Add Snippet for ModSecurity

[diazjf]

Adds a custom snippet to configure modsecurity.

[diazjf]

Waiting on owasp-modsecurity/ModSecurity-nginx#110

[aledbf]

@diazjf I am checking owasp-modsecurity/ModSecurity-nginx#110 (comment) in the build of the image

[aledbf]

@diazjf please rebase from master (#3406 is merged)

[diazjf]

-------------------------------------------------------------------------------
W1112 18:51:38.925063       8 queue.go:130] requeuing e2e-tests-modsecuritylocation-1542048379881314035-5xs66/modsecurity.foo.com, err 
-------------------------------------------------------------------------------
Error: exit status 1
2018/11/12 18:51:38 [notice] 1691#1691: ModSecurity-nginx v1.0.0
2018/11/12 18:51:38 [emerg] 1691#1691: "modsecurity_rules_remote" directive  in /tmp/nginx-cfg622971149:447
nginx: [emerg] "modsecurity_rules_remote" directive  in /tmp/nginx-cfg622971149:447
nginx: configuration file /tmp/nginx-cfg622971149 test failed
-------------------------------------------------------------------------------

Still occurring after rebase.

^ @aledbf

[aledbf]

@diazjf I just posted a comment in the modsecurity issue

[aledbf]

@diazjf can you run the e2e tests locally adding the flag --v=2 here https://github.com/kubernetes/ingress-nginx/blob/master/test/manifests/ingress-controller/mandatory.yaml#L211
(I want to see the generated nginx.conf because nginx is not saying the directive is invalid)

[diazjf]

@aledbf the above is when I cat a failed nginx.conf from the test.

[aledbf]

@diazjf I found the issue/s:

• remote rules only allow HTTPS https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#secremoterules
• In case of errors, the execution is aborted https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#secremoterulesfailaction
• the error we see in the test is related to an invalid FQDN. If the hosts or the URL is not valid (content) we get

nginx: [emerg] "modsecurity_rules_remote" directive  in /data/2:441

Because all that, you need to check the URL is HTTPS and the resource exist while parsing the annotation.

[diazjf]

@aledbf would it make sense for me to send a request to the URL to make sure it exists?

[diazjf]

/hold

[diazjf]

/hold cancel

[diazjf]

@aledbf adding the RemoteRules feature doesn't seem to be feasible at the moment. There arn't any(that I've seen) guides on how to configure your own server.

I have changed the PR to just include the snippet. Remote Rules can be added that way in case anyone needs to use them.

[diazjf]

/retest

[diazjf]

/test all

[diazjf]

/assign @aledbf

[aledbf]

/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aledbf, diazjf

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [aledbf]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[aledbf]

@diazjf thanks!