{"action":"created","issue":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/384","repository_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs","labels_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/384/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/384/comments","events_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/384/events","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/384","id":162547643,"number":384,"title":"Improve ergonomics around setup not being loaded","user":{"login":"lifeforms","id":3464056,"avatar_url":"https://avatars.githubusercontent.com/u/3464056?v=3","gravatar_id":"","url":"https://api.github.com/users/lifeforms","html_url":"https://github.com/lifeforms","followers_url":"https://api.github.com/users/lifeforms/followers","following_url":"https://api.github.com/users/lifeforms/following{/other_user}","gists_url":"https://api.github.com/users/lifeforms/gists{/gist_id}","starred_url":"https://api.github.com/users/lifeforms/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lifeforms/subscriptions","organizations_url":"https://api.github.com/users/lifeforms/orgs","repos_url":"https://api.github.com/users/lifeforms/repos","events_url":"https://api.github.com/users/lifeforms/events{/privacy}","received_events_url":"https://api.github.com/users/lifeforms/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/labels/V3.0.0-rc1%20Development","name":"V3.0.0-rc1 Development","color":"bfe5bf"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":11,"created_at":"2016-06-27T21:02:56Z","updated_at":"2016-07-10T00:05:17Z","closed_at":"2016-07-10T00:05:17Z","body":"A user hit a problem with setup.conf being loaded last when all rules are in a single directory (#373). This caused CRS3 to behave weirdly. I've hit the same exact problem on FreeBSD when upgrading from CRS2 to CRS3 and needed help from Chaim to get it running :)\r\n\r\nI have always put my rule files in a single directory. The Apache `Include` directive is very limited, you can't use relative directories. This makes it hard to deploy a hierarchy of config files. Just dumping .conf files in a single directory however is easy. So I think many people will try to do it and run into trouble.\r\n\r\nWe can do ~~two~~ three things.\r\n\r\n1) Help the user debug a case where the setup.conf is not loaded. It shouldn't be necessary to go on Github with weird WAF behavior. In the example setup, we set a variable `tx.setup_done` at the bottom. At the top of the CRS rules, we check this variable and log an error message about installing the example setup.conf.\r\n\r\n2) Accommodate installations where all the rule files are in a single directory, by ensuring through file names that the files are loaded in the correct order (well, at least with Apache on Unix systems). We can achieve this by lowercasing `REQUEST-` and `RESPONSE-`. Since we want to rename the rule files to `9xx` anyway (#343), we can also lowercase the file names at the same time. In my opinion, there's no reason to use caps at all. Example: `REQUEST-33-APPLICATION-ATTACK-PHP.conf` -> `request-933-application-attack-php.conf`.\r\n\r\n3) ModSecurity on IIS and Nginx implements its own `Include` handling, which follows different ordering rules than Apache. It might not be possible to recommend including `*.conf` at all for these servers. Bundling a rule file which hardcodes an `Include` of all the rule files seems not possible either, as paths are taken relative to the Nginx configuration directory, and we don't know the actual CRS3 installation directory. We could describe this problem in installation instructions however."},"comment":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/comments/231562704","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/384#issuecomment-231562704","issue_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/384","id":231562704,"user":{"login":"csanders-git","id":4632287,"avatar_url":"https://avatars.githubusercontent.com/u/4632287?v=3","gravatar_id":"","url":"https://api.github.com/users/csanders-git","html_url":"https://github.com/csanders-git","followers_url":"https://api.github.com/users/csanders-git/followers","following_url":"https://api.github.com/users/csanders-git/following{/other_user}","gists_url":"https://api.github.com/users/csanders-git/gists{/gist_id}","starred_url":"https://api.github.com/users/csanders-git/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/csanders-git/subscriptions","organizations_url":"https://api.github.com/users/csanders-git/orgs","repos_url":"https://api.github.com/users/csanders-git/repos","events_url":"https://api.github.com/users/csanders-git/events{/privacy}","received_events_url":"https://api.github.com/users/csanders-git/received_events","type":"User","site_admin":false},"created_at":"2016-07-10T00:05:17Z","updated_at":"2016-07-10T00:05:17Z","body":"I'm going to close this as the new INSTALL outlines a solution to this even though it is pretty bad. I don't think we're gonna get any better than saying do not use '*' on IIS or NGinx"}}
{"actor":{"display_login":"csanders-git"}}