Topic: mod_security 2.7 rc3 rule exceptions issue

[pipedevil]

Hi dear forum participants,

I have an issue adding rule exception to mod_security configuration files.
Exception should bypass DEFINED rule-id for DEFINED ARGUMENT, when the DEFINED ARGUMENT(php variable in the request) equals SPECIFIC VALUE

Example:
www.somedomain.com/index.php?VARIABLE=VALUE


Here is the resulting rule (based on documentation reveiw):
SecRule ARGS_NAMES:VARIABLE "@eq VALUE" "phase:1,t:none,nolog,pass,ctl:ruleUpdateTargetById=981173;!ARGS:VARIABLE"

When I add the string to the mod_security 15 config file, apache won't start.

What could be the cause?

[Steffen]

Anything in the Apache error.log and/or Windows Event Viewer.

Btw.
Best is to post rule issues at the mod_security newsgroup.

[pipedevil]

Nothing interesting in Apache error.log, but Windows application log has the following errors:

***
The Apache service named reported the following error:
>>> Error parsing actions: Invalid ctl name setting: ruleUpdateTargetById .
***
The Apache service named reported the following error:
>>> AH00526: Syntax error on line 36 of C:/xampp/apache/modules/mod_security2/modsecurity_crs_15_custom_rules.conf: .
***


It seems that error is in ruleUpdateTargetById statement, but it has been officially documented at
http://blog.spiderlabs.com/2011/08/modsecurity-advanced-topic-of-the-week-exception-handling.html

in "(New) Conditionally Updating the Target List" section. I still can't understand what i've missed?

[Steffen]

You can try the just released 2.6.8 , get it from http://www.apachehaus.com/

Steffen

[pipedevil]

Steffen is that only the solution?

Cause everything works fine(I mean apache starts with mod_security without any errors) till I add an exception to conf 15 file with statements described in first post

[Steffen]

Got an answer from the author.