owasp-modsecurity / modsecurity-python-bindings

Python bindings for libModSecurity (aka ModSecurity v3)

NOTE

This project was outdated by the pymodsecurity project (https://github.com/actions-security/pymodsecurity). At pymodsecurity you can get a more stable and feature complete bindings for libmodsecurity.

Introduction

The following are a set of Swig generated Python bindings for libmodsecurity. These bindings will allow users to utilize the exposed libmodsecurity interfaces directly from python, without the use of ctypes.

Compilation

Although these are python scripts DO NOT use setup.py to compile this. Instead, one should use the Makefile in order to compile these. This can be done by typing 'make'. Be aware that the Python development headers and Swig are required to build this package. These can be obtained on RHEL via 'dnf install swig python-devel'

modsecurity-python-bindings's Issues

Error building on Ubuntu 16.04.1

SWIG: 3.0 (also tried 2.0)
Python: 2.7 (also tried 3.5)

Running make I get some errors like:

modsecurity/modsecurity_wrap.cxx:23432:12: error: use of deleted function 'std::__cxx11::basic_ostringstream<_CharT, _Traits, _Alloc>& std::__cxx11::basic_ostringstream<_CharT, _Traits, _Alloc>::operator=(const std::__cxx11::basic_ostringstream<_CharT, _Traits, _Alloc>&) [with _CharT = char; _Traits = std::char_traits<char>; _Alloc = std::allocator<char>]'

I didn't find what else is missing, or if the python bindings are currently not buildable.

BROKEN: headers are not present between versions.

It looks like there are header files that are missing in v3/master that this lib is dependent on. variable.h one.

modsecurity/collection/variable.h exist in certain twaf8.5 branches and not others.

If you try to build off v3/master...
modsecurity/modsecurity.i:62: Error: Unable to find 'modsecurity/intervention.h'
modsecurity/modsecurity.i:63: Error: Unable to find 'modsecurity/collection/variable.h'
modsecurity/modsecurity.i:64: Error: Unable to find 'modsecurity/collection/collection.h'
modsecurity/modsecurity.i:65: Error: Unable to find 'modsecurity/collection/collections.h'
modsecurity/modsecurity.i:66: Error: Unable to find 'modsecurity/transaction.h'
modsecurity/modsecurity.i:67: Error: Unable to find 'modsecurity/debug_log.h'
modsecurity/modsecurity.i:68: Error: Unable to find 'modsecurity/modsecurity.h'
modsecurity/modsecurity.i:69: Error: Unable to find 'modsecurity/rules_properties.h'
modsecurity/modsecurity.i:70: Error: Unable to find 'modsecurity/rules.h'
modsecurity/modsecurity.i:71: Error: Unable to find 'modsecurity/rule.h'
Makefile:2: recipe for target 'all' failed
make: *** [all] Error 1

If you build off v3/twaf8.5-v3.0.0

make
swig -I/opt/libmodsec/usr/local/modsecurity/include/ -python -builtin -Wall -Wextra -c++ modsecurity/modsecurity.i
/usr/share/swig3.0/std/std_sstream.i:55: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig3.0/std/std_sstream.i:58: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig3.0/std/std_sstream.i:95: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig3.0/std/std_sstream.i:98: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig3.0/std/std_sstream.i:134: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig3.0/std/std_sstream.i:174: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig3.0/std/std_sstream.i:177: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig3.0/std/std_sstream.i:95: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig3.0/std/std_sstream.i:98: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig3.0/std/std_sstream.i:134: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig3.0/std/std_sstream.i:174: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig3.0/std/std_sstream.i:177: Warning 321: 'str' conflicts with a built-in name in python
/opt/libmodsec/usr/local/modsecurity/include/modsecurity/collection/collection.h:52: Warning 314: 'del' is a python keyword, renaming to '_del'
/opt/libmodsec/usr/local/modsecurity/include/modsecurity/collection/collection.h:115: Warning 314: 'del' is a python keyword, renaming to '_del'
/opt/libmodsec/usr/local/modsecurity/include/modsecurity/collection/collection.h:122: Warning 314: 'del' is a python keyword, renaming to '_del'
/opt/libmodsec/usr/local/modsecurity/include/modsecurity/collection/collections.h:47: Warning 401: Nothing known about base class 'std::unordered_map< std::string,Collection * >'. Ignored.
/opt/libmodsec/usr/local/modsecurity/include/modsecurity/collection/collections.h:47: Warning 401: Maybe you forgot to instantiate 'std::unordered_map< std::string,Collection * >' using %template.
/opt/libmodsec/usr/local/modsecurity/include/modsecurity/rules_properties.h:47: Warning 315: Nothing known about 'modsecurity::audit_log::AuditLog'.
python setup.py build_ext --inplace
*** found modsecurity at:
headers: /usr/local/modsecurity/include/
library: /usr/local/modsecurity/lib/
running build_ext
building '_modsecurity' extension
x86_64-linux-gnu-gcc -pthread -DNDEBUG -g -fwrapv -O2 -Wall -Wstrict-prototypes -fno-strict-aliasing -Wdate-time -D_FORTIFY_SOURCE=2 -g -fstack-protector-strong -Wformat -Werror=format-security -fPIC -I/usr/local/modsecurity/include/ -I. -I/usr/include/python2.7 -c modsecurity/modsecurity_wrap.cxx -o build/temp.linux-x86_64-2.7/modsecurity/modsecurity_wrap.o -std=c++11 -Wno-maybe-uninitialized
cc1plus: warning: command line option ‘-Wstrict-prototypes’ is valid for C/ObjC but not for C++
modsecurity/modsecurity_wrap.cxx:4595:45: fatal error: modsecurity/collection/variable.h: No such file or directory
compilation terminated.
error: command 'x86_64-linux-gnu-gcc' failed with exit status 1
Makefile:2: recipe for target 'all' failed
make: *** [all] Error 1
/opt/ModSecurity-Python-bindings# ls -la

Are python bindings dead? If so then this should be stated as such. There seems to be a lot of drift between versions.

META: Needs update for the latest version of libModSecurity

The bindings are a bit out dated and it will not compile against the latest version of libModSecurity. The lib has evolve to use some data structures that are not supported by swig. If support is not being added to swig we may consider to have this binding implemented using a different approach.

Add documentation

It would be cool to have a complete examples that shows how to:

1. Load rules
2. Run them against logs/attackes/whatever
3. Process/parse the results

Error build on CentOS 7x64

]# make
swig -I/root/testet/ModSecurity/headers/ -python -builtin -Wall -Wextra -c++ modsecurity/modsecurity.i
/usr/share/swig/2.0.10/std/std_sstream.i:55: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig/2.0.10/std/std_sstream.i:58: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig/2.0.10/std/std_sstream.i:95: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig/2.0.10/std/std_sstream.i:98: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig/2.0.10/std/std_sstream.i:134: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig/2.0.10/std/std_sstream.i:174: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig/2.0.10/std/std_sstream.i:177: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig/2.0.10/std/std_sstream.i:95: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig/2.0.10/std/std_sstream.i:98: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig/2.0.10/std/std_sstream.i:134: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig/2.0.10/std/std_sstream.i:174: Warning 321: 'str' conflicts with a built-in name in python
/usr/share/swig/2.0.10/std/std_sstream.i:177: Warning 321: 'str' conflicts with a built-in name in python
/root/testet/ModSecurity/headers/modsecurity/collection/collection.h:51: Warning 314: 'del' is a python keyword, renaming to '_del'
/root/testet/ModSecurity/headers/modsecurity/collection/collection.h:84: Warning 314: 'del' is a python keyword, renaming to '_del'
/root/testet/ModSecurity/headers/modsecurity/transaction.h:77: Error: Syntax error in input(1).
make: *** [all] Error 1

ModSecurity intsalled with https://github.com/SpiderLabs/ModSecurity/wiki/Compilation-recipes#centos-7-minimal

Fail to install

Hi!
I have a ubuntu Server with modsecurity 2.9.
I tryed to run the make command in ModSecurity-Python-bindings. The following errors ocurred:
swig -I/usr/local/modsecurity/include/ -python -builtin -Wall -Wextra -c++ modsecurity/modsecurity.i
modsecurity/modsecurity.i:62: Error: Unable to find 'modsecurity/intervention.h'
modsecurity/modsecurity.i:63: Error: Unable to find 'modsecurity/collection/variable.h'
modsecurity/modsecurity.i:64: Error: Unable to find 'modsecurity/collection/collection.h'
modsecurity/modsecurity.i:65: Error: Unable to find 'modsecurity/collection/collections.h'
modsecurity/modsecurity.i:66: Error: Unable to find 'modsecurity/transaction.h'
modsecurity/modsecurity.i:67: Error: Unable to find 'modsecurity/debug_log.h'
modsecurity/modsecurity.i:68: Error: Unable to find 'modsecurity/modsecurity.h'
modsecurity/modsecurity.i:69: Error: Unable to find 'modsecurity/rules_properties.h'
modsecurity/modsecurity.i:70: Error: Unable to find 'modsecurity/rules.h'
modsecurity/modsecurity.i:71: Error: Unable to find 'modsecurity/rule.h'

Can I do anything else?
Thanks!

Error while compiling: ‘GlobalVariables’ was not declared in this scope

When compiling against libmodsecurity https://github.com/SpiderLabs/ModSecurity/tree/1539a8c3efaf51f8109155df9a17e611fb04fd55 i get this error:

modsecurity/modsecurity_wrap.cxx: In function ‘int wrap_new_Collections(PyObject, PyObject_)’:
modsecurity/modsecurity_wrap.cxx:15036:3: error: ‘GlobalVariables’ was not declared in this scope
GlobalVariables *arg1 = (GlobalVariables *) 0 ;
^
modsecurity/modsecurity_wrap.cxx:15036:3: note: suggested alternative:
In file included from /usr/local/modsecurity/include/modsecurity/transaction/collections.h:30:0,
from modsecurity/modsecurity_wrap.cxx:4466:
/usr/local/modsecurity/include/modsecurity/transaction/global_variables.h:86:7: note: ‘modsecurity::transaction::GlobalVariables’
class GlobalVariables :
^

Embedding modsecurity to python-based web application honeypot

Hi, I just wanted to know if it possible to embed modsecurity in this python-based web application honeypot https://github.com/mushorg/snare. I would rather try embed the WAF rather than reverse proxy due to increased deception/generated attack data and ease of deployment using Docker (Basically creating a honeypot with enhanced deception/data collection capabilites).

The issue I'm having is that Snare honeypot starts its own aiohttp server, so I'm trying to figure if theres a workaround as all documentation points to Apache and NGINX implementations.