Meena Vyas

Element	Possible Values	Description
<config-file>	Text	This element may be present at the virtual-server level as well as at the server level. Points to a file containing ModSecurity rules. As with all file paths in server.xml it may be an absolute path or a relative path, in which case it is relative to the config directory. The file name component may contain wildcard characters to specify multiple files within the given directory. Multiple config-file elements may be present as well.

Additions to obj.conf

A new AuthTrans SAF, secrule-config, is introduced to control the behavior of the ModSecurity engine.

The following table describes parameters for the secrule-config function.

Parameter	Description
engine	(Optional) Indicates how SecRule directives are processed at request time. "on" indicates that the directives should be applied. "off" indicates that the directives should not be applied. "detection only" indicates that the directives should be evaluated but the result of the evaluation should not be enforced. The default value is what is set by SecRuleEngine directive (if any) in configuration file(s) specified by <config-file> element. If SecRuleEngine directive is not present, it is "off".
process-request-body	(Optional) Indicates whether request bodies are processed when evaluating SecRule directives. When request body processing is enabled, the server will buffer the entire request body in memory, up to the limit defined by SecRequestBodyInMemoryLimit directive (if any) in configuration file(s) specified by <config-file> element. If SecRequestBodyInMemoryLimit directive is not present, it is "131072". "on" indicates that request bodies should be processed. "off" indicates that response bodies should not be processed. The default value is what is set by SecRequestBodyAccess directive (if any) in configuration file(s) specified by <config-file> element. If SecRequestBodyAccess directive is not present, it is "off".
process-response-body	(Optional) Indicates whether response bodies are processed when evaluating SecRule directives. When response body processing is enabled, the server will buffer the entire response body in memory, up to the limit defined by SecResponseBodyLimit directive (if any) in configuration file(s) specified by <config-file> element. If SecResponseBodyLimit directive is not present, it is "524288". "on" indicates that response bodies should be processed. "off" indicates that response bodies should not be processed. The default value is what is set by SecResponseBodyAccess  directive (if any) in configuration file(s) specified by <config-file> directive. If SecResponseBodyAccess directive is not present, it is "off".

Example

# Disable SecRule processing in the /docs directory
<Object ppath="/docs/*">
AuthTrans fn="secrule-config" engine="off"
</Object>

SecRuleEngine, SecRequestBodyAccess and SecRequestBodyAccess will still work in the files specified in <config-file> in server.xml.

Sample :

I changed server.xml to have a new config-file element as shown below:
  <virtual-server>
    <config-file>sample.conf</config-file>
    <name>test</name>
    <host>...</host>
    <http-listener-name>http-listener-1</http-listener-name>
  </virtual-server>

and added this file in <ws7.0u2-server-install-dir>/https-test/config directory



I started the server. I get this warning at the time of server start up

Now I send these two requests :

The first request got denied as the header value matched with "SecRule REQUEST_HEADERS "request_headers_match"" rule in sample.conf as shown below :

Note that this is an untested feature and may have bugs. Please let me know if you find any.

Currently Supported ModSecurity Directives

Due to time constraints not all of the ModSecurity directives are supported in this release. This section documents the supported subset. Note that the supported rules are based on ModSecurity 2.0.

The terms and interfaces given below are taken from ModSecurity 2.0 documentation
http://www.modsecurity.org/documentation/modsecurity-apache/2.0.0-rc-4/modsecurity2-apache-reference.html

Some of these keywords like VARIABLES etc. are abstract quantities and not elements.

Directive	Values	Description
SecRuleEngine	On Off DetectionOnly	server initialization Default value is "off"

Directive	Values	Description
SecRule	VARIABLES " [@OPERATOR] Text regular expression or parameters to pass to the operator " [ACTIONS]
VARIABLES	[&!]VARIABLE[:/regular-expression/]| [&!]VARIABLE[:name]| [&!]VARIABLE[:regular-expression]...
	&	should count the number of variables in the array.
	!	x|!x:y examine all x but y should not be checked.
	|	concatenate variables
	:name	a particular value
	:/regular_expression/ or :'/regular_expression/'	matches regular expression

	Values	Description
VARIABLE	REQUEST_HEADERS
	REQUEST_HEADERS_NAMES
	REQUEST_HEADERS:yyy or REQUEST_HEADERS:/yyy/	Where yyy is any applicable request header name.
	ARGS	Contains request body if SecRequestBodyAccess is set to on.
	ARGS_NAMES
	ARGS_COMBINED_SIZE
	AUTH_TYPE
	ENV
	QUERY_STRING
	HTTP_yyy
	TIME, TIME_EPOCH, TIME_DAY, TIME_HOUR, TIME_MIN,  TIME_SEC, TIME_WDAY, TIME_MON, TIME_YEAR
	REMOTE_HOST, REMOTE_PORT, REMOTE_USER, REMOTE_ADDRESS
	PATH_INFO
	SERVER_NAME, SERVER_PORT, SERVER_ADDR
	SCRIPT_BASENAME, SCRIPT_FILENAME
	REQUEST_COOKIES
	REQUEST_COOKIES_NAMES
	REQUEST_FILENAME
	REQUEST_BASENAME
	REQUEST_BODY
	REQUEST_LINE
	REQUEST_METHOD
	REQUEST_PROTOCOL
	REQUEST_URI, REQUEST_URI_RAW
	RESPONSE_BODY
	RESPONSE_STATUS
	RESPONSE_HEADERS
	RESPONSE_HEADERS_NAMES
	RESPONSE_PROTOCOL

	Values
OPERATOR	rx
	eq
	ge
	gt
	le
	lt
	validateByteRange

	Values	Description
ACTIONS	ACTION[:xxx], ACTION[:xxx] ...

	Values
ACTION	allow
	msg
	id
	rev
	severity
	log
	deny
	status
	phase
	t
	skip
	chain

	Values	Description
phase	[1..4]	phase:1 - Request headers stage phase:2 - Request body stage phase:3 - Response headers stage phase:4 - Response body stage Default value is phase:2 Note that operations on "phase:5 (Logging stage)" are not supported. If encountered, these are ignored and a log message is recorded.

	Values	Description
t	lowercase	Transformation functions to perform on the variables before operator is executed (this includes request body)
	urlDecode
	none
	compressWhitespace
	removeWhitespace
	replaceNulls
	removeNulls

Directive	Values	Description
SecDefaultAction	ACTIONS	For a SecRule, if the previous SecDefaultAction directive is present, those actions takes into effect. If none of these SecDefaultAction directives are present before a SecRule (in that file or files loaded before it), default SecDefaultAction directive with ACTIONS "log,deny,status:403,phase:2,t:replaceNulls,t:compressWhitespace,t:lowercase" is internally added.

For the following directives, in case the multiple directives are present (in one or multiple files), last directive's value takes the precedence.

Directive	Values	Description
SecRequestBodyAccess	On Off	Whether the server should parse request body or not. Default value is "off"

Directive	Values	Description
SecRequestBodyInMemoryLimit	integer	Configures the maximum request body size server will store in memory. By default the limit is 128 KB (131072)