Re: [Mod-security-developers] Question regarding transaction::processConnection()

[Felipe C. <FC...@tr...>]

Hi Jai,

What is the version of yours libModSecurity? Do you happen to have any public rule set loaded? If so, can you share the version info?

Br.,
Felipe “Zimmerle” Costa
Security Researcher, Lead Developer ModSecurity.

Trustwave | SMART SECURITY ON DEMAND
www.trustwave.com<http://www.trustwave.com/>

From: Jai Harpalani via mod-security-developers <mod...@li...>
Reply-To: "mod...@li..." <mod...@li...>
Date: Tuesday, March 6, 2018 at 9:16 PM
To: "mod...@li..." <mod...@li...>
Cc: Jai Harpalani <jai...@mu...>
Subject: [Mod-security-developers] Question regarding transaction::processConnection()

What is the purpose of transaction::processConnection()? I see that after populating IP addresses and Port addresses, it invokes evaluate() with ConnectionPhase. Can someone elaborate on what this evaluate() call will check?  I see the below rules for the ConnectionPhase in my system, but all RuleIds = 0 so I do not know what these rules do.

Phase: 0 (18 rules)
    Rule ID: 0--0x555556494c20
    Rule ID: 0--0x5555563d9d20
    Rule ID: 0--0x555556426550
    Rule ID: 0--0x55555632f880
    Rule ID: 0--0x5555563fe760
    Rule ID: 0--0x5555562776f0
    Rule ID: 0--0x55555627f750
    Rule ID: 0--0x5555560997f0
    Rule ID: 0--0x5555566eec00
    Rule ID: 0--0x5555567247b0
    Rule ID: 0--0x555556731f50
    Rule ID: 0--0x5555567c1b70
    Rule ID: 0--0x55555673e0d0
    Rule ID: 0--0x555556740250
    Rule ID: 0--0x555555e96650
    Rule ID: 0--0x5555567dbc40
    Rule ID: 0--0x5555567dc260
    Rule ID: 0--0x5555567e75c0

Thanks,
Jai