modsecurity：SecRule REQUEST_METHOD“！^OPTIONS$” “t：无”

发布于 2024-12-09 22:44:14 字数 1275 浏览 1 评论 0原文

Modsecurity 问题...

下面的 REQUEST_METHOD 测试在做什么？它出现两次。

SecRule REQUEST_METHOD "!^OPTIONS$" "t:none"

SecRule &REQUEST_HEADERS:Accept "@eq 0" \
    "chain,phase:2,skip:1,t:none,deny,log,auditlog,status:400,msg:'Request Missing an Accept Header', severity:'2',id:'960015',tag:'PROTOCOL_VIOLATION/MISSING_HEADER'"
SecRule REQUEST_METHOD "!^OPTIONS$" "t:none"
SecRule REQUEST_HEADERS:Accept "^$" \
    "chain,phase:2,t:none,deny,log,auditlog,status:400,msg:'Request Missing an Accept Header', severity:'2',id:'960015',tag:'PROTOCOL_VIOLATION/MISSING_HEADER'"
SecRule REQUEST_METHOD "!^OPTIONS$" "t:none"
SecRule &REQUEST_HEADERS:User-Agent "@eq 0" \
    "skip:1,phase:2,t:none,deny,log,auditlog,status:400,msg:'Request Missing a User Agent Header',id:'960009',tag:'PROTOCOL_VIOLATION/MISSING_HEADER',severity:'4'"
SecRule REQUEST_HEADERS:User-Agent "^$" \
    "t:none,deny,log,auditlog,status:400,msg:'Request Missing a User Agent Header',id:'960009',tag:'PROTOCOL_VIOLATION/MISSING_HEADER',severity:'4'"
SecMarker 969999

请不要解释整个事情，我可以阅读其他所有内容。看起来 REQUEST_METHOD 测试是某种巫毒……

顺便说一句，Accept 测试是错误的。根据 HTTP，Accept 选项不是必需的。

原文

Modsecurity question...

What is the REQUEST_METHOD test doing in the following? It appears twice.

SecRule REQUEST_METHOD "!^OPTIONS$" "t:none"

SecRule &REQUEST_HEADERS:Accept "@eq 0" \
    "chain,phase:2,skip:1,t:none,deny,log,auditlog,status:400,msg:'Request Missing an Accept Header', severity:'2',id:'960015',tag:'PROTOCOL_VIOLATION/MISSING_HEADER'"
SecRule REQUEST_METHOD "!^OPTIONS$" "t:none"
SecRule REQUEST_HEADERS:Accept "^$" \
    "chain,phase:2,t:none,deny,log,auditlog,status:400,msg:'Request Missing an Accept Header', severity:'2',id:'960015',tag:'PROTOCOL_VIOLATION/MISSING_HEADER'"
SecRule REQUEST_METHOD "!^OPTIONS$" "t:none"
SecRule &REQUEST_HEADERS:User-Agent "@eq 0" \
    "skip:1,phase:2,t:none,deny,log,auditlog,status:400,msg:'Request Missing a User Agent Header',id:'960009',tag:'PROTOCOL_VIOLATION/MISSING_HEADER',severity:'4'"
SecRule REQUEST_HEADERS:User-Agent "^$" \
    "t:none,deny,log,auditlog,status:400,msg:'Request Missing a User Agent Header',id:'960009',tag:'PROTOCOL_VIOLATION/MISSING_HEADER',severity:'4'"
SecMarker 969999

Please, don't explain the whole thing, I can read everything else. It looks like the REQUEST_METHOD test, however, is some sort of voodoo...

BTW, the test of the Accept is wrong. The Accept option is not mandatory as per HTTP.

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

东走西顾 2024-12-16 22:44:14

虽然规则 SecRule REQUEST_METHOD "!^OPTIONS$" "t:none" 出现了两次，但每次都与另一个规则链接。

链是 ModSecurity 中的一个操作，它将两个或多个规则组合成一个规则。

第一条规则现在是：

SecRule &REQUEST_HEADERS:Accept "@eq 0" \
   "chain,phase:2,skip:1,t:none,deny,log,auditlog,status:400,msg:'Request Missing an Accept Header', severity:'2',id:'960015',tag:'PROTOCOL_VIOLATION/MISSING_HEADER'"
SecRule REQUEST_METHOD "!^OPTIONS$" "t:none"

第二条规则现在是：

SecRule REQUEST_HEADERS:Accept "^$" \
    "chain,phase:2,t:none,deny,log,auditlog,status:400,msg:'Request Missing an Accept Header', severity:'2',id:'960015',tag:'PROTOCOL_VIOLATION/MISSING_HEADER'"
SecRule REQUEST_METHOD "!^OPTIONS$" "t:none"

Although the Rule SecRule REQUEST_METHOD "!^OPTIONS$" "t:none" appeared twice but each time it is chained with another rule.

Chain is an action in ModSecurity that combine two or more Rules to form a single Rule.

1st rule is now:

SecRule &REQUEST_HEADERS:Accept "@eq 0" \
   "chain,phase:2,skip:1,t:none,deny,log,auditlog,status:400,msg:'Request Missing an Accept Header', severity:'2',id:'960015',tag:'PROTOCOL_VIOLATION/MISSING_HEADER'"
SecRule REQUEST_METHOD "!^OPTIONS$" "t:none"

2nd rule is now:

SecRule REQUEST_HEADERS:Accept "^$" \
    "chain,phase:2,t:none,deny,log,auditlog,status:400,msg:'Request Missing an Accept Header', severity:'2',id:'960015',tag:'PROTOCOL_VIOLATION/MISSING_HEADER'"
SecRule REQUEST_METHOD "!^OPTIONS$" "t:none"

回复收藏 0 原文

~没有更多了~