Skip to content

Commit 7e1fa3c

Browse files
pdabelf5pdabelf5
authored
Pin all NAP WAF package versions (#8317)
1 parent cb40135 commit 7e1fa3c

File tree

2 files changed

+59
-19
lines changed

2 files changed

+59
-19
lines changed

‎Makefile‎

Lines changed: 23 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ GIT_TAG = $(shell git describe --exact-match --tags || echo untagged)
44
VERSION = $(VER)-SNAPSHOT
55
NGINX_OSS_VERSION ?= 1.29
66
NGINX_PLUS_VERSION ?= R35
7+
NAP_WAF_VERSION ?= 35+5.498
8+
NAP_WAF_COMMON_VERSION ?= 11.533
9+
NAP_WAF_PLUGIN_VERSION ?= 6.20.0
710
NGINX_AGENT_VERSION ?= 3.3
811
PLUS_ARGS = --build-arg NGINX_PLUS_VERSION=$(NGINX_PLUS_VERSION) --secret id=nginx-repo.crt,src=nginx-repo.crt --secret id=nginx-repo.key,src=nginx-repo.key
912

@@ -155,32 +158,37 @@ alpine-image-plus-fips: build ## Create Docker image for Ingress Controller (Alp
155158

156159
.PHONY: alpine-image-nap-plus-fips
157160
alpine-image-nap-plus-fips: build ## Create Docker image for Ingress Controller (Alpine with NGINX Plus, NGINX App Protect WAF and FIPS)
158-
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=alpine-plus-nap-fips
161+
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=alpine-plus-nap-fips --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)
159162

160163
.PHONY: alpine-image-nap-v5-plus-fips
161164
alpine-image-nap-v5-plus-fips: build ## Create Docker image for Ingress Controller (Alpine with NGINX Plus, NGINX App Protect WAFv5 and FIPS)
162165
$(DOCKER_CMD) $(PLUS_ARGS) \
163-
--build-arg BUILD_OS=alpine-plus-nap-v5-fips
166+
--build-arg BUILD_OS=alpine-plus-nap-v5-fips --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)
164167

165168
.PHONY: debian-image-plus
166169
debian-image-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus)
167170
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus --build-arg NGINX_AGENT_VERSION=$(NGINX_AGENT_VERSION)
168171

169172
.PHONY: debian-image-nap-plus
170173
debian-image-nap-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus and NGINX App Protect WAF)
171-
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf
174+
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf \
175+
--build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_WAF_PLUGIN_VERSION=$(NAP_WAF_PLUGIN_VERSION) \
176+
--build-arg NAP_WAF_COMMON_VERSION=$(NAP_WAF_COMMON_VERSION)
172177

173178
.PHONY: debian-image-nap-v5-plus
174179
debian-image-nap-v5-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus and NGINX App Protect WAFv5)
175-
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap-v5
180+
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap-v5 --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) \
181+
--build-arg NAP_WAF_PLUGIN_VERSION=$(NAP_WAF_PLUGIN_VERSION)
176182

177183
.PHONY: debian-image-dos-plus
178184
debian-image-dos-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus and NGINX App Protect DoS)
179185
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=dos
180186

181187
.PHONY: debian-image-nap-dos-plus
182188
debian-image-nap-dos-plus: build ## Create Docker image for Ingress Controller (Debian with NGINX Plus, NGINX App Protect WAF and DoS)
183-
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf,dos
189+
$(DOCKER_CMD) $(PLUS_ARGS) --build-arg BUILD_OS=debian-plus-nap --build-arg NAP_MODULES=waf,dos \
190+
--build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION) --build-arg NAP_WAF_PLUGIN_VERSION=$(NAP_WAF_PLUGIN_VERSION) \
191+
--build-arg NAP_WAF_COMMON_VERSION=$(NAP_WAF_COMMON_VERSION)
184192

185193
.PHONY: ubi-image
186194
ubi-image: build ## Create Docker image for Ingress Controller (UBI)
@@ -192,29 +200,33 @@ ubi-image-plus: build ## Create Docker image for Ingress Controller (UBI with NG
192200

193201
.PHONY: ubi-image-nap-plus
194202
ubi-image-nap-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAF)
195-
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap --build-arg NAP_MODULES=waf
203+
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap \
204+
--build-arg NAP_MODULES=waf --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)
196205

197206
.PHONY: ubi8-image-nap-plus
198207
ubi8-image-nap-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAF)
199-
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-8-plus-nap --build-arg NAP_MODULES=waf
208+
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-8-plus-nap \
209+
--build-arg NAP_MODULES=waf --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)
200210

201211
.PHONY: ubi-image-nap-v5-plus
202212
ubi-image-nap-v5-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAFv5)
203213
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license \
204-
--build-arg BUILD_OS=ubi-9-plus-nap-v5
214+
--build-arg BUILD_OS=ubi-9-plus-nap-v5 --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)
205215

206216
.PHONY: ubi8-image-nap-v5-plus
207217
ubi8-image-nap-v5-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect WAFv5)
208218
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license \
209-
--build-arg BUILD_OS=ubi-8-plus-nap-v5
219+
--build-arg BUILD_OS=ubi-8-plus-nap-v5 --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)
210220

211221
.PHONY: ubi-image-dos-plus
212222
ubi-image-dos-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus and NGINX App Protect DoS)
213-
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap --build-arg NAP_MODULES=dos
223+
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap \
224+
--build-arg NAP_MODULES=dos
214225

215226
.PHONY: ubi-image-nap-dos-plus
216227
ubi-image-nap-dos-plus: build ## Create Docker image for Ingress Controller (UBI with NGINX Plus, NGINX App Protect WAF and DoS)
217-
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap --build-arg NAP_MODULES=waf,dos
228+
$(DOCKER_CMD) $(PLUS_ARGS) --secret id=rhel_license,src=rhel_license --build-arg BUILD_OS=ubi-9-plus-nap \
229+
--build-arg NAP_MODULES=waf,dos --build-arg NAP_WAF_VERSION=$(NAP_WAF_VERSION)
218230

219231
.PHONY: all-images ## Create all the Docker images for Ingress Controller
220232
all-images: alpine-image alpine-image-plus alpine-image-plus-fips alpine-image-nap-plus-fips debian-image debian-image-plus debian-image-nap-plus debian-image-dos-plus debian-image-nap-dos-plus ubi-image ubi-image-plus ubi-image-nap-plus ubi-image-dos-plus ubi-image-nap-dos-plus

‎build/Dockerfile‎

Lines changed: 36 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22
ARG BUILD_OS=debian
33
ARG NGINX_OSS_VERSION=1.29
44
ARG NGINX_PLUS_VERSION=R35
5+
ARG NAP_WAF_VERSION=35+5.498
6+
ARG NAP_WAF_COMMON_VERSION=11.533
7+
ARG NAP_WAF_PLUGIN_VERSION=6.20.0
58
ARG NGINX_AGENT_VERSION=3.3
69
ARG DOWNLOAD_TAG=edge
710
ARG DEBIAN_FRONTEND=noninteractive
@@ -207,6 +210,7 @@ RUN --mount=type=bind,from=alpine-fips-3.22,target=/tmp/fips/ \
207210
############################################# Base image for Alpine with NGINX Plus, App Protect WAF and FIPS #############################################
208211
FROM alpine:3.19@sha256:3be987e6cde1d07e873c012bf6cfe941e6e85d16ca5fc5b8bedc675451d2de67 AS alpine-plus-nap-fips
209212
ARG NGINX_PLUS_VERSION
213+
ARG NAP_WAF_VERSION
210214
ARG PACKAGE_REPO
211215

212216
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
@@ -231,7 +235,7 @@ RUN --mount=type=bind,from=alpine-fips-3.19,target=/tmp/fips/ \
231235
&& cp -av /tmp/fips/etc/ssl/openssl.cnf /etc/ssl/openssl.cnf \
232236
&& mkdir -p /etc/nginx/reporting/ \
233237
&& cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
234-
&& apk add --no-cache app-protect app-protect-attack-signatures app-protect-threat-campaigns \
238+
&& apk add --no-cache app-protect~=${NAP_WAF_VERSION/+/.} app-protect-attack-signatures app-protect-threat-campaigns \
235239
&& sed -i -e '/nginx.com/d' /etc/apk/repositories \
236240
&& nap-waf.sh \
237241
agent.sh
@@ -240,6 +244,7 @@ RUN --mount=type=bind,from=alpine-fips-3.19,target=/tmp/fips/ \
240244
############################################# Base image for Alpine with NGINX Plus, App Protect WAFv5 and FIPS #############################################
241245
FROM alpine:3.19@sha256:3be987e6cde1d07e873c012bf6cfe941e6e85d16ca5fc5b8bedc675451d2de67 AS alpine-plus-nap-v5-fips
242246
ARG NGINX_PLUS_VERSION
247+
ARG NAP_WAF_VERSION
243248
ARG PACKAGE_REPO
244249

245250
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
@@ -262,7 +267,7 @@ RUN --mount=type=bind,from=alpine-fips-3.19,target=/tmp/fips/ \
262267
&& cp -av /tmp/fips/etc/ssl/openssl.cnf /etc/ssl/openssl.cnf \
263268
&& mkdir -p /etc/nginx/reporting/ \
264269
&& cp -av /tmp/nginx/reporting/tracking.info /etc/nginx/reporting/tracking.info \
265-
&& apk add --no-cache app-protect-module-plus~=35.5.498 \
270+
&& apk add --no-cache app-protect-module-plus~=${NAP_WAF_VERSION/+/.} \
266271
&& sed -i -e '/nginx.com/d' /etc/apk/repositories \
267272
&& nap-waf.sh \
268273
agent.sh
@@ -321,6 +326,9 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
321326
FROM debian-plus-only AS debian-plus-nap
322327
ARG NAP_MODULES
323328
ARG NGINX_PLUS_VERSION
329+
ARG NAP_WAF_VERSION
330+
ARG NAP_WAF_COMMON_VERSION
331+
ARG NAP_WAF_PLUGIN_VERSION
324332

325333
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
326334

@@ -337,7 +345,15 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
337345
cp /tmp/app-protect.sources /etc/apt/sources.list.d/app-protect.sources \
338346
&& cp /tmp/nginx-agent.sources /etc/apt/sources.list.d/nginx-agent.sources \
339347
&& apt-get update \
340-
&& apt-get install --no-install-recommends --no-install-suggests -y app-protect app-protect-attack-signatures app-protect-threat-campaigns nginx-agent=2.* \
348+
&& apt-get install --no-install-recommends --no-install-suggests -y app-protect=${NAP_WAF_VERSION}* \
349+
nginx-plus-module-appprotect=${NAP_WAF_VERSION}* \
350+
app-protect-engine=${NAP_WAF_COMMON_VERSION}* \
351+
app-protect-common=${NAP_WAF_COMMON_VERSION}* \
352+
app-protect-compiler=${NAP_WAF_COMMON_VERSION}* \
353+
app-protect-plugin=${NAP_WAF_PLUGIN_VERSION}* \
354+
app-protect-attack-signatures \
355+
app-protect-threat-campaigns \
356+
nginx-agent=2.* \
341357
&& rm -f /etc/apt/sources.list.d/app-protect.sources /etc/apt/sources.list.d/nginx-agent.sources \
342358
&& nap-waf.sh \
343359
&& agent.sh; \
@@ -354,6 +370,8 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
354370
############################################# Base image for Debian with NGINX Plus and App Protect WAFv5 #############################################
355371
FROM debian-plus-only AS debian-plus-nap-v5
356372
ARG NGINX_PLUS_VERSION
373+
ARG NAP_WAF_VERSION
374+
ARG NAP_WAF_PLUGIN_VERSION
357375

358376
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
359377

@@ -365,7 +383,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
365383
--mount=type=bind,from=nginx-files,src=nap-waf.sh,target=/usr/local/bin/nap-waf.sh \
366384
--mount=type=bind,from=nginx-files,src=debian-agent-12.sources,target=/etc/apt/sources.list.d/nginx-agent.sources \
367385
apt-get update \
368-
&& apt-get install --no-install-recommends --no-install-suggests -y nginx-agent=2.* app-protect-module-plus=35+5.498* nginx-plus-module-appprotect=35+5.498* app-protect-plugin=6.20.0* \
386+
&& apt-get install --no-install-recommends --no-install-suggests -y nginx-agent=2.* app-protect-module-plus=${NAP_WAF_VERSION}* nginx-plus-module-appprotect=${NAP_WAF_VERSION}* app-protect-plugin=${NAP_WAF_PLUGIN_VERSION}* \
369387
&& nap-waf.sh \
370388
&& agent.sh
371389

@@ -400,6 +418,10 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
400418
FROM ubi-minimal AS ubi-9-plus-nap
401419
ARG NAP_MODULES
402420
ARG BUILD_OS
421+
ARG NGINX_PLUS_VERSION
422+
ARG NAP_WAF_VERSION
423+
424+
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
403425

404426
RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
405427
--mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
@@ -430,7 +452,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
430452
rpm --import /tmp/app-protect-security-updates.key \
431453
&& cp /tmp/app-protect-9.repo /etc/yum.repos.d/app-protect-9.repo \
432454
&& microdnf --enablerepo=codeready-builder-for-rhel-9-x86_64-rpms --nodocs install -y \
433-
app-protect app-protect-attack-signatures app-protect-threat-campaigns \
455+
app-protect-${NAP_WAF_VERSION}* app-protect-attack-signatures app-protect-threat-campaigns \
434456
&& rm -f /etc/yum.repos.d/app-protect-9.repo \
435457
&& nap-waf.sh \
436458
&& agent.sh; \
@@ -447,6 +469,10 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
447469

448470
############################################# Base image for UBI with NGINX Plus and App Protect WAFv5 #############################################
449471
FROM ubi-minimal AS ubi-9-plus-nap-v5
472+
ARG NGINX_PLUS_VERSION
473+
ARG NAP_WAF_VERSION
474+
475+
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
450476

451477
RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
452478
--mount=type=secret,id=nginx-repo.key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
@@ -468,7 +494,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
468494
&& rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm \
469495
&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
470496
&& microdnf --nodocs install -y ca-certificates shadow-utils subscription-manager \
471-
&& microdnf --nodocs install -y nginx-plus-module-otel nginx-agent-2.* app-protect-module-plus-35+5.498* \
497+
&& microdnf --nodocs install -y nginx-plus-module-otel nginx-agent-2.* app-protect-module-plus-${NAP_WAF_VERSION}* \
472498
&& nap-waf.sh \
473499
&& ubi-clean.sh \
474500
&& agent.sh
@@ -477,6 +503,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
477503
############################################# Base image for UBI8 with NGINX Plus and App Protect WAF #############################################
478504
FROM redhat/ubi8@sha256:534c2c0efa4150ede18e3f9d7480d3b9ec2a52e62bc91cd54e08ee7336819619 AS ubi-8-plus-nap
479505
ARG NGINX_PLUS_VERSION
506+
ARG NAP_WAF_VERSION
480507
ARG BUILD_OS
481508

482509
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
@@ -506,7 +533,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
506533
&& subscription-manager attach \
507534
&& dnf config-manager --set-enabled codeready-builder-for-rhel-8-x86_64-rpms \
508535
&& dnf --nodocs install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm \
509-
&& dnf --nodocs install -y app-protect app-protect-attack-signatures app-protect-threat-campaigns \
536+
&& dnf --nodocs install -y app-protect-${NAP_WAF_VERSION}* app-protect-attack-signatures app-protect-threat-campaigns \
510537
&& subscription-manager unregister \
511538
&& nap-waf.sh \
512539
&& agent.sh \
@@ -516,6 +543,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
516543
############################################# Base image for UBI8 with NGINX Plus and App Protect WAFv5 #############################################
517544
FROM redhat/ubi8@sha256:534c2c0efa4150ede18e3f9d7480d3b9ec2a52e62bc91cd54e08ee7336819619 AS ubi-8-plus-nap-v5
518545
ARG NGINX_PLUS_VERSION
546+
ARG NAP_WAF_VERSION
519547

520548
ENV NGINX_VERSION=${NGINX_PLUS_VERSION}
521549

@@ -538,7 +566,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
538566
&& rpm --import /tmp/nginx_signing.key \
539567
&& rpm -Uvh /ubi-bin/c-ares-*.rpm \
540568
&& dnf --nodocs install -y nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-plus-module-fips-check nginx-agent-2.* \
541-
&& dnf --nodocs install -y app-protect-module-plus-35+5.498* \
569+
&& dnf --nodocs install -y app-protect-module-plus-${NAP_WAF_VERSION}* \
542570
&& nap-waf.sh \
543571
&& agent.sh \
544572
&& dnf clean all

0 commit comments

Comments
 (0)