{"action":"created","issue":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1817","repository_url":"https://api.github.com/repos/SpiderLabs/ModSecurity","labels_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1817/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1817/comments","events_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1817/events","html_url":"https://github.com/SpiderLabs/ModSecurity/issues/1817","id":335185020,"node_id":"MDU6SXNzdWUzMzUxODUwMjA=","number":1817,"title":"v3/master chained SecRule using RESPONSE_HEADERS ","user":{"login":"theMiddleBlue","id":4454961,"node_id":"MDQ6VXNlcjQ0NTQ5NjE=","avatar_url":"https://avatars0.githubusercontent.com/u/4454961?v=4","gravatar_id":"","url":"https://api.github.com/users/theMiddleBlue","html_url":"https://github.com/theMiddleBlue","followers_url":"https://api.github.com/users/theMiddleBlue/followers","following_url":"https://api.github.com/users/theMiddleBlue/following{/other_user}","gists_url":"https://api.github.com/users/theMiddleBlue/gists{/gist_id}","starred_url":"https://api.github.com/users/theMiddleBlue/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theMiddleBlue/subscriptions","organizations_url":"https://api.github.com/users/theMiddleBlue/orgs","repos_url":"https://api.github.com/users/theMiddleBlue/repos","events_url":"https://api.github.com/users/theMiddleBlue/events{/privacy}","received_events_url":"https://api.github.com/users/theMiddleBlue/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-06-24T14:47:37Z","updated_at":"2018-06-24T17:48:46Z","closed_at":"2018-06-24T17:48:46Z","author_association":"NONE","body":"Hi,\r\n\r\nIs there a problem using RESPONSE_HEADERS as the last rule in a chain. Examples:\r\n\r\nTest response with 2 `Set-Cookie` response headers:\r\n```\r\n# curl -v localhost/test.php\r\n*   Trying 127.0.0.1...\r\n* TCP_NODELAY set\r\n* Connected to localhost (127.0.0.1) port 80 (#0)\r\n> GET /test.php HTTP/1.1\r\n> Host: localhost\r\n> User-Agent: curl/7.58.0\r\n> Accept: */*\r\n> \r\n< HTTP/1.1 200 OK\r\n< Server: openresty/1.13.6.2\r\n< Date: Sun, 24 Jun 2018 14:37:46 GMT\r\n< Content-Type: text/html; charset=UTF-8\r\n< Transfer-Encoding: chunked\r\n< Connection: keep-alive\r\n< X-Powered-By: PHP/7.2.6\r\n< Set-Cookie: TestCookie1=asd\r\n< Set-Cookie: TestCookie2=asd\r\n< \r\ntest\r\n\r\n* Connection #0 to host localhost left intact\r\n```\r\n\r\n**Not working** chained rules:\r\n```\r\nSecRule REQUEST_METHOD \"^GET$\" \"phase:1,id:22900001,nolog,chain,pass\"\r\n  SecRule REQUEST_FILENAME \"^/test\\.php$\" \"phase:2,id:22900001,nolog,chain\"\r\n    SecRule &RESPONSE_HEADERS:Set-Cookie \"@gt 0\" \"phase:3,id:22900001,log\"\r\n```\r\n\r\n**Not working** debug output:\r\n```\r\n[4] (Rule: 22900001) Executing operator \"Rx\" with param \"^GET$\" against REQUEST_METHOD.\r\n[9] Target value: \"GET\" (Variable: REQUEST_METHOD)\r\n[9] Matched vars updated.\r\n[4] Rule returned 1.\r\n[4] Executing chained rule.\r\n[4] (Rule: 22900001) Executing operator \"Rx\" with param \"^/test\\.php$\" against REQUEST_FILENAME.\r\n[9] Target value: \"/test.php\" (Variable: REQUEST_FILENAME)\r\n[9] Matched vars updated.\r\n[4] Rule returned 1.\r\n[4] Executing chained rule.\r\n[4] (Rule: 22900001) Executing operator \"Gt\" with param \"0\" against RESPONSE_HEADERS:Set-Cookie.\r\n[9] Target value: \"0\" (Variable: RESPONSE_HEADERS:Set-Cookie)\r\n[4] Rule returned 0.\r\n[9] Matched vars cleaned.\r\n```\r\n\r\nIt seems that it works only if I put the `&RESPONSE_HEADERS:Set-Cookie` as the first rule of the chain... is it an expected behavior?\r\n\r\n**Working** rules:\r\n```\r\nSecRule &RESPONSE_HEADERS:Set-Cookie \"@gt 0\" \"phase:3,id:22900001,nolog,chain,pass\"\r\n  SecRule REQUEST_METHOD \"^GET$\" \"phase:1,id:22900001,nolog,chain\"\r\n    SecRule REQUEST_FILENAME \"^/test\\.php$\" \"phase:2,id:22900001,log\"\r\n```\r\n\r\n**Working** debug output\r\n```\r\n[4] (Rule: 22900001) Executing operator \"Gt\" with param \"0\" against RESPONSE_HEADERS:Set-Cookie.\r\n[9] Target value: \"2\" (Variable: RESPONSE_HEADERS:Set-Cookie)\r\n[9] Matched vars updated.\r\n[4] Rule returned 1.\r\n[4] Executing chained rule.\r\n[4] (Rule: 22900001) Executing operator \"Rx\" with param \"^GET$\" against REQUEST_METHOD.\r\n[9] Target value: \"GET\" (Variable: REQUEST_METHOD)\r\n[9] Matched vars updated.\r\n[4] Rule returned 1.\r\n[4] Executing chained rule.\r\n[4] (Rule: 22900001) Executing operator \"Rx\" with param \"^/test\\.php$\" against REQUEST_FILENAME.\r\n[9] Target value: \"/test.php\" (Variable: REQUEST_FILENAME)\r\n[9] Matched vars updated.\r\n[4] Running [independent] (non-disruptive) action: log\r\n[9] Saving transaction to logs\r\n[4] Rule returned 1.\r\n[9] (SecDefaultAction) Running action: log\r\n```\r\n\r\nthanks.\r\n\r\nnginx version:\r\n```\r\n# /usr/local/openresty/nginx/sbin/nginx -V\r\nnginx version: openresty/1.13.6.2\r\nbuilt by gcc 7.3.0 (Ubuntu 7.3.0-16ubuntu3) \r\nbuilt with OpenSSL 1.1.0g  2 Nov 2017\r\nTLS SNI support enabled\r\nconfigure arguments: --prefix=/usr/local/openresty/nginx --with-cc-opt=-O2 --add-module=../ngx_devel_kit-0.3.0 --add-module=../echo-nginx-module-0.61 --add-module=../xss-nginx-module-0.06 --add-module=../ngx_coolkit-0.2rc3 --add-module=../set-misc-nginx-module-0.32 --add-module=../form-input-nginx-module-0.12 --add-module=../encrypted-session-nginx-module-0.08 --add-module=../srcache-nginx-module-0.31 --add-module=../ngx_lua-0.10.13 --add-module=../ngx_lua_upstream-0.07 --add-module=../headers-more-nginx-module-0.33 --add-module=../array-var-nginx-module-0.05 --add-module=../memc-nginx-module-0.19 --add-module=../redis2-nginx-module-0.15 --add-module=../redis-nginx-module-0.3.7 --add-module=../rds-json-nginx-module-0.15 --add-module=../rds-csv-nginx-module-0.09 --add-module=../ngx_stream_lua-0.0.5 --with-ld-opt=-Wl,-rpath,/usr/local/openresty/luajit/lib --add-module=/opt/openresty-1.13.6.2/../ModSecurity-nginx --with-stream --with-stream_ssl_module --with-http_ssl_module\r\n```\r\n\r\nModSecurity version:\r\n```\r\nModSecurity - v3.0.2-68-gce131593 for Linux\r\n \r\n Mandatory dependencies\r\n   + libInjection                                  ....v3.0.2-68-gce131593\r\n   + SecLang tests                                 ....ce131593\r\n \r\n Optional dependencies\r\n   + GeoIP/MaxMind                                 ....found \r\n      * (GeoIP) v1.6.12\r\n         -lGeoIP, -I/usr/include/\r\n   + LibCURL                                       ....found v7.58.0 \r\n      -lcurl,  -DWITH_CURL_SSLVERSION_TLSv1_2 -DWITH_CURL\r\n   + YAJL                                          ....found v2.1.0\r\n      -lyajl, -DWITH_YAJL -I/usr/include/yajl\r\n   + LMDB                                          ....disabled\r\n   + LibXML2                                       ....found v2.9.4\r\n      -lxml2, -I/usr/include/libxml2 -DWITH_LIBXML2\r\n   + SSDEEP                                        ....not found\r\n   + LUA                                           ....found v502\r\n      -llua5.2 -L/usr/lib/x86_64-linux-gnu/, -DWITH_LUA -DWITH_LUA_5_2 -I/usr/include/lua5.2\r\n \r\n Other Options\r\n   + Test Utilities                                ....enabled\r\n   + SecDebugLog                                   ....enabled\r\n   + afl fuzzer                                    ....disabled\r\n   + library examples                              ....enabled\r\n   + Building parser                               ....disabled\r\n   + Treating pm operations as critical section    ....disabled\r\n```"},"comment":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/comments/399774320","html_url":"https://github.com/SpiderLabs/ModSecurity/issues/1817#issuecomment-399774320","issue_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1817","id":399774320,"node_id":"MDEyOklzc3VlQ29tbWVudDM5OTc3NDMyMA==","user":{"login":"theMiddleBlue","id":4454961,"node_id":"MDQ6VXNlcjQ0NTQ5NjE=","avatar_url":"https://avatars0.githubusercontent.com/u/4454961?v=4","gravatar_id":"","url":"https://api.github.com/users/theMiddleBlue","html_url":"https://github.com/theMiddleBlue","followers_url":"https://api.github.com/users/theMiddleBlue/followers","following_url":"https://api.github.com/users/theMiddleBlue/following{/other_user}","gists_url":"https://api.github.com/users/theMiddleBlue/gists{/gist_id}","starred_url":"https://api.github.com/users/theMiddleBlue/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theMiddleBlue/subscriptions","organizations_url":"https://api.github.com/users/theMiddleBlue/orgs","repos_url":"https://api.github.com/users/theMiddleBlue/repos","events_url":"https://api.github.com/users/theMiddleBlue/events{/privacy}","received_events_url":"https://api.github.com/users/theMiddleBlue/received_events","type":"User","site_admin":false},"created_at":"2018-06-24T17:48:46Z","updated_at":"2018-06-24T17:48:46Z","author_association":"NONE","body":"solved by placing all rules on the same phase. I think it's the intended way for chained rules, but this detail is not present on the wiki :/ sorry"}}
{"actor":{"display_login":"theMiddleBlue"}}