Skip to content

Commit 1b7aa42

Browse files
michaelgranzow-avizimmerle
michaelgranzow-avi
authored and
zimmerle
committed
Issue-2423: Meta-actions like 'msg' should be applied at end of chain
1 parent 2672db1 commit 1b7aa42

File tree

4 files changed

+141
-11
lines changed

4 files changed

+141
-11
lines changed

‎CHANGES

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
v3.x.y - YYYY-MMM-DD (to be released)
22
-------------------------------------
33

4+
- Fixed MatchedVar on chained rules
5+
[Issue #2423, #2435, #2436 - @michaelgranzow-avi]
46
- Add support for new operator rxGlobal
57
[@martinhsv]
68
- Fix maxminddb link on FreeBSD

‎Makefile.am

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,7 @@ TESTS+=test/test-cases/regression/issue-2099.json
158158
TESTS+=test/test-cases/regression/issue-2000.json
159159
TESTS+=test/test-cases/regression/issue-2111.json
160160
TESTS+=test/test-cases/regression/issue-2196.json
161+
TESTS+=test/test-cases/regression/issue-2423-msg-in-chain.json
161162
TESTS+=test/test-cases/regression/issue-394.json
162163
TESTS+=test/test-cases/regression/issue-849.json
163164
TESTS+=test/test-cases/regression/issue-960.json

‎src/rule_with_actions.cc

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -215,17 +215,6 @@ void RuleWithActions::executeActionsIndependentOfChainedRuleResult(Transaction *
215215
}
216216
}
217217

218-
if (m_severity) {
219-
m_severity->evaluate(this, trans, ruleMessage);
220-
}
221-
222-
if (m_logData) {
223-
m_logData->evaluate(this, trans, ruleMessage);
224-
}
225-
226-
if (m_msg) {
227-
m_msg->evaluate(this, trans, ruleMessage);
228-
}
229218
}
230219

231220

@@ -257,6 +246,17 @@ void RuleWithActions::executeActionsAfterFullMatch(Transaction *trans,
257246
executeAction(trans, containsBlock, ruleMessage, a, false);
258247
disruptiveAlreadyExecuted = true;
259248
}
249+
if (m_severity) {
250+
m_severity->evaluate(this, trans, ruleMessage);
251+
}
252+
253+
if (m_logData) {
254+
m_logData->evaluate(this, trans, ruleMessage);
255+
}
256+
257+
if (m_msg) {
258+
m_msg->evaluate(this, trans, ruleMessage);
259+
}
260260
for (Action *a : this->m_actionsRuntimePos) {
261261
if (!a->isDisruptive()
262262
&& !(disruptiveAlreadyExecuted

‎test/test-cases/regression/issue-2423-msg-in-chain.json

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
[
2+
{
3+
"enabled":1,
4+
"version_min":300000,
5+
"title":"Test match variable (1/n)",
6+
"github_issue": 2423,
7+
"expected":{
8+
"http_code": 437,
9+
"error_log": "against variable `REQUEST_HEADERS:Transfer-Encoding' .Value: `deflate'"
10+
},
11+
"client":{
12+
"ip":"200.249.12.31",
13+
"port":123
14+
},
15+
"request":{
16+
"headers":{
17+
"Host":"localhost",
18+
"Transfer-Encoding": "deflate"
19+
},
20+
"uri":"/match-this",
21+
"method":"GET"
22+
},
23+
"server":{
24+
"ip":"200.249.12.31",
25+
"port":80
26+
},
27+
"rules":[
28+
"SecRuleEngine On",
29+
"SecRule REQUEST_URI \"^.*$\" \"phase:2,deny,capture,id:1,msg:'MatchedVar On Msg: [%{MATCHED_VAR}]',logdata:'MatchedVar On LogData %{MATCHED_VAR}',chain\"",
30+
"SecRule REQUEST_HEADERS \"^.*$\" \"status:437\""
31+
]
32+
},
33+
{
34+
"enabled":1,
35+
"version_min":300000,
36+
"title":"Test match variable (2/n)",
37+
"github_issue": 2423,
38+
"expected":{
39+
"http_code": 437,
40+
"error_log": "MatchedVar On Msg: .deflate."
41+
},
42+
"client":{
43+
"ip":"200.249.12.31",
44+
"port":123
45+
},
46+
"request":{
47+
"headers":{
48+
"Host":"localhost",
49+
"Transfer-Encoding": "deflate"
50+
},
51+
"uri":"/match-this",
52+
"method":"GET"
53+
},
54+
"server":{
55+
"ip":"200.249.12.31",
56+
"port":80
57+
},
58+
"rules":[
59+
"SecRuleEngine On",
60+
"SecRule REQUEST_URI \"^.*$\" \"phase:2,deny,capture,id:1,msg:'MatchedVar On Msg: [%{MATCHED_VAR}]',logdata:'MatchedVar On LogData %{MATCHED_VAR}',chain\"",
61+
"SecRule REQUEST_HEADERS \"^.*$\" \"status:437\""
62+
]
63+
},
64+
{
65+
"enabled":1,
66+
"version_min":300000,
67+
"title":"Test match variable (3/n)",
68+
"github_issue": 2423,
69+
"expected":{
70+
"http_code": 437,
71+
"error_log": "MatchedVar On LogData: deflate"
72+
},
73+
"client":{
74+
"ip":"200.249.12.31",
75+
"port":123
76+
},
77+
"request":{
78+
"headers":{
79+
"Host":"localhost",
80+
"Transfer-Encoding": "deflate"
81+
},
82+
"uri":"/match-this",
83+
"method":"GET"
84+
},
85+
"server":{
86+
"ip":"200.249.12.31",
87+
"port":80
88+
},
89+
"rules":[
90+
"SecRuleEngine On",
91+
"SecRule REQUEST_URI \"^.*$\" \"phase:2,deny,capture,id:1,msg:'MatchedVar On Msg: [%{MATCHED_VAR}]',logdata:'MatchedVar On LogData: %{MATCHED_VAR}',chain\"",
92+
"SecRule REQUEST_HEADERS \"^.*$\" \"status:437\""
93+
]
94+
},
95+
{
96+
"enabled":1,
97+
"version_min":300000,
98+
"title":"Test match variable (4/n)",
99+
"github_issue": 2423,
100+
"expected":{
101+
"http_code": 437,
102+
"error_log": "msg \"Illegal header \\[/restricted/\\]\""
103+
},
104+
"client":{
105+
"ip":"200.249.12.31",
106+
"port":123
107+
},
108+
"request":{
109+
"headers":{
110+
"Host":"localhost",
111+
"Restricted":"attack",
112+
"Other": "Value"
113+
},
114+
"uri":"/",
115+
"method":"GET"
116+
},
117+
"server":{
118+
"ip":"200.249.12.31",
119+
"port":80
120+
},
121+
"rules":[
122+
"SecRuleEngine On",
123+
"SecRule REQUEST_HEADERS_NAMES \"^.*$\" \"phase:2,setvar:'tx.header_name_%{TX.0}=/%{TX.0}/',deny,t:lowercase,capture,id:500065,msg:'Illegal header [%{MATCHED_VAR}]',logdata:'Restricted header detected: %{MATCHED_VAR}',chain\"",
124+
"SecRule TX:/^header_name_/ \"@within /name1/restricted/name3/\" \"status:437\""
125+
]
126+
}
127+
]

0 commit comments

Comments
 (0)