summaryrefslogtreecommitdiff
path: root/doc/source/config.rst
diff options
context:
space:
mode:
Diffstat (limited to 'doc/source/config.rst')
-rw-r--r--doc/source/config.rst24
1 files changed, 11 insertions, 13 deletions
diff --git a/doc/source/config.rst b/doc/source/config.rst
index 525885f..64d3591 100644
--- a/doc/source/config.rst
+++ b/doc/source/config.rst
@@ -11,15 +11,15 @@ Configuration
11 read the present documentation about how to configure them, 11 read the present documentation about how to configure them,
12 evaluate your threat model and write your configuration file accordingly. 12 evaluate your threat model and write your configuration file accordingly.
13 13
14Since PHP *ini-like* configuration model isn't flexible enough, 14Since PHP *ini-like* configuration model isn't flexible enough for our
15Snuffleupagus is using its own format in the file specified by 15usecases, Snuffleupagus is using its own format in the file specified by
16the directive ``sp.configuration_file`` **in** your ``php.ini`` file, 16the directive ``sp.configuration_file`` **in** your ``php.ini`` file,
17like ``sp.configuration_file=/etc/php/conf.d/snuffleupagus.rules``. 17like ``sp.configuration_file=/etc/php/conf.d/snuffleupagus.rules``.
18 18
19You can use the ``,`` separator to include multiple configuration files: 19You can use the ``,`` separator to include multiple configuration files:
20``sp.configuration_file=/etc/php/conf.d/snuffleupagus.rules,/etc/php/conf.d/sp_wordpress.rules``. 20``sp.configuration_file=/etc/php/conf.d/snuffleupagus.rules,/etc/php/conf.d/sp_wordpress.rules``.
21 21
22We're also also supporting `glob <https://en.wikipedia.org/wiki/Glob_%28programming%29>`__, 22It also supports `glob <https://en.wikipedia.org/wiki/Glob_%28programming%29>`__,
23so you can write something like: 23so you can write something like:
24``sp.configuration_file=/etc/php/conf.d/*.rules,/etc/php/conf.d/extra/test.rules``. 24``sp.configuration_file=/etc/php/conf.d/*.rules,/etc/php/conf.d/extra/test.rules``.
25 25
@@ -32,9 +32,9 @@ To sum up, you should put this in your ``php.ini``:
32 32
33And the **snuffleupagus rules** into the ``.rules`` files. 33And the **snuffleupagus rules** into the ``.rules`` files.
34 34
35Since our configuration format is a bit more complex than php's one, 35Since the configuration format is a bit more complex than php's one,
36we have a ``sp.allow_broken_configuration`` parameter (``false`` by default), 36their is a ``sp.allow_broken_configuration`` parameter (``false`` by default),
37that you can set to ``true`` if you want PHP to carry on if your Snuffleupagus' 37that can be set to ``true`` if you want PHP to carry on if your Snuffleupagus'
38configuration contains syntax errors. You'll still get a big scary message in 38configuration contains syntax errors. You'll still get a big scary message in
39your logs of course. We do **not** recommend to use it of course, but sometimes 39your logs of course. We do **not** recommend to use it of course, but sometimes
40it might be useful to be able to "debug in production" without breaking your 40it might be useful to be able to "debug in production" without breaking your
@@ -45,23 +45,23 @@ Configuration file format
45 45
46Options are chainable by using dots (``.``). 46Options are chainable by using dots (``.``).
47 47
48Some options have a string parameter, that **must** be quoted with double quotes, e.g. ``"string"``. 48String parameters **must** be quoted with double quotes, e.g. ``"string"``.
49 49
50Comments are prefixed either with ``#``, or ``;``. 50Comments are prefixed either with ``#``, or ``;``.
51 51
52Some rules apply in a specific ``function`` (context) on a specific ``variable`` 52Some rules apply to a specific ``function`` (context) on a specific ``variable``
53(data), like ``disable_function``. Others can only be enabled/disabled, like 53(data), like ``disable_function``. Others can only be enabled/disabled, like
54``harden_random``. 54``harden_random``.
55 55
56Most of the features can be used in ``simulation`` mode by appending the 56Most of the features can be used in ``simulation`` mode by appending the
57``.simulation()`` or ``.sim()`` option to them (eg. ``sp.readonly_exec.simulation().enable();``) to see 57``.simulation()`` or ``.sim()`` option to them (eg. ``sp.readonly_exec.simulation().enable();``) to see
58whether or not they could break your website. The simulation mode won't block the request, 58whether or not they could break your website. The simulation mode won't block the request,
59but will write a warning in the log. 59and will only log a warning.
60 60
61The rules are evaluated in the order that they are written, the **first** one 61The rules are evaluated in the order that they are written, the **first** one
62to match will terminate the evaluation (except for rules in simulation mode). 62to match will terminate the evaluation, except of course for rules in simulation mode.
63 63
64Rules can be split into lines and contain whitespace for easier readability and maintenance: (This feature is available since version 0.8.0.) 64Since Snuffleupagus 0.8.0, rules can be split into lines and contain whitespace for easier readability and maintenance:
65 65
66:: 66::
67 67
@@ -70,8 +70,6 @@ Rules can be split into lines and contain whitespace for easier readability and
70 .alias("newline in mail() To:") 70 .alias("newline in mail() To:")
71 .drop(); 71 .drop();
72 72
73The terminating ``;`` is optional for now, but it should be used for future compatibility.
74
75Rules, including comments, needs to be written in ASCII, other encodings aren't 73Rules, including comments, needs to be written in ASCII, other encodings aren't
76supported and might cause syntax errors and related issues like making 74supported and might cause syntax errors and related issues like making
77all rules after non-ASCII symbols not considered for execution and silently discarded. 75all rules after non-ASCII symbols not considered for execution and silently discarded.