Forces disruptive to be first-rule-only

ModSecurity version 3 is capable to handle disruptive actions in different
rules from the chain. However, lets get it working in the same fashion that
we have in version 2.
This commit is contained in:
Felipe Zimmerle
2017-04-24 21:02:50 -03:00
parent 7e59250068
commit 6421ff087a
9 changed files with 71 additions and 37 deletions

View File

@@ -35,9 +35,9 @@
},
"rules":[
"SecRuleEngine On",
"SecRule ARGS:keyI \"@contains value\" \"chain,id:28\"",
"SecRule ARGS:keyI \"@contains value\" \"chain,id:28,pass\"",
"SecRule ARGS:keyII \"@contains other_value\" \"chain\"",
"SecRule MATCHED_VARS \"@contains asdf\" \"pass\""
"SecRule MATCHED_VARS \"@contains asdf\" \"\""
]
},
{
@@ -76,9 +76,9 @@
},
"rules":[
"SecRuleEngine On",
"SecRule ARGS:keyI \"@contains value\" \"chain,id:28\"",
"SecRule ARGS:keyI \"@contains value\" \"chain,id:28,pass\"",
"SecRule ARGS:keyII \"@contains other_value\" \"chain\"",
"SecRule MATCHED_VARS \"@contains asdf\" \"pass\"",
"SecRule MATCHED_VARS \"@contains asdf\" \"\"",
"SecRule MATCHED_VARS \"@contains value\" \"id:29\""
]
}