sentinel-agent-sentinelsec

A pure Rust ModSecurity-compatible WAF agent for Sentinel reverse proxy. Provides full OWASP Core Rule Set (CRS) support with zero C dependencies - no libmodsecurity required.

Alpha Release: This agent is in early development. The core functionality works but expect API changes and potential bugs.

Features

• Full OWASP CRS Compatibility: Parse and execute 800+ CRS rules
• Pure Rust Implementation: No libmodsecurity or C dependencies
• Built-in SQLi/XSS Detection: Native @detectSQLi and @detectXSS operators
• SecLang Support: Load standard ModSecurity rule files
• Request Body Inspection: JSON, form data, XML, and all content types
• Response Body Inspection: Detect data leakage (opt-in)
• Block or Detect-Only Mode: Monitor before blocking
• Path Exclusions: Skip inspection for trusted paths
• Zero Installation Hassle: Just cargo install, no system dependencies

Comparison with Other WAF Agents

SentinelSec combines the best of both worlds: Full CRS compatibility like ModSec, with zero-dependency installation like WAF.

Installation

From crates.io

cargo install sentinel-agent-sentinelsec

From source

git clone https://github.com/raskell-io/sentinel-agent-sentinelsec
cd sentinel-agent-sentinelsec
cargo build --release

Usage

sentinel-sentinelsec-agent \
  --socket /var/run/sentinel/sentinelsec.sock \
  --rules /etc/modsecurity/crs/crs-setup.conf \
  --rules "/etc/modsecurity/crs/rules/*.conf"

Command Line Options

OWASP CRS Setup

Download CRS

# Clone the CRS repository
sudo mkdir -p /etc/modsecurity
sudo git clone https://github.com/coreruleset/coreruleset /etc/modsecurity/crs

# Copy example configuration
sudo cp /etc/modsecurity/crs/crs-setup.conf.example /etc/modsecurity/crs/crs-setup.conf

Run with CRS

sentinel-sentinelsec-agent \
  --socket /var/run/sentinel/sentinelsec.sock \
  --rules /etc/modsecurity/crs/crs-setup.conf \
  --rules "/etc/modsecurity/crs/rules/*.conf"

Sentinel Configuration

agents {
    agent "sentinelsec" {
        type "custom"
        transport "unix_socket" {
            path "/var/run/sentinel/sentinelsec.sock"
        }
        events ["request_headers", "request_body_chunk", "response_body_chunk"]
        timeout-ms 100
        failure-mode "open"
    }
}

routes {
    route "all" {
        matches { path-prefix "/" }
        upstream "backend"
        agents ["sentinelsec"]
    }
}

Paranoia Levels

Configure in /etc/modsecurity/crs/crs-setup.conf:

SecAction "id:900000,phase:1,pass,t:none,nolog,setvar:tx.blocking_paranoia_level=1"

Response Headers

CRS Rule Categories

Docker/Kubernetes

# Environment variables
env:
  - name: AGENT_SOCKET
    value: "/var/run/sentinel/sentinelsec.sock"
  - name: SENTINELSEC_RULES
    value: "/etc/modsecurity/crs/crs-setup.conf,/etc/modsecurity/crs/rules/*.conf"
  - name: SENTINELSEC_BLOCK_MODE
    value: "true"
  - name: SENTINELSEC_EXCLUDE_PATHS
    value: "/health,/metrics"

Writing Custom Rules

Create custom rules using SecLang syntax:

# /etc/modsecurity/custom-rules.conf

# Block requests with specific user-agent
SecRule REQUEST_HEADERS:User-Agent "@contains badbot" \
    "id:100001,phase:1,deny,status:403,msg:'Bad bot detected'"

# Detect sensitive data in responses
SecRule RESPONSE_BODY "@rx \b\d{3}-\d{2}-\d{4}\b" \
    "id:100002,phase:4,deny,status:500,msg:'SSN detected in response'"

Load custom rules:

sentinel-sentinelsec-agent \
  --rules /etc/modsecurity/crs/crs-setup.conf \
  --rules "/etc/modsecurity/crs/rules/*.conf" \
  --rules /etc/modsecurity/custom-rules.conf

Development

# Run with debug logging
RUST_LOG=debug cargo run -- --socket /tmp/test.sock --rules ./test-rules.conf

# Run tests
cargo test

# Build release binary
cargo build --release

Architecture

SentinelSec uses sentinel-modsec, a pure Rust reimplementation of libmodsecurity:

• Parser: Full SecLang parser for SecRule, SecAction, SecMarker directives
• Variables: REQUEST_URI, ARGS, REQUEST_HEADERS, TX collections, and more
• Operators: 37+ operators including @rx, @pm, @detectSQLi, @detectXSS
• Transformations: 35+ transformations (urlDecode, base64Decode, lowercase, etc.)
• Engine: 5-phase transaction processing with rule chaining and anomaly scoring

Related Agents

License

Apache-2.0