-
-
Notifications
You must be signed in to change notification settings - Fork 219
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Incorrect Macro Expansions for Log and Msg of Chained Rule #193
Comments
IMHO this would not work. A rule like the following would require preserving the last chain. So it would be better to preserve the match message and data from the rule/subrule where the msg, logdata action are specified. I have a fix in work that solves this.
|
@piyushroshan |
This issue is stale because it has been open for 30 days with no activity. |
This was fixed, right @piyushroshan ? |
Yes. |
Description
The MATCHED_VAR_NAME is taken from the chained rule. It should instead be taken from the rule where msg action is defined.
Variables are expanded incorrectly for Log and Msg of Rule
MATCHED_VAR expands to REQUEST_HEADERS:host i.e key but it should be attack i.e. value of MATCHED_VAR
MATCHED_VAR_NAME expands to MATCHED_VARS_NAMES:REQUEST_HEADERS:host i.e. key:value but it should be value of MATCHED_VAR_NAME
It seems the msg, data gets overridden as the chain rule gets evaluated.
Steps to reproduce
Expected result
Actual result
The text was updated successfully, but these errors were encountered: