import mod_security_crs-3.3.4-1.el9

.gitignore

@@ -1 +1 @@
-SOURCES/v3.3.0.tar.gz
+SOURCES/v3.3.4.tar.gz

.mod_security_crs.metadata

@@ -1 +1 @@
-1f4002b5cf941a9172b6250cea7e3465a85ef6ee SOURCES/v3.3.0.tar.gz
+821796a48bbedd1a0d962614ef473625da85feae SOURCES/v3.3.4.tar.gz

SOURCES/mod_security_crs-early-blocking.patch

@@ -1,14 +1,8 @@
-commit 8acabc1806d3c9be5f781da978a7684639b257d8
-Author: Tomas Korbar <tkorbar@redhat.com>
-Date:   Thu Aug 4 12:13:03 2022 +0200
-
-    Add early blocking feature
-
 diff --git a/crs-setup.conf.example b/crs-setup.conf.example
-index 6e18996..08c719e 100644
+index b443e77..0fdd5cb 100644
 --- a/crs-setup.conf.example
 +++ b/crs-setup.conf.example
-@@ -233,7 +233,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
+@@ -234,7 +234,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
  
  
  #
@@ -17,7 +11,7 @@ index 6e18996..08c719e 100644
  #
  # Each rule in the CRS has an associated severity level.
  # These are the default scoring points for each severity level.
-@@ -269,7 +269,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
+@@ -270,7 +270,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
  
  
  #
@@ -26,7 +20,7 @@ index 6e18996..08c719e 100644
  #
  # Here, you can specify at which cumulative anomaly score an inbound request,
  # or outbound response, gets blocked.
-@@ -318,6 +318,35 @@ SecDefaultAction "phase:2,log,auditlog,pass"
+@@ -319,6 +319,35 @@ SecDefaultAction "phase:2,log,auditlog,pass"
  #  setvar:tx.outbound_anomaly_score_threshold=4"
  
  #
@@ -63,11 +57,11 @@ index 6e18996..08c719e 100644
  #
  # Some well-known applications may undertake actions that appear to be
 diff --git a/rules/REQUEST-901-INITIALIZATION.conf b/rules/REQUEST-901-INITIALIZATION.conf
-index 2a6f74e..b279829 100644
+index 5044abd..06a1bb3 100644
 --- a/rules/REQUEST-901-INITIALIZATION.conf
 +++ b/rules/REQUEST-901-INITIALIZATION.conf
-@@ -88,6 +88,15 @@ SecRule &TX:outbound_anomaly_score_threshold "@eq 0" \
+@@ -89,6 +89,15 @@ SecRule &TX:outbound_anomaly_score_threshold "@eq 0" \
-     ver:'OWASP_CRS/3.3.0',\
+     ver:'OWASP_CRS/3.3.4',\
      setvar:'tx.outbound_anomaly_score_threshold=4'"
  
 +# Default Blocking Early (rule 900120 in setup.conf)
@@ -83,10 +77,10 @@ index 2a6f74e..b279829 100644
  SecRule &TX:paranoia_level "@eq 0" \
      "id:901120,\
 diff --git a/rules/REQUEST-949-BLOCKING-EVALUATION.conf b/rules/REQUEST-949-BLOCKING-EVALUATION.conf
-index 5f370a1..338ce88 100644
+index 050eb04..755315f 100644
 --- a/rules/REQUEST-949-BLOCKING-EVALUATION.conf
 +++ b/rules/REQUEST-949-BLOCKING-EVALUATION.conf
-@@ -11,7 +11,66 @@
+@@ -12,7 +12,66 @@
  # -= Paranoia Level 0 (empty) =- (apply unconditionally)
  #
  
@@ -154,7 +148,7 @@ index 5f370a1..338ce88 100644
  
  # NOTE: tx.anomaly_score should not be set initially, but masking would lead to difficult bugs.
  # So we add to it.
-@@ -92,6 +151,21 @@ SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" \
+@@ -93,6 +152,21 @@ SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" \
      severity:'CRITICAL',\
      setvar:'tx.inbound_anomaly_score=%{tx.anomaly_score}'"
  
@@ -177,10 +171,10 @@ index 5f370a1..338ce88 100644
  
  SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 1" "id:949011,phase:1,pass,nolog,skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
 diff --git a/rules/RESPONSE-950-DATA-LEAKAGES.conf b/rules/RESPONSE-950-DATA-LEAKAGES.conf
-index c34607e..a192359 100644
+index 13013de..bf9b03d 100644
 --- a/rules/RESPONSE-950-DATA-LEAKAGES.conf
 +++ b/rules/RESPONSE-950-DATA-LEAKAGES.conf
-@@ -95,7 +95,7 @@ SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 2" "id:950014,phase:4,pass,nolog,skipAf
+@@ -96,7 +96,7 @@ SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 2" "id:950014,phase:4,pass,nolog,skipAf
  #
  SecRule RESPONSE_STATUS "@rx ^5\d{2}$" \
      "id:950100,\
@@ -190,10 +184,10 @@ index c34607e..a192359 100644
      capture,\
      t:none,\
 diff --git a/rules/RESPONSE-959-BLOCKING-EVALUATION.conf b/rules/RESPONSE-959-BLOCKING-EVALUATION.conf
-index 8f8114c..26b525c 100644
+index 24130eb..549c07c 100644
 --- a/rules/RESPONSE-959-BLOCKING-EVALUATION.conf
 +++ b/rules/RESPONSE-959-BLOCKING-EVALUATION.conf
-@@ -21,7 +21,67 @@
+@@ -22,7 +22,67 @@
  # -= Paranoia Level 0 (empty) =- (apply unconditionally)
  #
  
@@ -262,8 +256,8 @@ index 8f8114c..26b525c 100644
  
  # NOTE: tx.anomaly_score should not be set initially, but masking would lead to difficult bugs.
  # So we add to it.
-@@ -75,6 +135,21 @@ SecRule TX:OUTBOUND_ANOMALY_SCORE "@ge %{tx.outbound_anomaly_score_threshold}" \
+@@ -76,6 +136,21 @@ SecRule TX:OUTBOUND_ANOMALY_SCORE "@ge %{tx.outbound_anomaly_score_threshold}" \
-     ver:'OWASP_CRS/3.3.0',\
+     ver:'OWASP_CRS/3.3.4',\
      setvar:'tx.anomaly_score=+%{tx.outbound_anomaly_score}'"
  
 +SecRule TX:BLOCKING_EARLY "@eq 1" \

SPECS/mod_security_crs.spec

@@ -1,12 +1,12 @@
 Summary: ModSecurity Rules
 Name: mod_security_crs
-Version: 3.3.0
+Version: 3.3.4
-Release: 5%{?dist}
+Release: 1%{?dist}
 License: ASL 2.0
 URL: https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project
 Source: https://github.com/coreruleset/coreruleset/archive/refs/tags/v%{version}.tar.gz
 BuildArch: noarch
-Requires: mod_security >= 2.8.0
+Requires: mod_security >= 2.9.6
 Obsoletes: mod_security_crs-extras < 3.0.0
 Patch0: mod_security_crs-early-blocking.patch
 
@@ -29,7 +29,9 @@ install -d %{buildroot}%{_datarootdir}/mod_modsecurity_crs/rules
 mv rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/activated_rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
 mv rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/activated_rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
 
-install -m0644 rules/* %{buildroot}%{_datarootdir}/mod_modsecurity_crs/rules/
+install -m0644 rules/*.conf %{buildroot}%{_datarootdir}/mod_modsecurity_crs/rules/
+install -m0644 rules/*.data %{buildroot}%{_datarootdir}/mod_modsecurity_crs/rules/
+
 mv crs-setup.conf.example %{buildroot}%{_sysconfdir}/httpd/modsecurity.d/crs-setup.conf
 
 # activate base_rules
@@ -46,6 +48,14 @@ done
 %{_datarootdir}/mod_modsecurity_crs
 
 %changelog
+* Mon Dec 05 2022 Luboš Uhliarik <luhliari@redhat.com> - 3.3.4-1
+- new version 3.3.4
+- Resolves: #2143210 - [RFE] upgrade mod_security_crs to latest upstream 3.3.x
+
+* Wed Sep 07 2022 Tomas Korbar <tkorbar@redhat.com> - 3.3.0-6
+- Fix application of early blocking patch
+- Related: rhbz#2115313
+
 * Fri Aug 05 2022 Tomas Korbar <tkorbar@redhat.com> - 3.3.0-5
 - Fix patch for early blocking
 - Related: rhbz#2115313