8000 Add cli argument to configure NAP log level (#2479) · nginx/kubernetes-ingress@b5b4d1f · GitHub
[go: up one dir, main page]
Skip to content

Commit b5b4d1f

Browse files
galitskiygalitskiy
authored
Add cli argument to configure NAP log level (#2479)
1 parent 6c888d3 commit b5b4d1f

File tree

9 files changed

+91
-31
lines changed

9 files changed

+91
-31
lines changed

‎build/Dockerfile‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -219,16 +219,6 @@ RUN --mount=target=/tmp [ -n "${BUILD_OS##*plus*}" ] && exit 0; mkdir -p etc/ngi
219219
RUN --mount=target=/tmp [ -n "${NAP_MODULES##*waf*}" ] && exit 0; mkdir -p /etc/nginx/waf/nac-policies /etc/nginx/waf/nac-logconfs /etc/nginx/waf/nac-usersigs /var/log/app_protect /opt/app_protect \
220220
&& chown -R nginx:0 /etc/app_protect /usr/share/ts /var/log/app_protect/ /opt/app_protect/ /var/log/nginx/ \
221221
&& touch /etc/nginx/waf/nac-usersigs/index.conf \
222-
&& printf "%s\n" "MODULE = ALL;" "LOG_LEVEL = TS_CRIT;" "FILE = 2;" > /etc/app_protect/bd/logger.cfg \
223-
&& printf "%s\n" "[config_set_compiler]" "log_level=fatal" >> /etc/app_protect/tools/asm_logging.conf \
224-
&& for v in \
225-
asm_config_server \
226-
lock_factory \
227-
bd_agent \
228-
import_export_policy \
229-
set_active \
230-
; do sed -i "/\[$v/a log_level=fatal" "/etc/app_protect/tools/asm_logging.conf" \
231-
; done \
232222
&& cp -a /tmp/build/log-default.json /etc/nginx
233223

234224
# run only on nap dos build

‎cmd/nginx-ingress/main.go‎

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,9 @@ var (
7171

7272
appProtect = flag.Bool("enable-app-protect", false, "Enable support for NGINX App Protect. Requires -nginx-plus.")
7373

74+
appProtectLogLevel = flag.String("app-protect-log-level", appProtectLogLevelDefault,
75+
`Sets log level for App Protect. Allowed values: fatal, error, warn, info, debug, trace. Requires -nginx-plus and -enable-app-protect.`)
76+
7477
appProtectDos = flag.Bool("enable-app-protect-dos", false, "Enable support for NGINX App Protect dos. Requires -nginx-plus.")
7578

7679
appProtectDosDebug = flag.Bool("app-protect-dos-debug", false, "Enable debugging for App Protect Dos. Requires -nginx-plus and -enable-app-protect-dos.")
@@ -248,6 +251,17 @@ func main() {
248251
glog.Fatal("NGINX App Protect support is for NGINX Plus only")
249252
}
250253

254+
if *appProtectLogLevel != appProtectLogLevelDefault && !*appProtect && !*nginxPlus {
255+
glog.Fatal("app-protect-log-level support is for NGINX Plus only and App Protect is enable")
256+
}
257+
258+
if *appProtectLogLevel != appProtectLogLevelDefault && *appProtect && *nginxPlus {
259+
logLevelValidationError := validateAppProtectLogLevel(*appProtectLogLevel)
260+
if logLevelValidationError != nil {
261+
glog.Fatalf("Invalid value for app-protect-log-level: %v", *appProtectLogLevel)
262+
}
263+
}
264+
251265
if *appProtectDos && !*nginxPlus {
252266
glog.Fatal("NGINX App Protect Dos support is for NGINX Plus only")
253267
}
@@ -449,7 +463,7 @@ func main() {
449463
aPPluginDone = make(chan error, 1)
450464
aPAgentDone = make(chan error, 1)
451465

452-
nginxManager.AppProtectAgentStart(aPAgentDone, *nginxDebug)
466+
nginxManager.AppProtectAgentStart(aPAgentDone, *appProtectLogLevel)
453467
nginxManager.AppProtectPluginStart(aPPluginDone)
454468
}
455469

@@ -783,6 +797,23 @@ func validatePort(port int) error {
783797
return nil
784798
}
785799

800+
const appProtectLogLevelDefault = "fatal"
801+
802+
// validateAppProtectLogLevel makes sure a given logLevel is one of the allowed values
803+
func validateAppProtectLogLevel(logLevel string) error {
804+
switch strings.ToLower(logLevel) {
805+
case
806+
"fatal",
807+
"error",
808+
"warn",
809+
"info",
810+
"debug",
811+
"trace":
812+
return nil
813+
}
814+
return fmt.Errorf("invalid App Protect log level: %v", logLevel)
815+
}
816+
786817
// parseNginxStatusAllowCIDRs converts a comma separated CIDR/IP address string into an array of CIDR/IP addresses.
787818
// It returns an array of the valid CIDR/IP addresses or an error if given an invalid address.
788819
func parseNginxStatusAllowCIDRs(input string) (cidrs []string, err error) {

‎cmd/nginx-ingress/main_test.go‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,3 +123,33 @@ func TestValidateLocation(t *testing.T) {
123123
}
124124
}
125125
}
126+
127+
func TestValidateAppProtectLogLevel(t *testing.T) {
128+
badLogLevels := []string{
129+
"",
130+
"critical",
131+
"none",
132+
"info;",
133+
}
134+
for _, badLogLevel := range badLogLevels {
135+
err := validateAppProtectLogLevel(badLogLevel)
136+
if err == nil {
137+
t.Errorf("validateAppProtectLogLevel(%v) returned no error when it should have returned an error", badLogLevel)
138+
}
139+
}
140+
141+
goodLogLevels := []string{
142+
"fatal",
143+
"Error",
144+
"WARN",
145+
"info",
146+
"debug",
147+
"trace",
148+
}
149+
for _, goodLogLevel := range goodLogLevels {
150+
err := validateAppProtectLogLevel(goodLogLevel)
151+
if err != nil {
152+
t.Errorf("validateAppProtectLogLevel(%v) returned an error when it should have returned no error: %v", goodLogLevel, err)
153+
}
154+
}
155+
}

‎deployments/helm-chart/templates/controller-daemonset.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,9 @@ spec:
105105
- -nginx-plus={{ .Values.controller.nginxplus }}
106106
- -nginx-reload-timeout={{ .Values.controller.nginxReloadTimeout }}
107107
- -enable-app-protect={{ .Values.controller.appprotect.enable }}
108+
{{- if and .Values.controller.appprotect.enable .Values.controller.appprotect.logLevel }}
109+
- -app-protect-log-level={{ .Values.controller.appprotect.logLevel }}
110+
{{ end }}
108111
- -enable-app-protect-dos={{ .Values.controller.appprotectdos.enable }}
109112
{{- if .Values.controller.appprotectdos.enable }}
110113
- -app-protect-dos-debug={{ .Values.controller.appprotectdos.debug }}

‎deployments/helm-chart/templates/controller-deployment.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,9 @@ spec:
103103
- -nginx-plus={{ .Values.controller.nginxplus }}
104104
- -nginx-reload-timeout={{ .Values.controller.nginxReloadTimeout }}
105105
- -enable-app-protect={{ .Values.controller.appprotect.enable }}
106+
{{- if and .Values.controller.appprotect.enable .Values.controller.appprotect.logLevel }}
107+
- -app-protect-log-level={{ .Values.controller.appprotect.logLevel }}
108+
{{ end }}
106109
- -enable-app-protect-dos={{ .Values.controller.appprotectdos.enable }}
107110
{{- if .Values.controller.appprotectdos.enable }}
108111
- -app-protect-dos-debug={{ .Values.controller.appprotectdos.debug }}

‎deployments/helm-chart/values.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ controller:
1616
appprotect:
1717
## Enable the App Protect module in the Ingress Controller.
1818
enable: false
19+
## Sets log level for App Protect. Allowed values: fatal, error, warn, info, debug, trace
20+
# logLevel: fatal
1921

2022
## Support for App Protect Dos
2123
appprotectdos:

‎docs/content/configuration/global-configuration/command-line-arguments.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -337,6 +337,17 @@ Requires [-nginx-plus](#cmdoption-nginx-plus).
337337

338338
* If the argument is set, but `nginx-plus` is set to false, the Ingress Controller will fail to start.
339339

340+
 
341+
<a name="cmdoption-app-protect-log-level"></a.>
342+
343+
### -app-protect-log-level `<string>`
344+
345+
Sets log level for App Protect. Allowed values: fatal, error, warn, info, debug, trace.
346+
347+
Requires [-nginx-plus](#cmdoption-nginx-plus) and [-enable-app-protect](#cmdoption-enable-app-protect).
348+
349+
* If the argument is set, but `nginx-plus` and `enable-app-protect` are set to false, the Ingress Controller will fail to start.
350+
340351
&nbsp;
341352
<a name="cmdoption-enable-app-protect-dos"></a>
342353

‎internal/nginx/fake_manager.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -151,7 +151,7 @@ func (*FakeManager) SetOpenTracing(_ bool) {
151151
}
152152

153153
// AppProtectAgentStart is a fake implementation of AppProtectAgentStart
154-
func (*FakeManager) AppProtectAgentStart(_ chan error, _ bool) {
154+
func (*FakeManager) AppProtectAgentStart(_ chan error, _ string) {
155155
glog.V(3).Infof("Starting FakeAppProtectAgent")
156156
}
157157

‎internal/nginx/manager.go‎

Lines changed: 9 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -32,16 +32,11 @@ const (
3232

3333
appProtectPluginStartCmd = "/usr/share/ts/bin/bd-socket-plugin"
3434
appProtectAgentStartCmd = "/opt/app_protect/bin/bd_agent"
35+
appProtectLogLevelCmd = "/opt/app_protect/bin/set_log_level"
3536

3637
// appPluginParams is the configuration of App-Protect plugin
3738
appPluginParams = "tmm_count 4 proc_cpuinfo_cpu_mhz 2000000 total_xml_memory 307200000 total_umu_max_size 3129344 sys_max_account_id 1024 no_static_config"
3839

39-
// appProtectDebugLogConfigFileContent holds the content of the file to be written when nginx debug is enabled. It will enable NGINX App Protect debug logs
40-
appProtectDebugLogConfigFileContent = "MODULE = IO_PLUGIN;\nLOG_LEVEL = TS_INFO | TS_DEBUG;\nFILE = 2;\nMODULE = ECARD_POLICY;\nLOG_LEVEL = TS_INFO | TS_DEBUG;\nFILE = 2;\n"
41-
42-
// appProtectLogConfigFileName is the location of the NGINX App Protect logging configuration file
43-
appProtectLogConfigFileName = "/etc/app_protect/bd/logger.cfg"
44-
4540
appProtectDosAgentInstallCmd = "/usr/bin/adminstall"
4641
appProtectDosAgentStartCmd = "/usr/bin/admd -d --standalone"
4742
appProtectDosAgentStartDebugCmd = "/usr/bin/admd -d --standalone --log debug"
@@ -81,7 +76,7 @@ type Manager interface {
8176
UpdateServersInPlus(upstream string, servers []string, config ServerConfig) error
8277
UpdateStreamServersInPlus(upstream string, servers []string) error
8378
SetOpenTracing(openTracing bool)
84-
AppProtectAgentStart(apaDone chan error, debug bool)
79+
AppProtectAgentStart(apaDone chan error, logLevel string)
8580
AppProtectAgentQuit()
8681
AppProtectPluginStart(appDone chan error)
8782
AppProtectPluginQuit()
@@ -461,20 +456,15 @@ func (lm *LocalManager) SetOpenTracing(openTracing bool) {
461456
}
462457

463458
// AppProtectAgentStart starts the AppProtect agent
464-
func (lm *LocalManager) AppProtectAgentStart(apaDone chan error, debug bool) {
465-
if debug {
466-
glog.V(3).Info("Starting AppProtect Agent in debug mode")
467-
err := os.Remove(appProtectLogConfigFileName)
468-
if err != nil {
469-
glog.Fatalf("Failed removing App Protect Log configuration file")
470-
}
471-
err = createFileAndWrite(appProtectLogConfigFileName, []byte(appProtectDebugLogConfigFileContent))
472-
if err != nil {
473-
glog.Fatalf("Failed Writing App Protect Log configuration file")
474-
}
459+
func (lm *LocalManager) AppProtectAgentStart(apaDone chan error, logLevel string) {
460+
glog.V(3).Info("Setting log level for App Protect - ", logLevel)
461+
appProtectLogLevelCmdfull := fmt.Sprintf("%v %v", appProtectLogLevelCmd, logLevel)
462+
logLevelCmd := exec.Command("sh", "-c", appProtectLogLevelCmdfull) // #nosec G204
463+
if err := logLevelCmd.Run(); err != nil {
464+
glog.Fatalf("Failed to set log level for AppProtect: %v", err)
475465
}
476-
glog.V(3).Info("Starting AppProtect Agent")
477466

467+
glog.V(3).Info("Starting AppProtect Agent")
478468
cmd := exec.Command(appProtectAgentStartCmd)
479469
if err := cmd.Start(); err != nil {
480470
glog.Fatalf("Failed to start AppProtect Agent: %v", err)

0 commit comments

Comments
 (0)
0