[packages/nginx-mod_http_modsecurity_crs] - local exclusion hooks: REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf and RESPONSE-999-EXCLUSION-RULE

[arekm]

commit f8c4604b86fd51d24de8ae146d4d2fd4c299ecbd
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date:   Sat Sep 12 00:48:36 2026 +0200

    - local exclusion hooks: REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf and RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
    - rel 2

 REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf | 10 ++++++++++
 RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf |  6 ++++++
 nginx-mod_http_modsecurity_crs.conf         |  5 ++++-
 nginx-mod_http_modsecurity_crs.spec         |  7 ++++++-
 4 files changed, 26 insertions(+), 2 deletions(-)
---
diff --git a/nginx-mod_http_modsecurity_crs.spec b/nginx-mod_http_modsecurity_crs.spec
index 3264422..e15bd7a 100644
--- a/nginx-mod_http_modsecurity_crs.spec
+++ b/nginx-mod_http_modsecurity_crs.spec
@@ -3,10 +3,12 @@ Summary(pl.UTF-8):	Aktywacja OWASP Core Rule Set dla modułu ModSecurity nginx-a
 Name:		nginx-mod_http_modsecurity_crs
 # loader layout follows CRS 4 (plugins/*-{config,before,after}.conf), not a CRS release
 Version:	4.0
-Release:	1
+Release:	2
 License:	Apache v2.0
 Group:		Daemons
 Source0:	%{name}.conf
+Source1:	REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
+Source2:	RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
 URL:		https://coreruleset.org/
 # crs-setup.conf.example is copied at build time
 BuildRequires:	modsecurity-crs >= 4
@@ -42,6 +44,7 @@ install -d $RPM_BUILD_ROOT%{_sysconfdir}/modsecurity/rules.d
 cp -p %{SOURCE0} $RPM_BUILD_ROOT%{_sysconfdir}/modsecurity/rules.d/10_crs.conf
 # rule 901001 rejects every request unless a setup file is loaded before rules/
 cp -p %{_datadir}/modsecurity-crs/crs-setup.conf.example $RPM_BUILD_ROOT%{_sysconfdir}/modsecurity/crs-setup.conf
+cp -p %{SOURCE1} %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/modsecurity
 
 %clean
 rm -rf $RPM_BUILD_ROOT
@@ -57,4 +60,6 @@ fi
 %files
 %defattr(644,root,root,755)
 %attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/modsecurity/crs-setup.conf
+%attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/modsecurity/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
+%attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/modsecurity/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
 %attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) %{_sysconfdir}/modsecurity/rules.d/10_crs.conf
diff --git a/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf b/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
new file mode 100644
index 0000000..9e909e1
--- /dev/null
+++ b/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
@@ -0,0 +1,10 @@
+# Local rule exclusions evaluated BEFORE the CRS rules (loaded right after
+# crs-setup.conf and the plugins). Use this file for runtime exclusions with
+# ctl: actions, which must run before the rule they modify, e.g.
+#
+#   SecRule REQUEST_URI "@beginsWith /api/upload" \
+#       "id:10001,phase:1,pass,nolog,ctl:ruleRemoveById=920420"
+#   SecRule REQUEST_HEADERS:User-Agent "@endsWith (internal dummy connection)" \
+#       "id:10002,phase:1,pass,nolog,ctl:ruleEngine=Off"
+#
+# Use ids in the 1-99999 range; they are reserved for local rules.
diff --git a/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf b/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
new file mode 100644
index 0000000..97234c2
--- /dev/null
+++ b/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
@@ -0,0 +1,6 @@
+# Local rule exclusions evaluated AFTER the CRS rules are loaded. Use this file
+# for configure-time exclusions, which need the rule to exist already, e.g.
+#
+#   SecRuleRemoveById 950130
+#   SecRuleUpdateTargetById 942100 "!ARGS:password"
+#   SecRuleRemoveByTag "attack-protocol"
diff --git a/nginx-mod_http_modsecurity_crs.conf b/nginx-mod_http_modsecurity_crs.conf
index 5c9e23e..960fb88 100644
--- a/nginx-mod_http_modsecurity_crs.conf
+++ b/nginx-mod_http_modsecurity_crs.conf
@@ -1,7 +1,10 @@
 # OWASP Core Rule Set (modsecurity-crs) for nginx ModSecurity.
-# Order required by CRS: setup, plugin config, plugin before-rules, rules, plugin after-rules.
+# Order required by CRS: setup, plugin config, plugin before-rules, local before-rules,
+# rules, plugin after-rules, local after-rules.
 Include /etc/nginx/modsecurity/crs-setup.conf
 Include /usr/share/modsecurity-crs/plugins/*-config.conf
 Include /usr/share/modsecurity-crs/plugins/*-before.conf
+Include /etc/nginx/modsecurity/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
 Include /usr/share/modsecurity-crs/rules/*.conf
 Include /usr/share/modsecurity-crs/plugins/*-after.conf
+Include /etc/nginx/modsecurity/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/nginx-mod_http_modsecurity_crs.git/commitdiff/f8c4604b86fd51d24de8ae146d4d2fd4c299ecbd