload", "apache2"], check=True)
+        subprocess.run(["systemctl", "reload", "apache2"], check=True, capture_output=True, text=True)
-        logging.info("[+] Apache reloaded successfully.")
+        logger.info("Apache reloaded.")
+
     except subprocess.CalledProcessError as e:
-        logging.error(f"[!] Apache configuration test failed: {e}")
+        logger.error(f"Apache command failed: {e.cmd} - Return code: {e.returncode}")
-        raise
+        logger.error(f"Stdout: {e.stdout}")
+        logger.error(f"Stderr: {e.stderr}")
+        raise  # Re-raise to signal failure
     except FileNotFoundError:
-        logging.error("[!] 'apachectl' or 'systemctl' command not found. Are you on a supported system?")
+        logger.error("apachectl or systemctl command not found.  Is Apache/systemd installed?")
-        raise
-    except Exception as e:
-        logging.error(f"[!] Error reloading Apache: {e}")
         raise
 
 
 def main():
-    """
+    """Main function."""
-    Main function to execute the script.
-    """
     try:
         copy_waf_files()
         update_apache_conf()
         reload_apache()
-        logging.info("[✔] Apache configured with latest WAF rules.")
+        logger.info("Apache WAF configuration updated successfully.")
     except Exception as e:
-        logging.critical(f"[!] Script failed: {e}")
+        logger.critical(f"Script failed: {e}")
         exit(1)