Merge pull request #2523 from JGodin-C2C/main

Author: smortex

manifests/mod/security.pp

@@ -23,6 +23,9 @@
 # @param modsec_secruleengine
 #   Configures the rules engine.
 # 
+# @param debug_log_level
+#   Configures the debug log level.
+#
 # @param audit_log_relevant_status
 #   Configures which response status code is to be considered relevant for the purpose of audit logging.
 # 
@@ -143,6 +146,7 @@
   Optional[Array[String]] $custom_rules_set                    = $apache::params::modsec_custom_rules_set,
   Stdlib::Absolutepath $modsec_dir                             = $apache::params::modsec_dir,
   String $modsec_secruleengine                                 = $apache::params::modsec_secruleengine,
+  Integer[0, 9] $debug_log_level                              = 0,
   String $audit_log_relevant_status                            = '^(?:5|4(?!04))',
   String $audit_log_parts                                      = $apache::params::modsec_audit_log_parts,
   String $audit_log_type                                       = $apache::params::modsec_audit_log_type,
@@ -262,6 +266,7 @@
     'audit_log_type'              => $audit_log_type,
     'audit_log_format'            => $audit_log_format,
     'audit_log_storage_dir'       => $audit_log_storage_dir,
+    'debug_log_level'             => $debug_log_level,
     'logroot'                     => $logroot,
   }
 

spec/classes/mod/security_spec.rb

@@ -104,6 +104,7 @@
                 audit_log_type: 'Concurrent',
                 audit_log_format: 'JSON',
                 audit_log_storage_dir: '/var/log/httpd/audit',
+                debug_log_level: 3,
                 secdefaultaction: 'deny,status:406,nolog,auditlog',
                 secrequestbodyaccess: 'Off',
                 secresponsebodyaccess: 'On',
@@ -118,6 +119,7 @@
             it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecAuditLogFormat JSON$} }
             it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecAuditLogStorageDir /var/log/httpd/audit$} }
             it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecRequestBodyAccess Off$} }
+            it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecDebugLogLevel 3$} }
             it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecResponseBodyAccess On$} }
             it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecRequestBodyLimitAction ProcessPartial$} }
             it { is_expected.to contain_file('security.conf').with_content %r{^\s+SecResponseBodyLimitAction Reject$} }

templates/mod/security.conf.epp

@@ -44,7 +44,7 @@
     SecResponseBodyMimeType text/plain text/html text/xml
     SecResponseBodyLimit 524288
     SecResponseBodyLimitAction <%= $secresponsebodylimitaction %>
-    SecDebugLogLevel 0
+    SecDebugLogLevel <%= $debug_log_level %>
     SecAuditEngine RelevantOnly
     SecAuditLogRelevantStatus "<%= $audit_log_relevant_status %>"
     SecAuditLogParts <%= $audit_log_parts %>