Re: Setting a request header to value from POST data

Hi Christian,

thanks for all the tips - I made a separate vhost and some tests, and indeed, when I remove ALL SecRuleRemoveById statements we have collected over the time, it suddenly works. Have to dig deeper why, though... or have you got any idea?

Cheers,
Andres

-----Ursprüngliche Nachricht-----
Von: Christian Folini <[email protected]> 
Gesendet: Freitag, 23. August 2019 14:03
An: [email protected]
Betreff: Re: [mod-security-users] Setting a request header to value from POST data

Hey Andres,

On Fri, Aug 23, 2019 at 11:26:38AM +0000, Andres Ofner wrote:
> I get "(null)" every time (which would have been avoided with 
> "env=PMID" in
> RequestHeader) instead of 12345...

There is something wrong in your setup. I can't readily see what though.

The following two examples work for me:


---

SecRule ARGS:foo                        ".*"    "id:1006,phase:2,pass,log,capture,setenv:foo=%{TX.0}"
RequestHeader set X-foo "%{foo}e"

---

SecRule ARGS:foo                        "@unconditionalMatch"   "id:1006,phase:2,pass,log,setenv:foo=%{MATCHED_VAR}"
RequestHeader set X-foo "%{foo}e"

---

I have checked with tcpdump, the header is really there.

I suggest you start over with a clean, minimal configuration; like the one I use in my 2nd tutorial on https://netnea.com.

Then put DebugLogLevel to 9 and follow closely. Maybe put Apache into trace:8 and follow step by step. Or if everything fails, start gdm (but that's really tough if you have not done it before).

Cheers,

Christian

> 
> 
> Thanks,
> Andres
> 
> -----Ursprüngliche Nachricht-----
> Von: Christian Folini <[email protected]>
> Gesendet: Freitag, 23. August 2019 12:23
> An: [email protected]
> Betreff: Re: [mod-security-users] Setting a request header to value 
> from POST data
> 
> Hey Andres,
> 
> On Fri, Aug 23, 2019 at 09:48:38AM +0000, Andres Ofner wrote:
> > In code, I came up with this:
> > 
> >       SecRule ARGS:MERCHANTID "(\d+)"
> > "phase:2,id:81104,setenv:PMID=%{TX.0},pass"
> > 
> >       RequestHeader set POSTMERCHANTID "%{PMID}e" env=PMID
> 
> 
> This should work when done correctly. (The order of the hooks / 
> modules does allow for it). Please try and add the "capture" action. 
> This should do the trick. If not, then you shoudl raise the debug log 
> level to 9 and follow the execution carefully.
> 
> > Also, I wonder why I failed to increase logging for 200 responses 
> > which by default are excluded, when adding these to the SecRule:
> > 
> > log,auditlog,ctl:auditEngine=On,ctl:auditLogParts=+E,ctl:debugLogLev
> > el
> > =9
> 
> Not sure. I think it ought to log the request to the auditlog. 
> Otherwise raise the baseline debug log level to 9 and look at the rule 
> execution carefully. Is there really a match, etc. auditEngine=on 
> should not be needed here, btw.
> 
> Cheers,
> 
> Christian
> 
> 
> --
> We used to think that if we knew one, we knew two, because one and one 
> are two. We are finding that we must learn a great deal more about 'and'.
> -- Sir Arthur Eddington
> 
> 
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/




> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/



_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/