modsecurity 3.x about nested variables question

[liusir-ht]

Configuration file contents:
Include /usr/local/nginx/conf/modsec/modsecurity.conf SecDefaultAction "phase:1,log,auditlog,deny,status:403" SecRule REQUEST_URI "@streq /phpmyadmin" "id:10001,phase:1,log,pass,msg:' uri = /phpmyadmin'" SecAction "phase:1,pass,log,setvar:ip.counter_%{REMOTE_ADDR}=+1,expirevar:ip.counter_%{REMOTE_ADDR}=3600,msg:'ip.counter_%{REMOTE_ADDR} counter+1,current counter: %{IP:COUNTER_%{REMOTE_ADDR}} '" SecAction "phase:1,pass,log,setvar:ip.cishu=%{IP:COUNTER_%{REMOTE_ADDR} },msg:'cishu=%{IP:COUNTER_%{REMOTE_ADDR} }'" SecAction "phase:1,pass,log,msg:'echo %{IP.CISHU}'" SecRule %{IP:COUNTER_%{REMOTE_ADDR}} "@gt 10" "id:2,phase:1,deny,log,auditlog,status:403,msg:'Access denied.'"
When I use/usr/local/nginx/sbin/nginx - c/usr/local/nginx/conf/nginx. Conf -s reload

modsecurity 3.x uses nested variables and has the following error:
nginx: [emerg] "modsecurity_rules_file" directive Rules error. File: /usr/local/nginx/conf/modsec/main.conf. Line: 11. Column: 114. Expecting a variable, got: : %{IP:COUNTER_%{REMOTE_ADDR}} "@gt 10" "id:2,phase:1,deny,log,auditlog,status:403,msg:'Access denied.'" in /usr/local/nginx/conf/nginx.conf:82

[martinhsv]

Hello @liusir-ht ,

If you want a variable to exist per IP address, the common way to do that is to use the special IP collection.

During each transaction, the collection needs to be initialized with https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v3.x%29#initcol

Then you can update the variable using a syntax like this

setvar:ip.counter=+1

Access is similar:

msg:'counter: %{ip.counter}'

[liusir-ht]

Hello, @martinhsv ,
when I use this config file content,is ok.
SecAction "id:1,phase:1,log,initcol:ip=%{REMOTE_ADDR},setvar:ip.rate-limit=0" SecRule REQUEST_FILENAME "@streq /phpmyadmin" \ "id:2,phase:1,chain,log,auditlog,\ setvar:ip.rate-limit=+1,\ expirevar:ip.rate-limit=60,\ deny,status:403,\ msg:'IP rate limit exceeded,current rate-limit %{REMOTE_ADDR}---- %{IP:RATE-LIMIT}'" SecRule IP:RATE-LIMIT "@gt 10"
But use this config file, expirevar:ip.rate-limit=60 does not take effect

[martinhsv]

There is an open issue for the implementation of expirevar functionality: #1803

[liusir-ht]

OK,Thanks