You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/includes/nap-waf/config/common/grpc-content-profiles.md
+2-2
Original file line number
Diff line number
Diff line change
@@ -94,12 +94,12 @@ The profile in this example enables checking of attack signatures and disallowed
94
94
95
95
The main IDL file, `album.proto` is marked as `primary`. The file it imports, `messages.proto`, is marked as secondary, i.e., `isPrimary` is `false` and so should be any imported file. In order for App Protect to be able to match it to the import statement, the file location should be specified as done in the example above using the `importUrl` property.
96
96
97
-
An alternative and probably more convenient way to specify all the IDL files, the primary and all its imports, direct and indirect, is to bundle them into a single tar file in the same directory structure as they are expected by the import statements. In this case, you will have to specify which of the files in the tarball is the primary one. The supported formats are `tar` and `tgz`. App Protect will identify the file type automatically (tar, gzipped tar, or JSON) and handle it accordingly. Following the above example:
97
+
An alternative and probably more convenient way to specify all the IDL files, the primary and all its imports, direct and indirect, is to bundle them into a single tar file in the same directory structure as they are expected by the import statements. In this case, you will have to specify which of the files in the tarball is the primary one. The supported formats are `tar` and `tar.gz`. App Protect will identify the file type automatically (tar, gzipped tar, or JSON) and handle it accordingly. Following the above example:
In this setup, copy your compiled policy and logging profile bundles to `/mnt/nap5_bundles_pv_data` on a cluster node. Make sure that input files are accessible to UID 101. Then, in your NGINX configuration, refer to these files from `/etc/app_protect/bundles`.
2
2
3
-
For example, to apply `custom_policy.tgz` that you've placed in `/mnt/nap5_bundles_pv_data/`, use:
3
+
For example, to apply `custom_policy.tar.gz` that you've placed in `/mnt/nap5_bundles_pv_data/`, use:
Copy file name to clipboardExpand all lines: content/nap-waf/v4/admin-guide/upgrade-nap-waf.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -22,7 +22,7 @@ For details on matching NGINX App Protect WAF releases with their WAF compiler v
22
22
23
23
## Upgrade NGINX App Protect on the Data Plane
24
24
25
-
Before you start, make sure you're using NGINX Management Suite for your policy management. Your NGINX configuration should be set up to use WAF policies with a _.tgz_ extension.
25
+
Before you start, make sure you're using NGINX Management Suite for your policy management. Your NGINX configuration should be set up to use WAF policies with a _.tar.gz_ extension.
26
26
27
27
To update NGINX App Protect on an NGINX data plane instance, follow these steps:
However, to utilize multiple policy bundles within a single NGINX configuration, it's necessary to supply a [global settings](#global-settings) JSON file. This ensures that all bundles have a common foundation, including cookie seed, user-defined signatures, and more.
@@ -153,7 +153,7 @@ Compilation with global settings:
Using `-include-source`, you can incorporate the source of the policy (as `policy.json`) or logging profile (as `logging_profile.json`) into the final bundle. This process transforms any configuration that relies on external references into an inline configuration within the bundled source. Furthermore, when `-include-source` is combined with `-full-export`, the policy.json within the bundle will contain the entire source policy, including any default settings from the base template.
@@ -162,7 +162,7 @@ Using `-include-source`, you can incorporate the source of the policy (as `polic
Copy file name to clipboardExpand all lines: content/nap-waf/v5/admin-guide/overview.md
+3-3
Original file line number
Diff line number
Diff line change
@@ -83,7 +83,7 @@ We recommend that you deploy the NGINX App Protect WAF v5 in a staging environme
83
83
-[Deploying NGINX App Protect WAF on Docker]({{<ref "/nap-waf/v5/admin-guide/deploy-on-docker.md">}})
84
84
-[Deploying NGINX App Protect WAF on Kubernetes]({{<ref "/nap-waf/v5/admin-guide/deploy-with-helm.md">}})
85
85
86
-
1. Compile your `.json` policies and logging profiles to `.tgz` bundles using [compiler-image]({{<ref "/nap-waf/v5/admin-guide/compiler.md">}}) because NGINX App Protect WAF v5 supports policies and logging profiles in a compiled bundle format only.
86
+
1. Compile your `.json` policies and logging profiles to `.tar.gz` bundles using [compiler-image]({{<ref "/nap-waf/v5/admin-guide/compiler.md">}}) because NGINX App Protect WAF v5 supports policies and logging profiles in a compiled bundle format only.
87
87
88
88
{{< note >}}
89
89
If you were previously using a default [logging profile]({{<ref "/nap-waf/v5/admin-guide/deploy-on-docker.md#using-policy-and-logging-profile-bundles">}}) JSON like `/opt/app_protect/share/defaults/log_all.json`, you can replace it with the default constant such as `log_all`, and then you will not need to explicitly compile the logging profile into a bundle.
@@ -94,9 +94,9 @@ We recommend that you deploy the NGINX App Protect WAF v5 in a staging environme
94
94
95
95
{{< /note >}}
96
96
97
-
1. Replace the `.json` references in nginx.conf with the above created `.tgz`[bundles]({{<ref "/nap-waf/v5/admin-guide/install.md#using-policy-and-logging-profile-bundles">}}).
97
+
1. Replace the `.json` references in nginx.conf with the above created `.tar.gz`[bundles]({{<ref "/nap-waf/v5/admin-guide/install.md#using-policy-and-logging-profile-bundles">}}).
98
98
99
-
1. Make sure that `.tgz` bundles references are accessible to the `waf-config-mgr` container.
99
+
1. Make sure that `.tar.gz` bundles references are accessible to the `waf-config-mgr` container.
100
100
101
101
1. Restart the deployment if it has already been initiated. Additionally, restart NGINX if utilizing the VM + containers deployment type. After the migrations, check that the NGINX process is running in the NGINX error log and there are no issues.
Copy file name to clipboardExpand all lines: content/nap-waf/v5/admin-guide/upgrade-nap-waf.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -25,7 +25,7 @@ For details on matching NGINX App Protect WAF releases with their WAF compiler v
25
25
26
26
## Upgrade NGINX App Protect on the Data Plane
27
27
28
-
Before you start, make sure you're using NGINX Management Suite for your policy management. Your NGINX configuration should be set up to use WAF policies with a _.tgz_ extension.
28
+
Before you start, make sure you're using NGINX Management Suite for your policy management. Your NGINX configuration should be set up to use WAF policies with a _.tar.gz_ extension.
29
29
30
30
To update NGINX App Protect on an NGINX data plane instance, follow these steps:
Copy file name to clipboardExpand all lines: content/nap-waf/v5/configuration-guide/configuration.md
+9-9
Original file line number
Diff line number
Diff line change
@@ -71,7 +71,7 @@ See [signature sets](#signature-sets) for configuring the signature sets include
71
71
72
72
### Policy Configuration Overview
73
73
74
-
The NGINX App Protect WAF security policy configuration uses the declarative format based on a pre-defined base template. The policy is represented in a JSON file which you can edit to add, modify and remove security capabilities with respect to the base template. The JSON file then should be compiled to a bundle file (`.tgz`) using the [NGINX App Protect WAF Compiler]({{< ref "/nap-waf/v5/admin-guide/compiler.md" >}}). The way the policy is integrated into the NGINX configuration is via referencing the bundle file (using the full path) in the `nginx.conf` file.
74
+
The NGINX App Protect WAF security policy configuration uses the declarative format based on a pre-defined base template. The policy is represented in a JSON file which you can edit to add, modify and remove security capabilities with respect to the base template. The JSON file then should be compiled to a bundle file (`.tar.gz`) using the [NGINX App Protect WAF Compiler]({{< ref "/nap-waf/v5/admin-guide/compiler.md" >}}). The way the policy is integrated into the NGINX configuration is via referencing the bundle file (using the full path) in the `nginx.conf` file.
75
75
76
76
Refer to the [admin guide]({{< ref "/nap-waf/v5/admin-guide/install.md#using-policy-and-logging-profile-bundles" >}}) for instructions on how to mount bundle files to your deployment.
77
77
@@ -89,7 +89,7 @@ Replace the `1.0.0` with the version you use.
89
89
90
90
This script will output the schema to a file named `policy.json` into the current working directory. Once the schema file is generated, you can use validation tools such as [AJV](https://ajv.js.org/standalone.html) to validate a JSON policy file.
91
91
92
-
In the following example, the NGINX configuration file with App Protect enabled in the HTTP context and the policy `/policies/policy1.tgz` is used:
92
+
In the following example, the NGINX configuration file with App Protect enabled in the HTTP context and the policy `/policies/policy1.tar.gz` is used:
93
93
94
94
```nginx
95
95
user nginx;
@@ -110,9 +110,9 @@ http {
110
110
keepalive_timeout 65;
111
111
112
112
app_protect_enable on; # This is how you enable NGINX App Protect WAF in the relevant context/block
113
-
app_protect_policy_file "/etc/app_protect/conf/policy1.tgz"; # This is a reference to the policy bundle file to use. If not defined, the default policy is used
113
+
app_protect_policy_file "/etc/app_protect/conf/policy1.tar.gz"; # This is a reference to the policy bundle file to use. If not defined, the default policy is used
114
114
app_protect_security_log_enable on; # This section enables the logging capability
115
-
app_protect_security_log "/etc/app_protect/conf/log_all.tgz" syslog:server=127.0.0.1:514; # This is where the remote logger is defined in terms of: logging options (defined in the referenced file), log server IP, log server port
115
+
app_protect_security_log "/etc/app_protect/conf/log_all.tar.gz" syslog:server=127.0.0.1:514; # This is where the remote logger is defined in terms of: logging options (defined in the referenced file), log server IP, log server port
116
116
117
117
server {
118
118
listen 80;
@@ -177,7 +177,7 @@ For instance, to create an updated version of the `app_protect_default_policy`,
@@ -976,9 +976,9 @@ This table summarizes the nginx.conf directives for NGINX App Protect WAF functi
976
976
|load_module | load_module <library_file_path> | NGINX directive to load the App Protect module. It must be invoked with the App Protect library path | Global | load_module modules/ngx_http_app_protect_module.so |
977
977
|app_protect_enforcer_address | <hostname/ip>:<port> | The Enforcer service address. | HTTP | app_protect_enforcer_address 127.0.0.1:50000; |
978
978
|app_protect_enable | app_protect_enable on | off | Whether to enable App Protect at the respective context. If not present, inherits from the parent context | HTTP, Server, Location | app_protect_enable on |
979
-
|app_protect_policy_file | app_protect_policy_file <file_path> | Set a App Protect policy configuring behavior for the respective context. | HTTP, Server, Location | app_protect_policy_file /config/waf/strict_policy.tgz|
979
+
|app_protect_policy_file | app_protect_policy_file <file_path> | Set a App Protect policy configuring behavior for the respective context. | HTTP, Server, Location | app_protect_policy_file /config/waf/strict_policy.tar.gz|
980
980
|app_protect_security_log_enable | app_protect_security_log_enable on | off | Whether to enable the App Protect per-request log at the respective context. | HTTP, Server, Location | app_protect_security_log_enable on |
981
-
|app_protect_security_log | app_protect_security_log <file_path> <destination> | Specifies the per-request logging: what to log and where | HTTP, Server, Location | app_protect_security_log /config/waf/log_illegal.tgz syslog:localhost:522 |
981
+
|app_protect_security_log | app_protect_security_log <file_path> <destination> | Specifies the per-request logging: what to log and where | HTTP, Server, Location | app_protect_security_log /config/waf/log_illegal.tar.gz syslog:localhost:522 |
982
982
|app_protect_custom_log_attribute | app_protect_custom_log_attribute <key_value> | Specifies the assigned location/server/http dimension of each request. | HTTP, Server, Location | app_protect_custom_log_attribute ‘environment' 'env1' |
Copy file name to clipboardExpand all lines: content/nap-waf/v5/logging-overview/security-log.md
+4-4
Original file line number
Diff line number
Diff line change
@@ -18,7 +18,7 @@ NGINX App Protect WAF uses its own logging mechanism for request logging rather
18
18
19
19
The Security log has the following properties:
20
20
21
-
***Log Configuration**: `app_protect_security_log` directive referencing a custom logging profile bundle file (tgz) or a built-in logging profile name, for example - `log_all`.
21
+
***Log Configuration**: `app_protect_security_log` directive referencing a custom logging profile bundle file (tar.gz) or a built-in logging profile name, for example - `log_all`.
Before applying, the log configuration file (JSON) should be [compiled]({{< ref "/nap-waf/v5/admin-guide/compiler.md#logging-profile-compilation" >}}) into a logging profile bundle (tgz).
80
+
Before applying, the log configuration file (JSON) should be [compiled]({{< ref "/nap-waf/v5/admin-guide/compiler.md#logging-profile-compilation" >}}) into a logging profile bundle (tar.gz).
81
81
82
82
The file is in JSON format and consists of two parts:
0 commit comments