的ModSecurity：removeWhitespace不工作

Question

我有以下规则：

SecRule REQUEST_HEADERS:Client-IP "@ipMatchFromFile test.txt" 
"id:210487,t:none,t:urlDecodeUni,t:removeWhitespace,drop,msg:'IP-test'" 

但是当我运行它，我得到的回应：

T (0) urlDecodeUni: "111.22.33.44 " // note the space before the " 
T (0) removeWhitespace: "111.22.33.44" // perfect! The space has been removed 
Transformation completed in 4 usec. 
Executing operator "ipMatchFromFile" with param "test.txt" against REQUEST_HEADERS:Client-IP. 
Target value: "111.22.33.44" // target value has no space, hooray! 
IPmatchFromFile: Total tree entries: 8, ipv4 8 ipv6 0 
IPmatch: bad IPv4 specification "111.22.33.44 ". // why, oh why, is the space back! 
Operator completed in 4 usec. 
Operator error: IPmatch: bad IPv4 specification "111.22.33.44 ". // that space again! 
Rule returned -1. 
Rule processing failed. 
Rule failed, not chained -> mode NEXT_RULE. 

请堆栈溢出的传说;告诉我如何解决它:-)

Answer 1

这应该工作，所以看起来像一个错误。不能说我诚实地试图匹配首先需要转换的IP地址。

因为它不是一个真正的IP地址，所以可以使用@pmFromFile而不是@ipMatchFromFile。需要注意的是the documentation警告明确，你需要正确地在这里使用界限：

由于此操作不检查匹配的时候边界， 误判在某些情况下是可能的。例如，如果您希望 使用@pm进行IP地址匹配，则短语1.2.3.4 可能会匹配多个IP地址（例如，它也会匹配 1.2.3.40或1.2.3.41）。为了避免误报，你可以在短语中使用自己的边界。例如，使用/1.2.3.4/而不是仅使用 1.2.3.4。然后，在您的规则中，也可以在适当的地方添加边界。您将在示例中找到一个完整的例子：

# Prepare custom REMOTE_ADDR variable 
SecAction "phase:1,id:168,nolog,pass,setvar:tx.REMOTE_ADDR=/%{REMOTE_ADDR}/" 

# Check if REMOTE_ADDR is blacklisted 
SecRule TX:REMOTE_ADDR "@pmFromFile blacklist.txt" "phase:1,id:169,deny,msg:'Blacklisted IP address'" 

文件blacklist.txt可能包含：

# ip-blacklist.txt contents: 
# NOTE: All IPs must be prefixed/suffixed with "/" as the rules 
# will add in this character as a boundary to ensure 
# the entire IP is matched. 
# SecAction "phase:1,id:170,pass,nolog,setvar:tx.remote_addr='/%{REMOTE_ADDR}/'" 
/1.2.3.4/ 
/5.6.7.8/