os-nginx: NAXSI rule import script fails with fatal PHP error

[ethanvos]

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

• I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• I have searched the existing issues, open and closed, and I'm convinced that mine is new.
• The title contains the plugin to which this issue belongs

Describe the bug
First-time download of NAXSI WAF ruleset fails.

To Reproduce
Navigate to Services > Nginx > Configuration.
Click dropdown on HTTP tab, select Naxsi WAF Policy.
Message appears: "It looks like you are not having any rules installed. You may want to download the NAXSI core rules." Click Download button. Click Accept And Download to confirm.

Resultant behaviour
Naxsi WAF Policy and Naxsi WAF Rule pages remain empty lists. PHP fatal error is seen in the reporter.
PHP Fatal error: Allowed memory size of 1073741824 bytes exhausted (tried to allocate 1063260160 bytes) in /usr/local/opnsense/scripts/nginx/naxsi_rule_download.php on line 172

Expected behaviour
Successful download and population of WAF ruleset.

Last known working version
I have used this feature successfully on a lab VM which was version 23.7 at the time.

Additional information
It appears the cause of the fatal error is a failed validation check. The code block in question:
170 $val_result = $model->performValidation(false);
171 if (count($val_result) !== 0) {
172 print_r($val_result);
173 exit(1);
174 }
My assumption is that val_result should be 0 if validation passes. Instead it spits out an OPNsense\Base\Validation object which is seemingly endless, resulting in the overflow.

Environment
FreeBSD 14.3-RELEASE-p2 stable/25.7-n271676-ab2281de1853 SMP amd64
OPNsense 25.7.3_7 13101bd9a
Plugins os-net-snmp-1.6 os-nginx-1.35 os-vmware-1.5_1
OpenSSL 3.0.17
Python 3.11.13
PHP 8.3.25

This issue was also reported by a user in the community forums here: https://forum.opnsense.org/index.php?topic=48960.0

[Monviech]

@kulikov-a Just pinging you for this one so its visible. no rush

[kulikov-a]

Hi! I'll try to look at it this week

[kulikov-a]

So i adapted the regex (a couple of rules were missing from the scope) and changed the validations messages output.
It turns out the root cause is that the policies stopped passing naxsi_rules field validation. This is odd (something change in the validation logic or fields?). It will take a little more time to figure this out.
b8168d5

Validations failed:
[custom_policy.23c86afe-8e5c-4864-aeab-4e2dde679236.naxsi_rules] Selected rule not found.
[custom_policy.8d122ece-729d-4c28-bac4-abb0a77864df.naxsi_rules] Selected rule not found.
[custom_policy.0ceb5315-ca84-4e50-b8bd-8784ece3f9ab.naxsi_rules] Selected rule not found.
[custom_policy.b35446eb-ab39-4817-ad7f-bc16eba642ab.naxsi_rules] Selected rule not found.
[custom_policy.946d3493-528e-4b8d-8d61-adee82dbe5e8.naxsi_rules] Selected rule not found.
[custom_policy.10ae433a-c809-48a0-bfb9-3a836e8ddeb2.naxsi_rules] Selected rule not found.

[kulikov-a]

@AdSchellevis Hi! )
It turns out the model in this script fails ModelRalationField validation after the opnsense/core@b8fde8e.
(This script just prepares a model with rules and policies based on these rules)
Could you tell please if this is expected behavior? Should I somehow set the force flag, or may be should we just not validate the model in this case? Thanks!

[AdSchellevis]

@kulikov-a I haven’t looked at the code, but if content changes which is guaranteed to be correct you can skip validation

[kulikov-a]

@AdSchellevis thanks!)
@ethanvos can you check with kulikov-a@cfbe14d please?
opnsense-patch -c plugins -a kulikov-a cfbe14d

[loiiiic]

Hello @kulikov-a

I am the person who started the discussion thread on the forum.
I have just tested the fix and the policy download is now working correctly.

Thank you! :)

[kulikov-a]

@loiiiic Thanks! I'll make a PR then)

[ethanvos]

Apologies for the late response, I was away on vacation.
Many thanks for looking into this issue quickly @kulikov-a, and for testing the fix quickly as well @loiiiic. I have installed the fix and can confirm it works for me as well.
All the best.