apache2/t/regression/rule/20-exceptions.t

   1 ### Tests for rule exceptions
   2
   3 # SecRuleRemoveById
   4 {
   5         type => "rule",
   6         comment => "SecRuleRemoveById (single)",
   7         conf => qq(
   8                 SecRuleEngine On
   9                 SecDebugLog $ENV{DEBUG_LOG}
  10                 SecDebugLogLevel 9
  11                 SecRule REQUEST_URI "test" "phase:1,deny,status:500,id:1"
  12                 SecRuleRemoveById 1
  13         ),
  14         match_log => {
  15                 -error => [ qr/ModSecurity: /, 1 ],
  16                 -audit => [ qr/./, 1 ],
  17                 debug => [ qr/Starting phase REQUEST_HEADERS\..*This phase consists of 0 rule.*Starting phase RESPONSE_HEADERS\./s, 1 ],
  18                 -debug => [ qr/Access denied/, 1 ],
  19         },
  20         match_response => {
  21                 status => qr/^200$/,
  22         },
  23         request => new HTTP::Request(
  24                 GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
  25         ),
  26 },
  27 {
  28         type => "rule",
  29         comment => "SecRuleRemoveById (multiple)",
  30         conf => qq(
  31                 SecRuleEngine On
  32                 SecDebugLog $ENV{DEBUG_LOG}
  33                 SecDebugLogLevel 9
  34                 SecRule REQUEST_URI "test" "phase:1,deny,status:500,id:1"
  35                 SecRule REQUEST_URI "test" "phase:1,deny,status:500,id:2"
  36                 SecRule REQUEST_URI "test" "phase:1,deny,status:500,id:3"
  37                 SecRuleRemoveById 1 2 3
  38         ),
  39         match_log => {
  40                 -error => [ qr/ModSecurity: /, 1 ],
  41                 -audit => [ qr/./, 1 ],
  42                 debug => [ qr/Starting phase REQUEST_HEADERS\..*This phase consists of 0 rule.*Starting phase RESPONSE_HEADERS\./s, 1 ],
  43                 -debug => [ qr/Access denied/, 1 ],
  44         },
  45         match_response => {
  46                 status => qr/^200$/,
  47         },
  48         request => new HTTP::Request(
  49                 GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
  50         ),
  51 },
  52 {
  53         type => "rule",
  54         comment => "SecRuleRemoveById (range)",
  55         conf => qq(
  56                 SecRuleEngine On
  57                 SecDebugLog $ENV{DEBUG_LOG}
  58                 SecDebugLogLevel 9
  59                 SecRule REQUEST_URI "test" "phase:1,deny,status:500,id:1"
  60                 SecRule REQUEST_URI "test" "phase:1,deny,status:500,id:2"
  61                 SecRule REQUEST_URI "test" "phase:1,deny,status:500,id:3"
  62                 SecRuleRemoveById 1-3
  63         ),
  64         match_log => {
  65                 -error => [ qr/ModSecurity: /, 1 ],
  66                 -audit => [ qr/./, 1 ],
  67                 debug => [ qr/Starting phase REQUEST_HEADERS\..*This phase consists of 0 rule.*Starting phase RESPONSE_HEADERS\./s, 1 ],
  68                 -debug => [ qr/Access denied/, 1 ],
  69         },
  70         match_response => {
  71                 status => qr/^200$/,
  72         },
  73         request => new HTTP::Request(
  74                 GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
  75         ),
  76 },
  77 {
  78         type => "rule",
  79         comment => "SecRuleRemoveById (multiple + range)",
  80         conf => qq(
  81                 SecRuleEngine On
  82                 SecDebugLog $ENV{DEBUG_LOG}
  83                 SecDebugLogLevel 9
  84                 SecRule REQUEST_URI "test" "phase:1,deny,status:500,id:1"
  85                 SecRule REQUEST_URI "test" "phase:1,deny,status:500,id:2"
  86                 SecRule REQUEST_URI "test" "phase:1,deny,status:500,id:3"
  87                 SecRule REQUEST_URI "test" "phase:1,deny,status:500,id:4"
  88                 SecRuleRemoveById 1 2-4
  89         ),
  90         match_log => {
  91                 -error => [ qr/ModSecurity: /, 1 ],
  92                 -audit => [ qr/./, 1 ],
  93                 debug => [ qr/Starting phase REQUEST_HEADERS\..*This phase consists of 0 rule.*Starting phase RESPONSE_HEADERS\./s, 1 ],
  94                 -debug => [ qr/Access denied/, 1 ],
  95         },
  96         match_response => {
  97                 status => qr/^200$/,
  98         },
  99         request => new HTTP::Request(
 100                 GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
 101         ),
 102 },
 103
 104 # SecRuleRemoveByMsg
 105 {
 106         type => "rule",
 107         comment => "SecRuleRemoveByMsg",
 108         conf => qq(
 109                 SecRuleEngine On
 110                 SecDebugLog $ENV{DEBUG_LOG}
 111                 SecDebugLogLevel 9
 112                 SecRule REQUEST_URI "test" "phase:1,deny,status:500,id:1,msg:'testing rule'"
 113                 SecRuleRemoveByMsg "testing rule"
 114         ),
 115         match_log => {
 116                 -error => [ qr/ModSecurity: /, 1 ],
 117                 -audit => [ qr/./, 1 ],
 118                 debug => [ qr/Starting phase REQUEST_HEADERS\..*This phase consists of 0 rule.*Starting phase RESPONSE_HEADERS\./s, 1 ],
 119                 -debug => [ qr/Access denied/, 1 ],
 120         },
 121         match_response => {
 122                 status => qr/^200$/,
 123         },
 124         request => new HTTP::Request(
 125                 GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
 126         ),
 127 },
 128
 129 # SecRuleUpdateActionById
 130 {
 131         type => "rule",
 132         comment => "SecRuleUpdateActionById",
 133         conf => qq(
 134                 SecRuleEngine On
 135                 SecDebugLog $ENV{DEBUG_LOG}
 136                 SecDebugLogLevel 9
 137                 SecRule REQUEST_URI "test" "phase:1,deny,status:500,id:1,msg:'testing rule'"
 138                 SecRuleUpdateActionById 1 "pass,nolog"
 139         ),
 140         match_log => {
 141                 -error => [ qr/ModSecurity: /, 1 ],
 142                 -audit => [ qr/./, 1 ],
 143                 debug => [ qr/id:1,.*,pass,nolog/, 1 ],
 144                 -debug => [ qr/Access denied/, 1 ],
 145         },
 146         match_response => {
 147                 status => qr/^200$/,
 148         },
 149         request => new HTTP::Request(
 150                 GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt",
 151         ),
 152 },
 153 {
 154         type => "rule",
 155         comment => "SecRuleUpdateActionById (chain)",
 156         conf => qq(
 157                 SecRuleEngine On
 158                 SecDebugLog $ENV{DEBUG_LOG}
 159                 SecDebugLogLevel 9
 160                 SecRule REQUEST_URI "test" "phase:1,deny,status:500,id:1,msg:'testing rule',chain"
 161         SecRule ARGS "bar"
 162                 SecRuleUpdateActionById 1 "pass,nolog"
 163         ),
 164         match_log => {
 165                 -error => [ qr/ModSecurity: /, 1 ],
 166                 -audit => [ qr/./, 1 ],
 167                 debug => [ qr/id:1,.*,pass,nolog/, 1 ],
 168                 -debug => [ qr/Access denied/, 1 ],
 169         },
 170         match_response => {
 171                 status => qr/^200$/,
 172         },
 173         request => new HTTP::Request(
 174                 GET => "http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt?foo=bar",
 175         ),
 176 },