diff --git a/CHANGES b/CHANGES index 153afa10..f562ac3c 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,9 @@ -04 Mar 2008 - 2.5.1-rc1 +07 Mar 2008 - 2.5.1-rc1 ----------------------- + * Fixed an issue where a match would not occur if transformation caching + was enabled. + * Using "severity" in a default action is now just a warning. * Cleaned up the "make test" target to better locate headers/libraries. diff --git a/apache2/re.c b/apache2/re.c index e6af7111..0fd7ecf8 100644 --- a/apache2/re.c +++ b/apache2/re.c @@ -735,6 +735,8 @@ void msre_engine_destroy(msre_engine *engine) { * transaction phase. */ #if defined(PERFORMANCE_MEASUREMENT) +static apr_status_t msre_ruleset_process_phase_(msre_ruleset *ruleset, modsec_rec *msr); + apr_status_t msre_ruleset_process_phase(msre_ruleset *ruleset, modsec_rec *msr) { apr_array_header_t *arr = NULL; msre_rule **rules = NULL; @@ -1986,6 +1988,8 @@ static apr_status_t msre_rule_process_normal(msre_rule *rule, modsec_rec *msr) { return -1; } if (rc == RULE_MATCH) { + match_count++; + /* Return straight away if the transaction * was intercepted - no need to process the remaining * targets. diff --git a/doc/modsecurity2-apache-reference.xml b/doc/modsecurity2-apache-reference.xml index b986ea29..50d97d80 100644 --- a/doc/modsecurity2-apache-reference.xml +++ b/doc/modsecurity2-apache-reference.xml @@ -4,7 +4,7 @@ Manual - Version 2.5.1-rc1 (March 04, 2008) + Version 2.5.1-rc1 (March 07, 2008) 2004-2008 @@ -4606,14 +4606,26 @@ SecRule ARGS "attack" multiMatch Action Group: Disruptive - Example: + Example1: SecRule REQUEST_HEADERS:User-Agent "Test" log,pass + When using pass with SecRule with multiple + targets, all targets will be processed and + all non-disruptive actions will trigger for + every match found. In the second example the + TX:test target would be incremented by 1 for each matching + argument. + + Example2: + + SecRule ARGS "test" log,pass,setvar:TX.test=+1 + Note - Transaction will not be interrupted but it will be logged (unless - logging has been suppressed). + The transaction will not be interrupted but a log will be + generated for each matching target (unless logging has been + suppressed).