apache2/t/regression/action/10-logging.t

   1 ### Logging tests
   2
   3 # log/nolog
   4 {
   5         type => "action",
   6         comment => "log",
   7         conf => qq(
   8                 SecRuleEngine On
   9                 SecAuditEngine RelevantOnly
  10                 SecAuditLog "$ENV{AUDIT_LOG}"
  11                 SecAction "phase:1,pass,log"
  12         ),
  13         match_log => {
  14                 error => [ qr/ModSecurity: Warning. Unconditional match in SecAction\./, 1 ],
  15         },
  16         match_response => {
  17                 status => qr/^200$/,
  18         },
  19         request => new HTTP::Request(
  20                 GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
  21         ),
  22 },
  23 {
  24         type => "action",
  25         comment => "nolog",
  26         conf => qq(
  27                 SecRuleEngine On
  28                 SecAuditEngine RelevantOnly
  29                 SecAuditLog "$ENV{AUDIT_LOG}"
  30                 SecAction "phase:1,pass,nolog"
  31         ),
  32         match_log => {
  33                 -error => [ qr/ModSecurity: /, 1 ],
  34                 -audit => [ qr/./, 1 ],
  35         },
  36         match_response => {
  37                 status => qr/^200$/,
  38         },
  39         request => new HTTP::Request(
  40                 GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
  41         ),
  42 },
  43
  44 # auditlog/noauditlog
  45 {
  46         type => "action",
  47         comment => "auditlog",
  48         conf => qq(
  49                 SecRuleEngine On
  50                 SecAuditEngine RelevantOnly
  51                 SecAuditLog "$ENV{AUDIT_LOG}"
  52                 SecAction "phase:1,pass,auditlog"
  53         ),
  54         match_log => {
  55                 error => [ qr/ModSecurity: Warning. Unconditional match in SecAction\./, 1 ],
  56                 audit => [ qr/Message: Warning. Unconditional match in SecAction\./, 1 ],
  57         },
  58         match_response => {
  59                 status => qr/^200$/,
  60         },
  61         request => new HTTP::Request(
  62                 GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
  63         ),
  64 },
  65 {
  66         type => "action",
  67         comment => "noauditlog",
  68         conf => qq(
  69                 SecRuleEngine On
  70                 SecAuditEngine RelevantOnly
  71                 SecAuditLog "$ENV{AUDIT_LOG}"
  72                 SecAction "phase:1,pass,noauditlog"
  73         ),
  74         match_log => {
  75                 error => [ qr/ModSecurity: Warning. Unconditional match in SecAction\./, 1 ],
  76                 -audit => [ qr/./, 1 ],
  77         },
  78         match_response => {
  79                 status => qr/^200$/,
  80         },
  81         request => new HTTP::Request(
  82                 GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
  83         ),
  84 },
  85
  86 # All log/nolog auditlog/noauditlog combos
  87 {
  88         type => "action",
  89         comment => "log,auditlog",
  90         conf => qq(
  91                 SecRuleEngine On
  92                 SecAuditEngine RelevantOnly
  93                 SecAuditLog "$ENV{AUDIT_LOG}"
  94                 SecAction "phase:1,pass,log,auditlog"
  95         ),
  96         match_log => {
  97                 error => [ qr/ModSecurity: Warning. Unconditional match in SecAction\./, 1 ],
  98                 audit => [ qr/Message: Warning. Unconditional match in SecAction\./, 1 ],
  99         },
 100         match_response => {
 101                 status => qr/^200$/,
 102         },
 103         request => new HTTP::Request(
 104                 GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
 105         ),
 106 },
 107 {
 108         type => "action",
 109         comment => "log,noauditlog",
 110         conf => qq(
 111                 SecRuleEngine On
 112                 SecAuditEngine RelevantOnly
 113                 SecAuditLog "$ENV{AUDIT_LOG}"
 114                 SecAction "phase:1,pass,log,noauditlog"
 115         ),
 116         match_log => {
 117                 error => [ qr/ModSecurity: Warning. Unconditional match in SecAction\./, 1 ],
 118                 -audit => [ qr/./, 1 ],
 119         },
 120         match_response => {
 121                 status => qr/^200$/,
 122         },
 123         request => new HTTP::Request(
 124                 GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
 125         ),
 126 },
 127 {
 128         type => "action",
 129         comment => "nolog,auditlog",
 130         conf => qq(
 131                 SecRuleEngine On
 132                 SecAuditEngine RelevantOnly
 133                 SecAuditLog "$ENV{AUDIT_LOG}"
 134                 SecAction "phase:1,pass,nolog,auditlog"
 135         ),
 136         match_log => {
 137                 audit => [ qr/-H--\s+Message: .*Stopwatch: /s, 1 ],
 138         },
 139         match_response => {
 140                 status => qr/^200$/,
 141         },
 142         request => new HTTP::Request(
 143                 GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
 144         ),
 145 },
 146 {
 147         type => "action",
 148         comment => "nolog,noauditlog",
 149         conf => qq(
 150                 SecRuleEngine On
 151                 SecAuditEngine RelevantOnly
 152                 SecAuditLog "$ENV{AUDIT_LOG}"
 153                 SecAction "phase:1,pass,nolog,noauditlog"
 154         ),
 155         match_log => {
 156                 -error => [ qr/ModSecurity: /, 1 ],
 157                 -audit => [ qr/./, 1 ],
 158         },
 159         match_response => {
 160                 status => qr/^200$/,
 161         },
 162         request => new HTTP::Request(
 163                 GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
 164         ),
 165 },
 166 {
 167         type => "action",
 168         comment => "auditlog,log",
 169         conf => qq(
 170                 SecRuleEngine On
 171                 SecAuditEngine RelevantOnly
 172                 SecAuditLog "$ENV{AUDIT_LOG}"
 173                 SecAction "phase:1,pass,auditlog,log"
 174         ),
 175         match_log => {
 176                 error => [ qr/ModSecurity: Warning. Unconditional match in SecAction\./, 1 ],
 177                 audit => [ qr/Message: Warning. Unconditional match in SecAction\./, 1 ],
 178         },
 179         match_response => {
 180                 status => qr/^200$/,
 181         },
 182         request => new HTTP::Request(
 183                 GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
 184         ),
 185 },
 186 {
 187         type => "action",
 188         comment => "auditlog,nolog",
 189         conf => qq(
 190                 SecRuleEngine On
 191                 SecAuditEngine RelevantOnly
 192                 SecAuditLog "$ENV{AUDIT_LOG}"
 193                 SecAction "phase:1,pass,auditlog,nolog"
 194         ),
 195         match_log => {
 196                 -error => [ qr/ModSecurity: /, 1 ],
 197                 -audit => [ qr/./, 1 ],
 198         },
 199         match_response => {
 200                 status => qr/^200$/,
 201         },
 202         request => new HTTP::Request(
 203                 GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
 204         ),
 205 },
 206 {
 207         type => "action",
 208         comment => "noauditlog,log",
 209         conf => qq(
 210                 SecRuleEngine On
 211                 SecAuditEngine RelevantOnly
 212                 SecAuditLog "$ENV{AUDIT_LOG}"
 213                 SecAction "phase:1,pass,noauditlog,log"
 214         ),
 215         match_log => {
 216                 error => [ qr/ModSecurity: Warning. Unconditional match in SecAction\./, 1 ],
 217                 -audit => [ qr/./, 1 ],
 218         },
 219         match_response => {
 220                 status => qr/^200$/,
 221         },
 222         request => new HTTP::Request(
 223                 GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
 224         ),
 225 },
 226 {
 227         type => "action",
 228         comment => "noauditlog,nolog",
 229         conf => qq(
 230                 SecRuleEngine On
 231                 SecAuditEngine RelevantOnly
 232                 SecAuditLog "$ENV{AUDIT_LOG}"
 233                 SecAction "phase:1,pass,noauditlog,nolog"
 234         ),
 235         match_log => {
 236                 -error => [ qr/ModSecurity: /, 1 ],
 237                 -audit => [ qr/./, 1 ],
 238         },
 239         match_response => {
 240                 status => qr/^200$/,
 241         },
 242         request => new HTTP::Request(
 243                 GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
 244         ),
 245 },
 246