diff --git a/CHANGES b/CHANGES index 4e1f2cf8..14e9a419 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,9 @@ ?? ??? 2007 - 2.5.0-trunk ------------------------- + * Added TX_SEVERITY that keeps track of the highest severity + for any matched rules so far. + * Added ARGS_GET, ARGS_POST, ARGS_GET_NAMES, ARGS_POST_NAMES variables to allow seperation of GET and POST arguments. diff --git a/apache2/modsecurity.c b/apache2/modsecurity.c index 8eab51f8..60f71374 100644 --- a/apache2/modsecurity.c +++ b/apache2/modsecurity.c @@ -295,9 +295,12 @@ apr_status_t modsecurity_tx_init(modsec_rec *msr) { msr->collections_dirty = apr_table_make(msr->mp, 8); if (msr->collections_dirty == NULL) return -1; + /* Other */ msr->tcache = apr_hash_make(msr->mp); if (msr->tcache == NULL) return -1; + msr->tx_severity = 7; /* lowest */ + return 1; } diff --git a/apache2/modsecurity.h b/apache2/modsecurity.h index a04cfa3e..745c276c 100644 --- a/apache2/modsecurity.h +++ b/apache2/modsecurity.h @@ -320,6 +320,7 @@ struct modsec_rec { apr_time_t time_checkpoint_3; const char *matched_var; + int tx_severity; /* upload */ int upload_extract_files; diff --git a/apache2/re.c b/apache2/re.c index 1c323fba..9f914590 100644 --- a/apache2/re.c +++ b/apache2/re.c @@ -1253,6 +1253,12 @@ static int execute_operator(msre_var *var, msre_rule *rule, modsec_rec *msr, msr->matched_var = apr_pstrdup(msr->mp, var->name); + /* Keep track of the highest severity matched so far */ + if (acting_actionset->severity < msr->tx_severity) { + msr->tx_severity = acting_actionset->severity; + } + + /* Perform non-disruptive actions. */ msre_perform_nondisruptive_actions(msr, rule, rule->actionset, mptmp); diff --git a/apache2/re_variables.c b/apache2/re_variables.c index f656cf78..c247695f 100644 --- a/apache2/re_variables.c +++ b/apache2/re_variables.c @@ -734,6 +734,14 @@ static int var_tx_generate(modsec_rec *msr, msre_var *var, msre_rule *rule, return count; } +/* TX_SEVERITY */ + +static int var_tx_severity_generate(modsec_rec *msr, msre_var *var, msre_rule *rule, + apr_table_t *vartab, apr_pool_t *mptmp) +{ + return var_simple_generate(var, vartab, mptmp, apr_psprintf(mptmp, "%i", msr->tx_severity)); +} + /* GEO */ static int var_geo_generate(modsec_rec *msr, msre_var *var, msre_rule *rule, @@ -2139,6 +2147,17 @@ void msre_engine_register_default_variables(msre_engine *engine) { PHASE_REQUEST_HEADERS ); + /* TX_SEVERITY */ + msre_engine_variable_register(engine, + "TX_SEVERITY", + VAR_SIMPLE, + 0, 0, + NULL, + var_tx_severity_generate, + VAR_DONT_CACHE, + PHASE_REQUEST_HEADERS + ); + /* GEO */ msre_engine_variable_register(engine, "GEO",