External/patterns
1
0
Fork 0
mirror of https://github.com/fabriziosalmi/patterns.git synced 2025-12-17 09:45:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update json2apache.py

Browse Source
This commit is contained in:
fab 2025-02-28 11:26:45 +01:00 committed by GitHub
parent 4c01d419de
commit ed0c2e736e
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 26 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
json2apache.py
View File

@ -5,6 +5,7 @@ import logging
from pathlib import Path from pathlib import Path
from typing import List, Dict, Set, Tuple, Optional from typing import List, Dict, Set, Tuple, Optional
from functools import lru_cache from functools import lru_cache
from collections import defaultdict # Import defaultdict
# --- Configuration --- # --- Configuration ---
LOG_LEVEL = logging.INFO # Adjust as needed (DEBUG, INFO, WARNING, ERROR) LOG_LEVEL = logging.INFO # Adjust as needed (DEBUG, INFO, WARNING, ERROR)
@ -21,19 +22,19 @@ DEFAULT_ACTIONS = "deny,status:403,log"
# Unsupported ModSecurity directives (expand as needed) # Unsupported ModSecurity directives (expand as needed)
UNSUPPORTED_PATTERNS = [ UNSUPPORTED_PATTERNS = [
"@pmFromFile", # File lookups not directly supported "@pmFromFile", # File lookups not directly supported
# You might handle some of these with ctl:ruleRemoveTargetById later # You might handle some of these with ctl:ruleRemoveTargetById later
] ]
# Supported ModSecurity operators and their rough translations (for logging/info) # Supported ModSecurity operators and their rough translations (for logging/info)
SUPPORTED_OPERATORS = { SUPPORTED_OPERATORS = {
"@rx": "Regular Expression", "@rx": "Regular Expression",
"@streq": "String Equals", "@streq": "String Equals",
"@contains": "Contains String", "@contains": "Contains String",
"@beginsWith": "Begins With", "@beginsWith": "Begins With",
"@endsWith": "Ends With", "@endsWith": "Ends With",
"@within": "Contained Within", "@within": "Contained Within",
"@ipMatch": "IP Address Match", "@ipMatch": "IP Address Match",
# ... add more as needed # ... add more as needed
} }
# --- Logging Setup --- # --- Logging Setup ---
@ -78,7 +79,7 @@ def _determine_variables(location: str) -> str:
# Add other location mappings as needed # Add other location mappings as needed
else: else:
logger.warning(f"Unknown location '{location}', defaulting to REQUEST_URI") logger.warning(f"Unknown location '{location}', defaulting to REQUEST_URI")
return "REQUEST_URI" # Default variable return "REQUEST_URI" # Default variable
def generate_apache_waf(rules: List[Dict]) -> None: def generate_apache_waf(rules: List[Dict]) -> None:
@ -93,16 +94,24 @@ def generate_apache_waf(rules: List[Dict]) -> None:
for rule in rules: for rule in rules:
rule_id = rule.get("id", "no_id") # Get rule ID rule_id = rule.get("id", "no_id") # Get rule ID
if not isinstance(rule_id, int): # check if is an int if not isinstance(rule_id, int): # check if is an int
# Extract ID from rule and convert to an integer # Extract ID from rule and convert to an integer
match = re.search(r'id:(\d+)', rule_id) match = re.search(r'id:(\d+)', rule_id)
rule_id = int(match.group(1)) if match else rule_id_counter if match:
rule_id_counter += 1 try:
rule_id = int(match.group(1))
except ValueError:
logger.warning(f"Invalid rule ID '{match.group(1)}' in rule: {rule}. Using generated ID.")
rule_id = rule_id_counter
rule_id_counter += 1
else:
rule_id = rule_id_counter
rule_id_counter += 1
category = rule.get("category", "generic").lower() category = rule.get("category", "generic").lower()
pattern = rule["pattern"] pattern = rule["pattern"]
location = rule.get("location", "REQUEST_URI") # Set a default variable location = rule.get("location", "REQUEST_URI") # Set a default variable
severity = rule.get("severity", "CRITICAL").upper() # CRITICAL, ERROR, WARNING, NOTICE severity = rule.get("severity", "CRITICAL").upper() # CRITICAL, ERROR, WARNING, NOTICE
# --- Operator Handling --- # --- Operator Handling ---
operator_used = "Unknown" # Default operator_used = "Unknown" # Default
for op in SUPPORTED_OPERATORS: for op in SUPPORTED_OPERATORS:
@ -133,7 +142,7 @@ def generate_apache_waf(rules: List[Dict]) -> None:
phase=2, # Phase 2 (request body processing) is common, adjust if needed phase=2, # Phase 2 (request body processing) is common, adjust if needed
actions=DEFAULT_ACTIONS, actions=DEFAULT_ACTIONS,
) )
categorized_rules[category].add(rule_str) # added into a dict categorized_rules[category].add(rule_str) # added into a dict
# --- File Output --- # --- File Output ---