LSWS 4.2.2 VS mod_security

[DraCoola]

Originally Posted by brrr

After several years of running the same rules on LSWS Standard without any problem all the way up to 4.2.1, I just upgraded to 4.2.2 and now see a lot of this:

2013-03-23 13:26:04.114 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.114 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.114 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.114 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.114 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.114 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.114 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.114 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.114 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.114 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.114 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.114 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.114 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.114 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.114 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.114 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.114 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.114 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.114 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.114 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.115 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.115 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.115 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.115 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.115 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.115 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.115 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.115 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.115 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.115 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.115 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.115 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.115 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.115 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.115 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.115 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.115 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.115 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.115 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.115 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT
2013-03-23 13:26:04.115 ERROR [ModSecurity] unknown server variable while parsing: HEADER_USER_AGENT

The rules are simple ones that looks like this:


or


And the action is:


Why do these rules break now?

hi brr,

you might want to try "SecRule REQUEST_HEADERS:User-Agent" than "SecFilterSelective HEADER_USER_AGENT"

[mistwang]

Yes, time to update your mod_sec rules to 2.5+ syntax.

[brrr]

Thank you DraCoola and mistwang! Using the 2.5 syntax did work.

I should have updated the syntax to 2.5 a long time ago I suppose.

But it was a case of 'if it ain't broke, don't fix it', so up until 4.2.2, I got lazy.