How do you calculate the number of rules in CRS?

[yashhere]

Hi, I am trying to reproduce the results given on the wiki page. But I am not able to get the number of rules in CRS that you have posted on the very bottom of the wiki page. It says that CRS v3.1.0 has 1634 rules. How did you calculate this? I tried calculating, but I am getting 847 as a result. I used the following command -

# running it in the rules directory of CRS
grep -c "Sec" *.conf | cut -d':' -f2 | awk '{total = total + $1}END{print total}'

I think I am missing something here. Can you share your method/command of counting the number of rules? It would be of great help.

Thank you :)

[defanator]

@yashhere a number comes from total amount of loaded rules, and the default nginx.conf in this environment contains two locations with modsecurity_rules_file: https://github.com/defanator/modsecurity-performance/blob/master/states/files/etc/nginx/nginx.conf#L86 and https://github.com/defanator/modsecurity-performance/blob/master/states/files/etc/nginx/nginx.conf#L92.

You may check the following code to see how it's being calculated:
https://github.com/SpiderLabs/ModSecurity-nginx/blob/master/src/ngx_http_modsecurity_module.c#L316-L317
https://github.com/SpiderLabs/ModSecurity-nginx/blob/master/src/ngx_http_modsecurity_module.c#L350-L351
https://github.com/SpiderLabs/ModSecurity-nginx/blob/master/src/ngx_http_modsecurity_module.c#L389-L390

That is, you see the exact number of loaded rules as they are being represented architecturally within the library.

(Tagging @zimmerle for visibility.)

[yashhere]

I was thinking that the number of rules is the total number of rules in CRS, not the rules that are actually loaded in ModSecurity. That's why I was trying to grep the occurrences of the word "Sec" to get the approximate count of all the rules. Still, from my testing, the word "Sec" occurs for ~847 times in CRS, so at any time, the number of loaded rules in ModSecurity cannot be more than 847, provided that a rule can't be loaded twice (which is actually the case, if I am not wrong). Then how are you getting almost twice of my result? Is it because of the fact, that the main.conf is used two times for two different URL paths (/modsec-full and /modsec-full/upload) and you take both these configurations into account while calculating the numbers?

[defanator]

@yashhere rules are tied to an object of nginx configuration (which can be separated by levels, e.g. http, server, location, etc), so when you're loading even the identical modsecurity configuration from the same file into two different contexts (locations, servers), you'll get a sum of rules.

You can check nginx development guide for the configuration parts here:
http://nginx.org/en/docs/dev/development_guide.html#http_conf

[defanator]

re: "a rule can't be loaded twice" - in fact, it can (cc'ing @zimmerle again to confirm)