|
| 1 | +name: IIS-tests |
| 2 | + |
| 3 | +# Controls when the workflow will run |
| 4 | +on: |
| 5 | + # Triggers the workflow on push or pull request events but only for the waf_nginx branch |
| 6 | + push: |
| 7 | + branches: [ waf_nginx ] |
| 8 | + pull_request: |
| 9 | + branches: [ waf_nginx ] |
| 10 | + |
| 11 | + # Allows you to run this workflow manually from the Actions tab |
| 12 | + workflow_dispatch: |
| 13 | + |
| 14 | +jobs: |
| 15 | + build: |
| 16 | + runs-on: windows-2019 |
| 17 | + steps: |
| 18 | + # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it |
| 19 | + - uses: actions/checkout@v2 |
| 20 | + # Setup Env |
| 21 | + - name: Install Modsec Dependencies |
| 22 | + run: cd iis; .\getModSecurityPkgs.ps1 https://modsecurity.blob.core.windows.net/windows-artifacts |
| 23 | + - name: Pre-Build Preparation |
| 24 | + run: | |
| 25 | + cd iis |
| 26 | + #setup the python virtual env - not a must but still |
| 27 | + py.exe -2 -m pip install virtualenv |
| 28 | + py.exe -2 -m virtualenv --version |
| 29 | + $python_proj_name = "test_crs3" |
| 30 | + py.exe -2 -m virtualenv $python_proj_name |
| 31 | + & ".\$python_proj_name\Scripts\activate.ps1" |
| 32 | + # Build |
| 33 | + - name: Build Modsec |
| 34 | + run: cd iis; ./build_release_amd64.bat |
| 35 | + # Test |
| 36 | + - name: Pre-Test Config |
| 37 | + run: | |
| 38 | + $python_proj_name = "test_crs3" |
| 39 | + & ".\iis\$python_proj_name\Scripts\activate.ps1" |
| 40 | + $modsec_repo = "$pwd" |
| 41 | + $modsec_conf = "$modsec_repo\iis\wix\modsecurity.conf" |
| 42 | + $modsec_iis_conf = "$modsec_repo\iis\wix\modsecurity_iis.conf" |
| 43 | + & {iisreset /stop} #need to stop iis before copy of files that are used by it |
| 44 | + #copy the xml file to the schema |
| 45 | + Copy-Item "$modsec_repo\iis\ModSecurity.xml" -Destination "$env:SystemRoot\System32\inetsrv\config\schema" -Force |
| 46 | + #set modsecurity in applicationhost.cofig |
| 47 | + [System.Reflection.Assembly]::LoadFrom("$env:systemroot\system32\inetsrv\Microsoft.Web.Administration.dll") |
| 48 | + $sm = new-object Microsoft.Web.Administration.ServerManager |
| 49 | + $rootSG = $sm.GetApplicationHostConfiguration().RootSectionGroup |
| 50 | + $rootSG.SectionGroups["system.webServer"].Sections.Add("ModSecurity") |
| 51 | + $rootSG.SectionGroups["system.webServer"].Sections["ModSecurity"].OverrideModeDefault = "Deny" |
| 52 | + $rootSG.SectionGroups["system.webServer"].Sections["ModSecurity"].AllowDefinition = "Everywhere" |
| 53 | + $sm.CommitChanges() |
| 54 | + & "$env:SystemRoot\System32\inetsrv\appcmd.exe" install module /name:"ModSecurity" /image:"$modsec_repo\iis\release\amd64\ModSecurityIIS.dll" |
| 55 | + & "$env:SystemRoot\System32\inetsrv\appcmd.exe" set config /section:"system.webServer/ModSecurity" /"enabled:true" /"configFile:$modsec_iis_conf" |
| 56 | + #setup the crs repo and the modsec config |
| 57 | + $crs_path = "$modsec_repo\crs" |
| 58 | + git clone -b "v3.1.0" -q https://github.com/SpiderLabs/owasp-modsecurity-crs.git $crs_path |
| 59 | + cd "$modsec_repo\tests" |
| 60 | + Rename-Item -Path "$crs_path\crs-setup.conf.example" -NewName "crs-setup.conf" |
| 61 | + Copy-Item "$crs_path\util\regression-tests\requirements.txt" -Destination "$modsec_repo\tests" -Force |
| 62 | + #setup the test env with depending python pkgs |
| 63 | + pip install ftw==1.1.7 |
| 64 | + #configure modsec to use crs 3 and set if for the python testing |
| 65 | + $dbg_file = "$modsec_repo\modsec_debug.log" |
| 66 | + Add-Content $modsec_conf "SecDebugLog $dbg_file`r`nSecDebugLogLevel 3" |
| 67 | + Clear-Content $modsec_iis_conf |
| 68 | + #configure modsecurity_iis.conf for crs 3 and for runnig the python tests |
| 69 | + Add-Content $modsec_iis_conf "Include modsecurity.conf" |
| 70 | + Add-Content $modsec_iis_conf "SecAction ""id:900005,\`r`n phase:1,\`r`n nolog,\`r`n pass,\`r`n ctl:ruleEngine=DetectionOnly,\`r`n ctl:ruleRemoveById=910000,\" |
| 71 | + Add-Content $modsec_iis_conf " setvar:tx.paranoia_level=4,\`r`n setvar:tx.crs_validate_utf8_encoding=1,\`r`n setvar:tx.arg_name_length=100,\`r`n setvar:tx.arg_length=400""" |
| 72 | + Add-Content $modsec_iis_conf "include $crs_path\crs-setup.conf" |
| 73 | + Add-Content $modsec_iis_conf "include $crs_path/rules/*.conf" |
| 74 | + & {iisreset /start}; Start-Service W3SVC # finished all the modsec config, start iis |
| 75 | + - name: Run Test |
| 76 | + run: | |
| 77 | + $modsec_repo = "$pwd" |
| 78 | + $python_proj_name = "test_crs3" |
| 79 | + $crs_path = "$modsec_repo\crs" |
| 80 | + & "$modsec_repo\iis\$python_proj_name\Scripts\Activate.ps1" |
| 81 | + #usually the first test fail, due to i/o |
| 82 | + cd tests; |
| 83 | + py.test.exe -v CRS_Tests_modsec_dbg.py --rule="$crs_path\util\regression-tests\tests\test.yaml" |
| 84 | + #running all the tests |
| 85 | + py.test.exe -q CRS_Tests_modsec_dbg.py --ruledir_recurse="$crs_path\util\regression-tests\tests\" --result-log=res.txt --tb=no --junit-xml=res.xml |
| 86 | + python Parse_test_res.py res.txt |
0 commit comments