Skip to content

Commit 5e32495

Browse files
authored
feat: Update default error log level, broken link (#1427)
This commit updates the default error log level for F5 WAF for NGINX configuration examples from debug to warning, and updates a broken link for NGINX Gateway Fabric. Closes #1411 Metadata and Markdown fixes have been included for affected files.
1 parent 9ac1e44 commit 5e32495

File tree

6 files changed

+16
-19
lines changed

6 files changed

+16
-19
lines changed

content/ngf/support.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,4 +38,4 @@ Visit the [project’s GitHub repository](https://github.com/nginx/nginx-support
3838

3939
- You can also get help through the [NGINX Community Forum](https://community.nginx.org/).
4040

41-
- If you need dedicated support for NGINX Gateway Fabric, or you would like to leverage our [advanced NGINX Plus features](https://docs.nginx.com/nginx-gateway-fabric/overview/nginx-plus/), you can contact [F5 Sales](https://www.f5.com/content/f5-com/en_us/products/get-f5).
41+
- If you need dedicated support for NGINX Gateway Fabric, or you would like to leverage our [advanced NGINX Plus features](https://docs.nginx.com/nginx-gateway-fabric/overview/nginx-plus/), you can contact [F5 Sales](https://www.f5.com/products/get-f5).

content/waf/install/docker.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ user nginx;
7171
worker_processes auto;
7272
load_module modules/ngx_http_app_protect_module.so;
7373
74-
error_log /var/log/nginx/error.log debug;
74+
error_log /var/log/nginx/error.log warn;
7575
7676
events {
7777
worker_connections 10240;
@@ -839,7 +839,7 @@ user nginx;
839839
worker_processes auto;
840840
load_module modules/ngx_http_app_protect_module.so;
841841
842-
error_log /var/log/nginx/error.log debug;
842+
error_log /var/log/nginx/error.log warn;
843843
844844
events {
845845
worker_connections 10240;

content/waf/logging/custom-dimensions.md

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Custom dimensions for log entries
33
toc: false
44
weight: 200
55
nd-content-type: reference
6-
nd-product: NAP-WAF
6+
nd-product: WAF
77
---
88

99
F5 WAF for NGINX can configure custom dimensions for log entries using the directive `app_protect_custom_log_attribute`.
@@ -27,7 +27,7 @@ The following example defines the `app_protect_custom_log_attribute` directive a
2727
```nginx
2828
user nginx;
2929
load_module modules/ngx_http_app_protect_module.so;
30-
error_log /var/log/nginx/error.log debug;
30+
error_log /var/log/nginx/error.log warn;
3131
3232
events {
3333
worker_connections 65536;
@@ -85,6 +85,4 @@ The log will specify the precise issue:
8585

8686
```text
8787
app_protect_custom_log_attribute directive is invalid. Number of app_protect_custom_log_attribute directives exceeds maximum
88-
```
89-
90-
88+
```

content/waf/policies/configuration.md

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,7 @@ weight: 100
77
toc: true
88
# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this
99
nd-content-type: how-to
10-
# Intended for internal catalogue and search, case sensitive:
11-
# Agent, N4Azure, NIC, NIM, NGF, NAP-DOS, NAP-WAF, NGINX One, NGINX+, Solutions, Unit
12-
nd-product: NAP-WAF
10+
nd-product: WAF
1311
---
1412

1513
This page describes the security features available with F5 WAF for NGINX and how to configure policies.
@@ -76,7 +74,7 @@ worker_processes 4;
7674
7775
load_module modules/ngx_http_app_protect_module.so;
7876
79-
error_log /var/log/nginx/error.log debug;
77+
error_log /var/log/nginx/error.log warn;
8078
8179
events {
8280
worker_connections 65536;
@@ -141,6 +139,7 @@ By default, other requests which have a lower violation rating are not blocked,
141139
For example, if you want to add blocking on a violation rating of 3 as well, enable blocking for the `VIOL_RATING_NEED_EXAMINATION` violation.
142140

143141
The following violations and signature sets have a low chance of being false positives and are, therefore, configured by default to block the request regardless of its Violation Rating:
142+
144143
- High accuracy attack signatures
145144
- Threat campaigns
146145
- Malformed request: unparsable header, malformed cookie and malformed body (JSON or XML).
@@ -249,6 +248,7 @@ In addition, the Strict policy also enables the following features in **alarm on
249248
The policy JSON file specifies the settings that are different from the base template, such as enabling more signatures, disabling some violations, adding server technologies, etc. These will be shown in the next sections.
250249

251250
There are two ways to tune those settings:
251+
252252
- Within the `policy` structure property, the organic structure of the policy.
253253
- Within the `modifications` structure property that contains a list of changes expressed in a generic manner.
254254

@@ -297,6 +297,7 @@ The same configuration in the `modifications` array looks like this:
297297
Note the generic schema that can express manipulation in any policy element: `entity`, `entityType`, `action` etc. The `modifications` array is a flat list of individual changes applied to the policy after evaluating the `policy` block.
298298

299299
So when to use `policy` and when to use `modifications`? There are some recommended practice guidelines for that:
300+
300301
- Use `policy` to express the security policy as you intended it to be: the features you want to enable, disable, the signature sets, server technologies and other related configuration attributes. This part of the policy is usually determined when the application is deployed and changes at a relatively slow pace.
301302
- Use `modifications` to express **exceptions** to the intended policy. These exceptions are usually the result of fixing false positive incidents and failures in tests applied to those policies. Usually these are granular modifications, typically disabling checks of individual signatures, metacharacters and sub-violations. These changes are more frequent.
302303
- Use `modifications` also for **removing** individual collection elements from the base template, for example disallowed file types.

content/waf/policies/graphql-protection.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ worker_processes 4;
8484
8585
load_module modules/ngx_http_app_protect_module.so;
8686
87-
error_log /var/log/nginx/error.log debug;
87+
error_log /var/log/nginx/error.log warn;
8888
8989
events {
9090
worker_connections 65536;

content/waf/policies/grpc-protection.md

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,7 @@ weight: 1200
77
toc: true
88
# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this
99
nd-content-type: reference
10-
# Intended for internal catalogue and search, case sensitive:
11-
# Agent, N4Azure, NIC, NIM, NGF, NAP-DOS, NAP-WAF, NGINX One, NGINX+, Solutions, Unit
12-
nd-product: NAP-WAF
10+
nd-product: WAF
1311
---
1412

1513
This topic describes the gRPC protection feature for F5 WAF for NGINX.
@@ -36,7 +34,6 @@ They include:
3634
- **Security enforcement**, which detect signatures and/or metacharacters and optionally an exception list of signatures (Such as overrides) that need to be disabled in the context of a profile.
3735
- **Defense attributes**, special restrictions applied to the gRPC traffic. This includes a size limit for the gRPC messages in the request, and whether to tolerate fields that are not defined in the definition of the Protocol Buffer messages.
3836

39-
4037
An example service might have the following IDL file:
4138

4239
```proto
@@ -66,7 +63,6 @@ The definitions of `OperationResult` and `Condition` messages are in the importe
6663

6764
Both files need to be referenced in the gRPC content profile:
6865

69-
7066
```json
7167
{
7268
"policy": {
@@ -331,6 +327,7 @@ gRPC guarantees message ordering within an individual RPC call.
331327
```shell
332328
rpc LotsOfGreetings(stream HelloRequest) returns (HelloResponse);
333329
```
330+
334331
#### Server stream
335332

336333
The client sends a request to the server and gets a stream to read a sequence of messages back.
@@ -340,6 +337,7 @@ The client reads from the returned stream until there are no more messages. gRPC
340337
```shell
341338
rpc LotsOfReplies(HelloRequest) returns (stream HelloResponse);
342339
```
340+
343341
#### Bidirectional streams
344342

345343
Both sides send a sequence of messages using a read-write stream.
@@ -381,7 +379,7 @@ worker_processes auto;
381379
382380
load_module modules/ngx_http_app_protect_module.so;
383381
384-
error_log /var/log/nginx/error.log debug;
382+
error_log /var/log/nginx/error.log warn;
385383
working_directory /tmp/cores;
386384
worker_rlimit_core 1000M;
387385

0 commit comments

Comments
 (0)