Skip to content

Commit e901119

Browse files
aknot242alessfg
andcommitted
Removal fixes for WAF and DoS (#141)
Co-authored-by: Alessandro Fael Garcia <[email protected]>
1 parent 4b59222 commit e901119

27 files changed

+394
-321
lines changed

.github/workflows/molecule.yml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,9 @@ jobs:
2121
scenario:
2222
- advanced
2323
- default
24-
- specific-version
2524
- dos
25+
- specific-version
26+
- uninstall
2627
steps:
2728
- name: Check out the codebase
2829
if: github.event.pull_request.head.repo.full_name == github.repository

CHANGELOG.md

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,22 @@
11
# Changelog
22

3+
## 0.8.0 (Unreleased)
4+
5+
BREAKING CHANGES:
6+
7+
* Rename `nginx_app_protect_<waf/dos>_state` parameter to `nginx_app_protect_<waf/dos>_setup` parameters.
8+
* Rename multiple `nginx_app_protect_*` parameters and tags to `nginx_app_protect_waf_*` to aid in disambiguation.
9+
* Cleanup remaining Alpine Linux tasks.
10+
11+
ENHANCEMENTS:
12+
13+
New molecule tests for NGINX App Protect WAF and DoS removal scenarios.
14+
15+
BUG FIXES:
16+
17+
* Role was failing to uninstall NGINX App Protect DoS packages when the `nginx_app_protect_dos_state` was set to `absent`.
18+
* Uninstallation scenario was unintentionally creating repository entries.
19+
320
## 0.7.1 (February 16, 2022)
421

522
ENHANCEMENTS:

defaults/main.yml

Lines changed: 35 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,19 @@ nginx_app_protect_waf_enable: true
55
# Specify whether or not this role should install the NGINX App Protect DoS product.
66
nginx_app_protect_dos_enable: false
77

8-
# Specify whether you want to maintain your version of NGINX App Protect WAF, upgrade to the latest version, or remove NGINX App Protect WAF.
9-
# Using 'present' will install the latest version of NGINX App Protect WAF on a fresh install.
10-
# Using 'latest' will upgrade NGINX App Protect WAF to the latest version on every playbook execution.
11-
# Using 'absent' will remove NGINX App Protect WAF from your system.
12-
# Default is present.
13-
nginx_app_protect_waf_state: present
14-
15-
# Specify whether you want to maintain your version of NGINX App Protect DoS, upgrade to the latest version, or remove NGINX App Protect DoS.
16-
# Using 'present' will install the latest version of NGINX App Protect DoS on a fresh install.
17-
# Using 'latest' will upgrade NGINX App Protect DoS to the latest version on every playbook execution.
18-
# Using 'absent' will remove NGINX App Protect DoS from your system.
19-
# Default is present.
20-
nginx_app_protect_dos_state: present
8+
# Specify whether you want to install NGINX App Protect WAF, upgrade to the latest version, or remove NGINX App Protect WAF.
9+
# Using 'install' will install the latest version of NGINX App Protect WAF on a fresh install.
10+
# Using 'upgrade' will upgrade NGINX App Protect WAF to the latest version of NGINX App Protect WAF on every playbook execution.
11+
# Using 'uninstall' will remove NGINX App Protect WAF from your system.
12+
# Default is install.
13+
nginx_app_protect_waf_setup: install
14+
15+
# Specify whether you want to install NGINX App Protect DoS, upgrade to the latest version, or remove NGINX App Protect DoS.
16+
# Using 'install' will install the latest version of NGINX App Protect DoS on a fresh install.
17+
# Using 'upgrade' will upgrade NGINX App Protect DoS to the latest version of NGINX App Protect DoS on every playbook execution.
18+
# Using 'uninstall' will remove NGINX App Protect DoS from your system.
19+
# Default is install.
20+
nginx_app_protect_dos_setup: install
2121

2222
# If you have a RHEL subscription, NGINX App Protect WAF's dependencies will use subscription repos.
2323
# Otherwise, it will source packages from CentOS' repositories.
@@ -27,16 +27,16 @@ nginx_app_protect_use_rhel_subscription_repos: false
2727
# The installation of NGINX App Protect WAF includes a base signature set, which may be out of date.
2828
# This option installs the latest NGINX App Protect signatures.
2929
# Default is true.
30-
nginx_app_protect_install_signatures: true
30+
nginx_app_protect_waf_install_signatures: true
3131

3232
# (Optional) Installs a specific version of the NGINX App Protect WAF attack signatures package
3333
# Default is to install the latest release.
34-
# nginx_app_protect_signatures_version: "=2019.07.16-1" # <- Example value for Debian/Ubuntu
34+
# nginx_app_protect_waf_signatures_version: "=2019.07.16-1" # <- Example value for Debian/Ubuntu
3535

3636
# The installation of NGINX App Protect WAF can include a page of frequently-updated, high-accuracy signatures called "threat campaigns".
3737
# This option installs the latest NGINX App Protect WAF threat campaigns signatures.
3838
# Default is true.
39-
nginx_app_protect_install_threat_campaigns: true
39+
nginx_app_protect_waf_install_threat_campaigns: true
4040

4141
# (Optional) Installs a specific version of the NGINX App Protect WAF threat campaigns package
4242
# Default is to install the latest release.
@@ -46,25 +46,35 @@ nginx_app_protect_install_threat_campaigns: true
4646
# Default settings are the official NGINX signing key hosts.
4747
# nginx_app_protect_signing_key:
4848
# nginx_plus: https://cs.nginx.com/static/keys/nginx_signing.key
49-
# security_updates: https://cs.nginx.com/static/keys/app-protect-security-updates.key
49+
# waf_security_updates: https://cs.nginx.com/static/keys/app-protect-security-updates.key
5050

51-
# Specify whether or not you want to manage the NGINX App Protect repositories.
52-
# Using 'true' will manage NGINX App Protect repositories.
53-
# Using 'false' will not manage the NGINX App Protect repositories, allowing them to be managed through other means.
51+
# Specify whether or not you want to manage the NGINX App Protect WAF repositories.
52+
# Using 'true' will manage NGINX App Protect WAF repositories.
53+
# Using 'false' will not manage the NGINX App Protect WAF repositories, allowing them to be managed through other means.
5454
# Default is true
55-
nginx_app_protect_manage_repo: true
55+
nginx_app_protect_waf_manage_repo: true
56+
57+
# Specify whether or not you want to manage the NGINX App Protect DoS repositories.
58+
# Using 'true' will manage NGINX App Protect DoS repositories.
59+
# Using 'false' will not manage the NGINX App Protect DoS repositories, allowing them to be managed through other means.
60+
# Default is true
61+
nginx_app_protect_dos_manage_repo: true
5662

5763
# (Optional) Specify repository for NGINX Plus.
5864
# Defaults are the official NGINX repositories.
5965
# nginx_plus_repository: deb [arch=amd64] https://pkgs.nginx.com/plus/debian buster nginx-plus
6066

61-
# (Optional) Specify repository for NGINX App Protect.
67+
# (Optional) Specify repository for NGINX App Protect WAF.
68+
# Defaults are the official NGINX repositories.
69+
# nginx_app_protect_waf_repository: deb [arch=amd64 signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect/debian buster nginx-plus
70+
71+
# (Optional) Specify repository for NGINX App Protect WAF security updates.
6272
# Defaults are the official NGINX repositories.
63-
# nginx_app_protect_repository: deb [arch=amd64] https://pkgs.nginx.com/app-protect/debian buster nginx-plus
73+
# nginx_app_protect_waf_security_updates_repository: deb [arch=amd64 signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://app-protect-security-updates.nginx.com/debian buster nginx-plus
6474

65-
# (Optional) Specify repository for NGINX App Protect security updates.
75+
# (Optional) Specify repository for NGINX App Protect DoS.
6676
# Defaults are the official NGINX repositories.
67-
# nginx_app_protect_security_updates_repository: deb [arch=amd64] https://app-protect-security-updates.nginx.com/debian buster nginx-plus
77+
# nginx_app_protect_dos_repository: deb [arch=amd64 signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/debian buster nginx-plus
6878

6979
# Location of your NGINX App Protect license in your local machine.
7080
# Default is the files folder within the NGINX Ansible role.

handlers/main.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@
1111
when:
1212
- nginx_app_protect_start | bool
1313
- not ansible_check_mode | bool
14-
- ansible_os_family != "Alpine"
1514
listen: (Handler - NGINX App Protect) Run NGINX
1615

1716
- name: (Handler - NGINX App Protect) Check NGINX

molecule/advanced/verify.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@
99
check_mode: true
1010
register: install
1111
failed_when: (install is changed) or (install is failed)
12-
when: ansible_os_family != "Alpine"
1312

1413
- name: Check if NGINX App Protect WAF is installed
1514
package:

molecule/default/files/test-security-policy.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,4 @@
55
"name": "POLICY_TEMPLATE_NGINX_BASE"
66
}
77
}
8-
}
8+
}

molecule/default/verify.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,6 @@
4242
check_mode: true
4343
register: service
4444
failed_when: (service is changed) or (service is failed)
45-
when: ansible_os_family != "Alpine"
4645

4746
- name: Store the statistics of /etc/app_protect/conf/test-security-policy.json in the 'security_policy' variable
4847
stat:

molecule/dos/verify.yml

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@
99
check_mode: true
1010
register: install
1111
failed_when: (install is changed) or (install is failed)
12-
when: ansible_os_family != "Alpine"
1312

1413
- name: Check if NGINX App Protect DoS is installed
1514
package:
@@ -27,4 +26,3 @@
2726
check_mode: true
2827
register: service
2928
failed_when: (service is changed) or (service is failed)
30-
when: ansible_os_family != "Alpine"

molecule/specific-version/converge.yml

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,22 +5,20 @@
55
specify_app_protect_signatures_version: true
66
specify_app_protect_threat_campaigns_version: true
77
app_protect_signature_version_matrix:
8-
alpine: "=2021.01.20-r1"
98
debian: "=2019.07.16-1"
109
redhat: "-2019.07.16"
1110
app_protect_threat_campaigns_version_matrix:
12-
alpine: "=2021.01.03-r1"
1311
debian: "=2020.08.20-1"
1412
redhat: "-2020.08.20"
1513
tasks:
1614
- name: Set NGINX App Protect WAF signature version fact
1715
set_fact:
18-
nginx_app_protect_signatures_version: "{{ app_protect_signature_version_matrix[ansible_os_family | lower] }}{{ (ansible_os_family | lower == 'debian') | ternary('~' ~ ansible_distribution_release, '') }}"
16+
nginx_app_protect_waf_signatures_version: "{{ app_protect_signature_version_matrix[ansible_os_family | lower] }}{{ (ansible_os_family | lower == 'debian') | ternary('~' ~ ansible_distribution_release, '') }}"
1917
when: specify_app_protect_signatures_version| bool
2018

2119
- name: Set NGINX App Protect WAF threat campaigns version fact
2220
set_fact:
23-
nginx_app_protect_threat_campaigns_version: "{{ app_protect_threat_campaigns_version_matrix[ansible_os_family | lower] }}{{ (ansible_os_family | lower == 'debian') | ternary('~' ~ ansible_distribution_release, '') }}"
21+
nginx_app_protect_waf_threat_campaigns_version: "{{ app_protect_threat_campaigns_version_matrix[ansible_os_family | lower] }}{{ (ansible_os_family | lower == 'debian') | ternary('~' ~ ansible_distribution_release, '') }}"
2422
when: specify_app_protect_threat_campaigns_version| bool
2523

2624
- name: Install NGINX App Protect WAF
@@ -31,7 +29,5 @@
3129
certificate: license/nginx-repo.crt
3230
key: license/nginx-repo.key
3331
nginx_app_protect_remove_license: false
34-
nginx_app_protect_install_signatures: true
35-
nginx_app_protect_install_threat_campaigns: true
36-
nginx_app_protect_configure: false
37-
nginx_app_protect_waf_state: present
32+
nginx_app_protect_waf_install_signatures: true
33+
nginx_app_protect_waf_install_threat_campaigns: true

molecule/specific-version/verify.yml

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,9 @@
55
specify_app_protect_signatures_version: true
66
specify_app_protect_threat_campaigns_version: true
77
app_protect_signature_version_matrix:
8-
alpine: "=2021.01.20-r1"
98
debian: "=2019.07.16-1"
109
redhat: "-2019.07.16"
1110
app_protect_threat_campaigns_version_matrix:
12-
alpine: "=2021.01.03-r1"
1311
debian: "=2020.08.20-1"
1412
redhat: "-2020.08.20"
1513
tasks:
@@ -20,7 +18,6 @@
2018
check_mode: true
2119
register: install
2220
failed_when: (install is changed) or (install is failed)
23-
when: ansible_os_family != "Alpine"
2421

2522
- name: Check if NGINX App Protect WAF is installed
2623
package:
@@ -54,7 +51,6 @@
5451
check_mode: true
5552
register: service
5653
failed_when: (service is changed) or (service is failed)
57-
when: ansible_os_family != "Alpine"
5854

5955
- name: Check NGINX App Protect WAF version
6056
block:
@@ -69,4 +65,3 @@
6965
- name: Verify installed NAP threat campaigns version matches requested version
7066
assert:
7167
that: (ansible_facts.packages['app-protect-threat-campaigns'] | map(attribute='version') | first) == (app_protect_threat_campaigns_version_matrix[ansible_os_family | lower] | regex_replace('^-|=','') + (ansible_os_family | lower == 'debian') | ternary('~' ~ ansible_distribution_release, ''))
72-
when: ansible_os_family != "Alpine"

0 commit comments

Comments
 (0)