diff options
Diffstat (limited to 'doc/source/config.rst')
| -rw-r--r-- | doc/source/config.rst | 24 |
1 files changed, 11 insertions, 13 deletions
diff --git a/doc/source/config.rst b/doc/source/config.rst index 525885f..64d3591 100644 --- a/doc/source/config.rst +++ b/doc/source/config.rst | |||
| @@ -11,15 +11,15 @@ Configuration | |||
| 11 | read the present documentation about how to configure them, | 11 | read the present documentation about how to configure them, |
| 12 | evaluate your threat model and write your configuration file accordingly. | 12 | evaluate your threat model and write your configuration file accordingly. |
| 13 | 13 | ||
| 14 | Since PHP *ini-like* configuration model isn't flexible enough, | 14 | Since PHP *ini-like* configuration model isn't flexible enough for our |
| 15 | Snuffleupagus is using its own format in the file specified by | 15 | usecases, Snuffleupagus is using its own format in the file specified by |
| 16 | the directive ``sp.configuration_file`` **in** your ``php.ini`` file, | 16 | the directive ``sp.configuration_file`` **in** your ``php.ini`` file, |
| 17 | like ``sp.configuration_file=/etc/php/conf.d/snuffleupagus.rules``. | 17 | like ``sp.configuration_file=/etc/php/conf.d/snuffleupagus.rules``. |
| 18 | 18 | ||
| 19 | You can use the ``,`` separator to include multiple configuration files: | 19 | You can use the ``,`` separator to include multiple configuration files: |
| 20 | ``sp.configuration_file=/etc/php/conf.d/snuffleupagus.rules,/etc/php/conf.d/sp_wordpress.rules``. | 20 | ``sp.configuration_file=/etc/php/conf.d/snuffleupagus.rules,/etc/php/conf.d/sp_wordpress.rules``. |
| 21 | 21 | ||
| 22 | We're also also supporting `glob <https://en.wikipedia.org/wiki/Glob_%28programming%29>`__, | 22 | It also supports `glob <https://en.wikipedia.org/wiki/Glob_%28programming%29>`__, |
| 23 | so you can write something like: | 23 | so you can write something like: |
| 24 | ``sp.configuration_file=/etc/php/conf.d/*.rules,/etc/php/conf.d/extra/test.rules``. | 24 | ``sp.configuration_file=/etc/php/conf.d/*.rules,/etc/php/conf.d/extra/test.rules``. |
| 25 | 25 | ||
| @@ -32,9 +32,9 @@ To sum up, you should put this in your ``php.ini``: | |||
| 32 | 32 | ||
| 33 | And the **snuffleupagus rules** into the ``.rules`` files. | 33 | And the **snuffleupagus rules** into the ``.rules`` files. |
| 34 | 34 | ||
| 35 | Since our configuration format is a bit more complex than php's one, | 35 | Since the configuration format is a bit more complex than php's one, |
| 36 | we have a ``sp.allow_broken_configuration`` parameter (``false`` by default), | 36 | their is a ``sp.allow_broken_configuration`` parameter (``false`` by default), |
| 37 | that you can set to ``true`` if you want PHP to carry on if your Snuffleupagus' | 37 | that can be set to ``true`` if you want PHP to carry on if your Snuffleupagus' |
| 38 | configuration contains syntax errors. You'll still get a big scary message in | 38 | configuration contains syntax errors. You'll still get a big scary message in |
| 39 | your logs of course. We do **not** recommend to use it of course, but sometimes | 39 | your logs of course. We do **not** recommend to use it of course, but sometimes |
| 40 | it might be useful to be able to "debug in production" without breaking your | 40 | it might be useful to be able to "debug in production" without breaking your |
| @@ -45,23 +45,23 @@ Configuration file format | |||
| 45 | 45 | ||
| 46 | Options are chainable by using dots (``.``). | 46 | Options are chainable by using dots (``.``). |
| 47 | 47 | ||
| 48 | Some options have a string parameter, that **must** be quoted with double quotes, e.g. ``"string"``. | 48 | String parameters **must** be quoted with double quotes, e.g. ``"string"``. |
| 49 | 49 | ||
| 50 | Comments are prefixed either with ``#``, or ``;``. | 50 | Comments are prefixed either with ``#``, or ``;``. |
| 51 | 51 | ||
| 52 | Some rules apply in a specific ``function`` (context) on a specific ``variable`` | 52 | Some rules apply to a specific ``function`` (context) on a specific ``variable`` |
| 53 | (data), like ``disable_function``. Others can only be enabled/disabled, like | 53 | (data), like ``disable_function``. Others can only be enabled/disabled, like |
| 54 | ``harden_random``. | 54 | ``harden_random``. |
| 55 | 55 | ||
| 56 | Most of the features can be used in ``simulation`` mode by appending the | 56 | Most of the features can be used in ``simulation`` mode by appending the |
| 57 | ``.simulation()`` or ``.sim()`` option to them (eg. ``sp.readonly_exec.simulation().enable();``) to see | 57 | ``.simulation()`` or ``.sim()`` option to them (eg. ``sp.readonly_exec.simulation().enable();``) to see |
| 58 | whether or not they could break your website. The simulation mode won't block the request, | 58 | whether or not they could break your website. The simulation mode won't block the request, |
| 59 | but will write a warning in the log. | 59 | and will only log a warning. |
| 60 | 60 | ||
| 61 | The rules are evaluated in the order that they are written, the **first** one | 61 | The rules are evaluated in the order that they are written, the **first** one |
| 62 | to match will terminate the evaluation (except for rules in simulation mode). | 62 | to match will terminate the evaluation, except of course for rules in simulation mode. |
| 63 | 63 | ||
| 64 | Rules can be split into lines and contain whitespace for easier readability and maintenance: (This feature is available since version 0.8.0.) | 64 | Since Snuffleupagus 0.8.0, rules can be split into lines and contain whitespace for easier readability and maintenance: |
| 65 | 65 | ||
| 66 | :: | 66 | :: |
| 67 | 67 | ||
| @@ -70,8 +70,6 @@ Rules can be split into lines and contain whitespace for easier readability and | |||
| 70 | .alias("newline in mail() To:") | 70 | .alias("newline in mail() To:") |
| 71 | .drop(); | 71 | .drop(); |
| 72 | 72 | ||
| 73 | The terminating ``;`` is optional for now, but it should be used for future compatibility. | ||
| 74 | |||
| 75 | Rules, including comments, needs to be written in ASCII, other encodings aren't | 73 | Rules, including comments, needs to be written in ASCII, other encodings aren't |
| 76 | supported and might cause syntax errors and related issues like making | 74 | supported and might cause syntax errors and related issues like making |
| 77 | all rules after non-ASCII symbols not considered for execution and silently discarded. | 75 | all rules after non-ASCII symbols not considered for execution and silently discarded. |
