Anti-virus support without need to run external programs #1986

azurit · 2021-01-24T18:01:42Z

Adding anti-virus support implemented in pure Lua. The only external requirement is lua-socket library (should be part of all major distros). Currently, only ClamAV is supported. All configuration can be done in crs-setup.conf. This feature is disabled by default.

Feature is implemented using INSTREAM ClamAV command, so:

no external program/script is running (no forking, no need of extended permissions and so on)
ClamAV doesn't need to be run as root to have access to scanned files as data is send through socket (both TCP/IP and unix socket files are supported)
should be fully multiplatform

Thing to consider: Requests containing virus should be hard-blocked, current implementation is only adding score (CRITICAL severity).

ClamAV signatures for PHP malware (tested, both are good):
https://www.rfxn.com/projects/linux-malware-detect/ (free of charge)
https://malware.expert/signatures/ (commercial)

…into v3.4/antivirus

dune73 · 2021-01-25T14:49:11Z

Hey @azurit, thank you for this contribution.

I can not get it to work so far, but I have some preliminary feedback:

The log action missing in rule 925100
I like your handling of virus name in 925100
Please rename av.lua to anti-virus.lua
I get the feeling you would like to generalize this, but the var names link it to clamav. Can you generalize them, or will a different backend need different variables? If yes, then better leave it as is.
I enabled the rules without compiling lua into ModSec, but no warning. I know, this is not your fault, but it's a problem.
(As soon as lua is installed, apache complains when it does not find the script.)
No comments whatsoever in av.lua script. Most is self-explanatory, but not everything.
Documentation should reference the need for testing with the eicar file:
curl http://localhost --form "[email protected]"
Get eicar test file from https://www.eicar.org
Remark to run lua script from the command line while testing would also be helpful
lua5.3 av.lua
(If that is meant to work at all)
No complaint that lua-socket is not installed
But error message:
[2021-01-25 15:31:53.679752] [-:error] 127.0.0.1:44956 YA7WWVYoCzdOV1uTMfDC7AAAAAA [client 127.0.0.1] ModSecurity: Rule processing failed (id=, msg=). [hostname "localhost"] [uri "/"] [unique_id "YA7WWVYoCzdOV1uTMfDC7AAAAAA"]
configuration comments reference connection type socket and tcp, but script checks for socket and else.
Also not sure that
module_name = "socket"
is correct for connection type "tcp". Or is it?
What is require("m") meant to load? I fail with this. And I never got it to log anything.

azurit · 2021-01-25T16:16:07Z

Hey @azurit, thank you for this contribution.

I can not get it to work so far, but I have some preliminary feedback:

Thanks for reviewing! Strange, it's fully working for me. Also see comments below.

* The log action missing in rule 925100

Fixed.

* I like your handling of virus name in 925100

* Please rename av.lua to anti-virus.lua

Done.

* I get the feeling you would like to generalize this, but the var names link it to clamav. Can you generalize them, or will a different backend need different variables? If yes, then better leave it as is.

I was planning to add support also for other anti-virus software and allow activation of multiple anti-viruses simultaneously - it makes sense as various AVs are able to detect different viruses.

* I enabled the rules without compiling lua into ModSec, but no warning. I know, this is not your fault, but it's a problem.
  (As soon as lua is installed, apache complains when it does not find the script.)

Now i noticed that @inspectFile is not giving a warning about this - in other cases like SecRuleScript, modsecurity is printing a warning on web server startup:
Ignoring SecRuleScript "response_body_decompress.lua" directive (/usr/share/modsecurity-crs-new/rules/REQUEST-901-INITIALIZATION.conf:502): No Lua scripting support.

Probably a modsecurity bug, I will look into this.

* No comments whatsoever in av.lua script. Most is self-explanatory, but not everything.

I already added few but was not pushing it only because of this. But ok, i will add more.

* Documentation should reference the need for testing with the eicar file:
  curl http://localhost --form "[email protected]"
  Get eicar test file from https://www.eicar.org

Added.

* Remark to run lua script from the command line while testing would also be helpful
  lua5.3 av.lua
  (If that is meant to work at all)

This is not supposed to work.

* No complaint that lua-socket is not installed
  But error message:
  [2021-01-25 15:31:53.679752] [-:error] 127.0.0.1:44956 YA7WWVYoCzdOV1uTMfDC7AAAAAA [client 127.0.0.1] ModSecurity: Rule processing failed (id=, msg=). [hostname "localhost"] [uri "/"] [unique_id "YA7WWVYoCzdOV1uTMfDC7AAAAAA"]

It's working for me, modsec2, apache 2.4, lua 5.1. What version of modsec are you testing on? Which web server software?

[Mon Jan 25 17:06:01.153312 2021] [:error] [pid 14721] [client ...] [client ...] ModSecurity: ClamAV: lua-socket library not installed, please install it or disable 'tx.crs_anti-virus_protection_enable' in crs-setup.conf [hostname "..."] [uri "/"] [unique_id "YA7saWbMVoYLfTj0kRzgpAAAAGA"]

* configuration comments reference connection type socket and tcp, but script checks for socket and else.

Yes, do you find this not correct? I can add additional check.

  Also not sure that
  module_name = "socket"
  is correct for connection type "tcp". Or is it?

This is ok.

* What is require("m") meant to load? I fail with this. And I never got it to log anything.

It's a special modsecurity Lua library shipped with modsecurity and always available to all Lua scripts executed internally, using it, Lua scripts has access to modsecurity internals (for example TX variable).

dune73 · 2021-01-25T16:20:19Z

Thank you for petting me. I have lua 5.3 installed. Does it work for you on lua 5.3 as well?

Definitely no "m" to load / require here. :(

azurit · 2021-01-25T16:30:53Z

Are you sure your modsecurity is compiled with Lua 5.3? Is it modsec 2 or 3? The whole modsecurity 2.x documentation is mentioning only Lua version 5.1. Newer Lua versions are available only with modsec 3 (as far as i understand it).

dune73 · 2021-01-25T16:35:44Z

Ah, my bad. Have not worked with Lua in quite a long time. No problem during compilation, but if that is a constraint, I need to downgrade and try it out anew.

azurit · 2021-01-25T16:49:27Z

I just pushed mentioned fixies.

azurit · 2021-01-25T18:01:47Z

Were you able to make it work?

dune73 · 2021-01-25T18:31:00Z

Have not tried it yet.

franbuehler · 2021-03-01T20:37:22Z

Meeting decision March: #2008 (comment):
@airween volunteers to review this PR.

dune73 · 2021-04-02T15:36:10Z

Hey @airween: You promised to review this PR. Did you have the time to look into it?

airween · 2021-04-02T16:12:28Z

Hey @airween: You promised to review this PR. Did you have the time to look into it?

Yes, I already did it - found some issue in case of libmodsecurity3, see this report. Noticed @azurit about partially results.

Btw: in case of Apache2 - mod_security everything worked as well.

airween · 2021-04-04T20:15:27Z

I reviewed this PR, see my comments between lines.

There is one more note: libmodsecurity3 has a known bug: variable REQUEST_BODY always presents, even if the Content-Type is not www-url-form-encoded nor ctl:forceRequestBodyVariable isn't used. Therefore it has an unexpected side effect: when upload a file, libmodsecurity3 uses the REQUEST_BODY at all rules where it uses, and there are two false positive rule: 920272 and 920273.

2021/04/04 21:23:19 [info] 12723#12723: *3 ModSecurity: Warning. Matched "Operator `ValidateByteRange' with parameter `32-36,38-126' against variable `REQUEST_BODY' (Value: `--------------------------cbd70b742c11bc6b\x0d\x0aContent-Disposition: form-data; name="userfile"; f (556 characters omitted)' ) [file "/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1361"] [id "920272"] [rev ""] [msg "Invalid character in request (outside of printable chars below ascii 127)"] [data "REQUEST_BODY=--------------------------cbd70b742c11bc6b\x0d\x0aContent-Disposition: form-data; name="userfile"; filename="eicar.com"\x0d\x0aContent-Type: application/octet-stream\x0d\x0a\x0d\x0aPK\x03\x04\x0a\x00\x00\x00\x00\x00\xe0\x98\xb8(<\xcfQhD\x00\x00\x00D\x00\x00\x00\x09\x00\x00\x00 (202 characters omitted)"] [severity "2"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "paranoia-level/3"] [hostname "::1"] [uri "/index.php"] [unique_id "1617564199"] [ref "o42,1o43,1o113,1o114,1o153,1o154,1o155,1o156,1o159,1o160,1o161,1o162,1o163,1o164,1o165,1o166,1o167,1o168,1o169,1o172,1o176,1o177,1o178,1o180,1o181,1o182,1o183,1o184,1o185,1o186,1o201,1o266,1o267,1o268 (360 characters omitted)"], client: ::1, server: _, request: "POST /index.php HTTP/1.1", host: "localhost"

2021/04/04 21:23:19 [info] 12723#12723: *3 ModSecurity: Warning. Matched "Operator `ValidateByteRange' with parameter `38,44-46,48-58,61,65-90,95,97-122' against variable `REQUEST_BODY' (Value: `--------------------------cbd70b742c11bc6b\x0d\x0aContent-Disposition: form-data; name="userfile"; f (556 characters omitted)' ) [file "/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1500"] [id "920273"] [rev ""] [msg "Invalid character in request (outside of very strict set)"] [data "REQUEST_BODY=--------------------------cbd70b742c11bc6b\x0d\x0aContent-Disposition: form-data; name="userfile"; filename="eicar.com"\x0d\x0aContent-Type: application/octet-stream\x0d\x0a\x0d\x0aPK\x03\x04\x0a\x00\x00\x00\x00\x00\xe0\x98\xb8(<\xcfQhD\x00\x00\x00D\x00\x00\x00\x09\x00\x00\x00 (202 characters omitted)"] [severity "2"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "paranoia-level/4"] [hostname "::1"] [uri "/index.php"] [unique_id "1617564199"] [ref "o42,1o43,1o64,1o74,1o75,1o81,1o90,1o91,1o92,1o102,1o112,1o113,1o114,1o128,1o140,1o153,1o154,1o155,1o156,1o159,1o160,1o161,1o162,1o163,1o164,1o165,1o166,1o167,1o168,1o169,1o170,1o171,1o172,1o176,1o177, (533 characters omitted)"], client: ::1, server: _, request: "POST /index.php HTTP/1.1", host: "localhost"

These FP's always triggered, no matter the anti-virus feature is on or off, but the anomaly score value will be distorted.

And finally: in case of Apache2 + mod_security everything is fine.

airween

See my comments between the lines.

crs-setup.conf.example

rules/anti-virus.lua

airween · 2021-04-05T10:29:41Z

crs-setup.conf.example

+#  setvar:'tx.crs_anti-virus_clamav_port=3310',\
+#  setvar:'tx.crs_anti-virus_clamav_chunk_size=4096',\
+#  setvar:'tx.crs_anti-virus_clamav_network_timeout_seconds=2',\
+#  setvar:'tx.crs_anti-virus_clamav_max_file_size_bytes=1048576'"


To avoid the FP's in case of libmodsecurity3 (because the REQUEST_BODY is always presented), we should add these actions:

ctl:ruleRemoveById=920272,\ ctl:ruleRemoveById=920273"

or we can combine these exceptions with checking of CT header.

I would not count on CT as it can be faked to bypass anti-virus check.

May be we should discuss this on monthly chat. I tried this rule in crs-setup.conf:

SecRule REQUEST_HEADERS:Content-Type "(?:multipart/form-data)" \ "id:'900801',\ phase:1,\ t:none,t:lowercase,\ pass,\ nolog,\ ctl:ruleRemoveTargetById=920272;REQUEST_BODY,\ ctl:ruleRemoveTargetById=920273;REQUEST_BODY"

I will keep this open, i think we need to discuss it with others.

azurit · 2021-04-05T13:20:59Z

Simple way of testing anti-virus:
python -c 'import requests; print(requests.post("http://example.com/", files={"virus": "X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*"}))'

azurit · 2021-04-05T16:59:51Z

@airween Thanks A LOT for a detailed review!

azurit · 2021-04-06T13:30:15Z

Just a note: I will rewrite this into plugin after plugin infrastructure is merged.

emphazer · 2021-04-09T09:45:44Z

lua: test.lua:2: attempt to index local 'socket' (a function value)
stack traceback:
        test.lua:2: in main chunk
        [C]: ?

azurit · 2021-04-09T09:47:08Z

Try this one:

local ok, socket2 = pcall(require, "socket.unix")
sck = socket2.tcp()
status, error = sck:connect("/var/run/clamd.scan/clamd.sock")
print(status)
print(error)
sck:close()

emphazer · 2021-04-09T09:48:37Z

lua: test2.lua:2: attempt to index local 'socket2' (a function value)
stack traceback:
        test2.lua:2: in main chunk
        [C]: ?

azurit · 2021-04-09T09:52:29Z

That's really weird, everything is fully working with same versions of the software on Debian 10.

What about this:

local ok, socket = pcall(require, "socket.unix")
print(ok)
print(type(socket))
print(socket)
sck = socket.tcp()
status, error = sck:connect("/var/run/clamd.scan/clamd.sock")
print(status)
print(error)
sck:close()

emphazer · 2021-04-09T09:56:20Z

i don't understand it too. the lua-socket module is from epel repository.
and lua from official rhel7 repo...

true
function
function: 0x60c080
lua: test3.lua:5: attempt to index local 'socket' (a function value)
stack traceback:
        test3.lua:5: in main chunk
        [C]: ?

azurit · 2021-04-09T10:15:43Z

Can you point me to the repository page of the lua-socket you are using? Looks like you have something different than i have. You need this library:
http://w3.impa.br/~diego/software/luasocket/

emphazer · 2021-04-09T10:20:10Z

Installed Packages
Name        : lua-socket
Arch        : x86_64
Version     : 3.0
Release     : 0.17.rc1.el7
Size        : 671 k
Repo        : installed
From repo   : rhel-server-7-epel
Summary     : Network support for the Lua language
URL         : http://www.tecgraf.puc-rio.br/~diego/professional/luasocket/
License     : MIT
Description : LuaSocket is a Lua extension library that is composed by two parts: a C core
            : that provides support for the TCP and UDP transport layers, and a set of Lua
            : modules that add support for functionality commonly needed by applications
            : that deal with the Internet.
            :
            : Among the support modules, the most commonly used implement the SMTP, HTTP
            : and FTP. In addition there are modules for MIME, URL handling and LTN12.

here the link to the source package. last update was 2018
https://ftp.fau.de/epel/7/SRPMS/Packages/l/lua-socket-3.0-0.17.rc1.el7.src.rpm

emphazer · 2021-04-09T13:29:22Z

@azurit you use v3.0 too right?

azurit · 2021-04-09T15:18:05Z

@emphazer Yes, 3.0 rc1, same as you.

emphazer · 2021-04-09T15:43:27Z

well, i could recompile the src package without the 3 included patches and see if it works...
or else im out of ideas.

azurit · 2021-04-09T15:56:25Z

No, wait with that please, i will try to look at it again probably tomorrow (i'm out of energy for today). Thank you!

emphazer · 2021-04-09T15:56:58Z

no problemo ;-)

airween · 2021-04-11T11:11:20Z

I don't know why, but looks like the RH and for eg. Debian Luasocket are different (I've tested both of them).

Here is a snippet which worked on both system:

socket = require("socket")
socket.unix = require("socket.unix")
c = socket.unix()
local ok = c:connect("/var/run/clamav/clamd.ctl")
print(ok)

Also it's interesting that on Debian the result will 1, on RH will 1.0.

…ements.

azurit · 2021-04-12T15:12:53Z

@airween Thanks!

@emphazer Can you try current version? Pls test both socket and tcp.

emphazer · 2021-04-13T07:27:29Z

yeeeeeehaaaa, work perfect! :-)
good job!

azurit · 2021-04-13T08:01:33Z

Does ANYONE see any problems or have feature requests?

airween · 2021-04-13T08:12:33Z

Does ANYONE see any problems or have feature requests?

I think it's really nice work, congratulation!

I'd check the whole cumulated patch again both on Apache and Nginx, but may be I just can do that tomorrow.

dune73 · 2021-04-14T08:28:58Z

This is coming along nicely. Thank you all for your work and looking fwd to @airween's review.

airween · 2021-04-17T11:46:50Z

@azurit, @emphazer - can you help me how can I emulate the POST request with x-www-form-urlencoded CT?

After the first tests, this implementation works with the "regular" file upload:

curl -v http://localhost/index.php -F "[email protected]"

2021/04/17 13:42:10 [info] 17102#17102: *11 ModSecurity: Warning. Matched "Operator `StrEq' with parameter `' against variable `TX:VIRUS_NAME' (Value: `Win.Test.EICAR_HDB-1' ) [file "/usr/share/modsecurity-crs/rules/REQUEST-925-ANTIVIRUS.conf"] [line "30"] [id "925110"] [rev ""] [msg "Virus detected in uploaded file: Win.Test.EICAR_HDB-1"] [data "Virus detected in uploaded file: Win.Test.EICAR_HDB-1"] [severity "2"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/262/441/442"] [hostname "::1"] [uri "/index.php"] [unique_id "1618659730"] [ref "v286,63"], client: ::1, server: _, request: "POST /index.php HTTP/1.1", host: "localhost"

2021/04/17 13:42:10 [info] 17102#17102: *11 ModSecurity: Warning. Matched "Operator `StrEq' with parameter `' against variable `TX:VIRUS_NAME' (Value: `Win.Test.EICAR_HDB-1' ) [file "/usr/share/modsecurity-crs/rules/REQUEST-925-ANTIVIRUS.conf"] [line "46"] [id "925120"] [rev ""] [msg "Virus detected in request body: Win.Test.EICAR_HDB-1"] [data "Virus detected in request body: Win.Test.EICAR_HDB-1"] [severity "2"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/262/441/442"] [hostname "::1"] [uri "/index.php"] [unique_id "1618659730"] [ref "v182,389"], client: ::1, server: _, request: "POST /index.php HTTP/1.1", host: "localhost"

and PUT method:

curl -v -T "eicar.com" "http://localhost/index.php"

2021/04/17 13:39:00 [info] 17102#17102: *9 ModSecurity: Warning. Matched "Operator `StrEq' with parameter `' against variable `TX:VIRUS_NAME' (Value: `Win.Test.EICAR_HDB-1' ) [file "/usr/share/modsecurity-crs/rules/REQUEST-925-ANTIVIRUS.conf"] [line "46"] [id "925120"] [rev ""] [msg "Virus detected in request body: Win.Test.EICAR_HDB-1"] [data "Virus detected in request body: Win.Test.EICAR_HDB-1"] [severity "2"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/262/441/442"] [hostname "::1"] [uri "/index.php"] [unique_id "1618659540"] [ref "v117,184"], client: ::1, server: _, request: "PUT /index.php HTTP/1.1", host: "localhost"

But the rule 925120 didn't triggered with the request was like this:

curl -X POST -d @eicar.com http://localhost/index.php

And my 2 cents: in case of first case (regular file upload) there are two blocking rules. It's no problem, just saying.

azurit · 2021-04-17T15:01:11Z

But the rule 925120 didn't triggered with the request was like this:

It works for me. Is that modsec3? Have you set tx.crs_anti-virus_protection_scan_request_body to 1 in crs-setup.conf?

And my 2 cents: in case of first case (regular file upload) there are two blocking rules. It's no problem, just saying.

modsec3?

airween · 2021-04-17T16:27:10Z

It works for me.

Can you share with me the curl request for this test?

Is that modsec3? Have you set tx.crs_anti-virus_protection_scan_request_body to 1 in crs-setup.conf?

yes, and yes :)

But I also tested with mod_security2 with same result.

And my 2 cents: in case of first case (regular file upload) there are two blocking rules. It's no problem, just saying.

modsec3?

yes, but in case of mod_security2, the PUT request doesn't work at there too. Can you share that request too?

azurit · 2021-04-17T16:42:04Z

I used the same command as you:
curl -X POST -d @eicar.com http://localhost/index.php

azurit · 2021-04-17T16:42:47Z

Apache or nginx?

airween · 2021-04-17T16:54:30Z

I'm using Apache2 with mod_security2, and Nginx with libmodsecurity3.

Here is the debug log from Apache+mod_security2 and the request what you shared:

Recipe: Invoking rule 7f928abeec38; [file "/usr/share/modsecurity-crs/rules/REQUEST-925-ANTIVIRUS.conf"] [line "58"] [id "925120"].
Rule 7f928abeec38: SecRule "TX:CRS_ANTI-VIRUS_PROTECTION_SCAN_REQUEST_BODY" "@eq 1" "phase:2,log,auditlog,id:925120,block,t:none,msg:'Virus detected in request body: %{tx.virus_name}',logdata:'Virus detected in request body: %{tx.virus_name}',tag:paranoia-level/1,tag:OWASP_CRS,tag:capec/1000/262/441/442,ver:OWASP_CRS/3.3.0,severity:CRITICAL,chain"
Transformation completed in 1 usec.
Executing operator "eq" with param "1" against TX:crs_anti-virus_protection_scan_request_body.
Target value: "1"
Operator completed in 1 usec.
Rule returned 1.
Match -> mode NEXT_RULE.
Recipe: Invoking rule 7f928abe4a88; [file "/usr/share/modsecurity-crs/rules/REQUEST-925-ANTIVIRUS.conf"] [line "59"].
Rule 7f928abe4a88: SecRule "REQUEST_BODY" "@inspectFile anti-virus.lua" "chain"
Transformation completed in 1 usec.
Executing operator "inspectFile" with param "anti-virus.lua" against REQUEST_BODY.
Target value: "PK\x03\x04"
Lua: Executing script: /usr/share/modsecurity-crs/rules/anti-virus.lua
Lua: Script completed in 1600 usec, returning: (null).
Operator completed in 1622 usec.
Rule returned 0.

Of course, I upgraded the anti-virus.lua tool by your newest version.

But looks like curl sends only a part of the file:

--37d8e57b-C--
PK^C^D
--37d8e57b-F--

Thoughts?

airween · 2021-04-19T09:02:00Z

I reviewed the whole PR again both on Apache2 + mod_security2 and Nginx and libmodsecurity3.

There were two files: eicar.com, which is a zip file, and eicar.txt the plain virus itself.

I tested the engines with these requests:

curl http://localhost/index.php -F "[email protected]"
curl http://localhost/index.php -F "[email protected]" 
curl http://localhost/index.php -X POST -d "@eicar.txt"
curl http://localhost/index.php -T "eicar.txt"

the requests:

upload the zip file
upload the plain virus
send a POST request with CT x-www-form-urlencoded
send a PUT request

All request were catched by both engine, the one and only side-effect is when I uploaded the zipped file to Nginx, it logged the both rule (925110 and 925120) - the reason is known (REQUEST_BODY is always exists in v3).

I asked @azurit that fix the prerequisites in case of v3 and nginx in comment - every other part of this PR is perfect :)

azurit · 2021-04-19T11:25:40Z

@airween Thank you very much!

Can you be so kind and test again - this time as a plugin, see:
https://github.com/coreruleset/antivirus-plugin

Don't forget to apply changes in includes needs for plugins to work:
https://github.com/coreruleset/coreruleset/blob/v3.4/dev/INSTALL

Almost nothing changed so do only quick test mainly on Nginx and modsec3 (i already tested modsec2 + apache).

airween · 2021-04-19T11:33:19Z

@airween Thank you very much!

Can you be so kind and test again - this time as a plugin, see:
https://github.com/coreruleset/antivirus-plugin

Don't forget to apply changes in includes needs for plugins to work:
https://github.com/coreruleset/coreruleset/blob/v3.4/dev/INSTALL

Almost nothing changed so do only quick test mainly on Nginx and modsec3 (i already tested modsec2 + apache).

sure, I'll check it again soon.

azurit · 2021-04-23T07:07:51Z

Closing in favour of official Antivirus plugin, see:
https://github.com/coreruleset/antivirus-plugin

Thanks to everyone!

azurit added 3 commits January 19, 2021 13:57

initial commit

01808ca

Merge branch 'v3.4/dev' of https://github.com/coreruleset/coreruleset …

92abfda

…into v3.4/antivirus

Anti-virus support

39b84a6

azurit added the 🚀 enhancement New feature or request label Jan 24, 2021

azurit self-assigned this Jan 24, 2021

Added support for max file size, fixed typos, few improvements

4de205a

Additional fixies

b01b147

dune73 mentioned this pull request Feb 1, 2021

Monthly Chat Agendas February (2021-02-01 and 2021-02-15) #1992

Closed

dune73 mentioned this pull request Mar 1, 2021

Monthly Chat Agendas March (2021-03-01 and 2021-02-15) Meeting Agenda #2008

Closed

franbuehler requested a review from airween March 1, 2021 20:38

dune73 mentioned this pull request Apr 2, 2021

Monthly Chat Agendas April (2021-04-05 and 2021-04-19) Meeting Agenda #2051

Closed

airween reviewed Apr 4, 2021

View reviewed changes

crs-setup.conf.example Show resolved Hide resolved

crs-setup.conf.example Outdated Show resolved Hide resolved

rules/anti-virus.lua Outdated Show resolved Hide resolved

airween reviewed Apr 5, 2021

View reviewed changes

Make prerequisities more clear, fix modsec3 compatilibity

951bc8b

Update prerequisities

144ffae

Fix support with RHEL version of lua-socket, minor performance improv…

89c38b4

…ements.

azurit closed this Apr 23, 2021

Anti-virus support without need to run external programs #1986

Anti-virus support without need to run external programs #1986

Conversation

azurit commented Jan 24, 2021 • edited Loading

dune73 commented Jan 25, 2021 • edited Loading

azurit commented Jan 25, 2021

dune73 commented Jan 25, 2021

azurit commented Jan 25, 2021

dune73 commented Jan 25, 2021

azurit commented Jan 25, 2021

azurit commented Jan 25, 2021

dune73 commented Jan 25, 2021

franbuehler commented Mar 1, 2021

dune73 commented Apr 2, 2021

airween commented Apr 2, 2021

airween commented Apr 4, 2021

airween left a comment

Choose a reason for hiding this comment

airween Apr 5, 2021

Choose a reason for hiding this comment

azurit Apr 5, 2021

Choose a reason for hiding this comment

airween Apr 5, 2021

Choose a reason for hiding this comment

azurit Apr 5, 2021

Choose a reason for hiding this comment

azurit commented Apr 5, 2021

azurit commented Apr 5, 2021

azurit commented Apr 6, 2021 • edited Loading

emphazer commented Apr 9, 2021

azurit commented Apr 9, 2021

emphazer commented Apr 9, 2021

azurit commented Apr 9, 2021

emphazer commented Apr 9, 2021

azurit commented Apr 9, 2021

emphazer commented Apr 9, 2021

emphazer commented Apr 9, 2021

azurit commented Apr 9, 2021

emphazer commented Apr 9, 2021

azurit commented Apr 9, 2021

emphazer commented Apr 9, 2021

airween commented Apr 11, 2021

azurit commented Apr 12, 2021

emphazer commented Apr 13, 2021

azurit commented Apr 13, 2021

airween commented Apr 13, 2021

dune73 commented Apr 14, 2021

airween commented Apr 17, 2021

azurit commented Apr 17, 2021

airween commented Apr 17, 2021

azurit commented Apr 17, 2021

azurit commented Apr 17, 2021

airween commented Apr 17, 2021

airween commented Apr 19, 2021

azurit commented Apr 19, 2021

airween commented Apr 19, 2021

azurit commented Apr 23, 2021

azurit commented Jan 24, 2021 •

edited

Loading

dune73 commented Jan 25, 2021 •

edited

Loading

azurit commented Apr 6, 2021 •

edited

Loading