Added TX_SEVERITY variable. See #60.

CHANGES

@@ -1,6 +1,9 @@
 ?? ??? 2007 - 2.5.0-trunk
 -------------------------
 
+ * Added TX_SEVERITY that keeps track of the highest severity
+   for any matched rules so far.
+
  * Added ARGS_GET, ARGS_POST, ARGS_GET_NAMES, ARGS_POST_NAMES variables to
    allow seperation of GET and POST arguments.
 

apache2/modsecurity.c

@@ -295,9 +295,12 @@ apr_status_t modsecurity_tx_init(modsec_rec *msr) {
     msr->collections_dirty = apr_table_make(msr->mp, 8);
     if (msr->collections_dirty == NULL) return -1;
 
+    /* Other */
     msr->tcache = apr_hash_make(msr->mp);
     if (msr->tcache == NULL) return -1;
 
+    msr->tx_severity = 7; /* lowest */
+
     return 1;
 }
 

apache2/modsecurity.h

@@ -320,6 +320,7 @@ struct modsec_rec {
     apr_time_t           time_checkpoint_3;
 
     const char          *matched_var;
+    int                  tx_severity;
 
     /* upload */
     int                  upload_extract_files;

apache2/re.c

@@ -1253,6 +1253,12 @@ static int execute_operator(msre_var *var, msre_rule *rule, modsec_rec *msr,
 
         msr->matched_var = apr_pstrdup(msr->mp, var->name);
 
+        /* Keep track of the highest severity matched so far */
+        if (acting_actionset->severity < msr->tx_severity) {
+            msr->tx_severity = acting_actionset->severity;
+        }
+
+
         /* Perform non-disruptive actions. */
         msre_perform_nondisruptive_actions(msr, rule, rule->actionset, mptmp);
 

apache2/re_variables.c

@@ -734,6 +734,14 @@ static int var_tx_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
     return count;
 }
 
+/* TX_SEVERITY */
+
+static int var_tx_severity_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
+    apr_table_t *vartab, apr_pool_t *mptmp)
+{
+    return var_simple_generate(var, vartab, mptmp, apr_psprintf(mptmp, "%i", msr->tx_severity));
+}
+
 /* GEO */
 
 static int var_geo_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
@@ -2139,6 +2147,17 @@ void msre_engine_register_default_variables(msre_engine *engine) {
         PHASE_REQUEST_HEADERS
     );
 
+    /* TX_SEVERITY */
+    msre_engine_variable_register(engine,
+        "TX_SEVERITY",
+        VAR_SIMPLE,
+        0, 0,
+        NULL,
+        var_tx_severity_generate,
+        VAR_DONT_CACHE,
+        PHASE_REQUEST_HEADERS
+    );
+
     /* GEO */
     msre_engine_variable_register(engine,
         "GEO",