8000 Improve sampling efficiency2 by 53cur3M3 · Pull Request #2094 · coreruleset/coreruleset · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Improve sampling efficiency2 #2094

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jul 2, 2021
Merged

Improve sampling efficiency2 #2094

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ba320d6
Improve efficiency of sampling rules
May 21, 2021
daa0ff0
Simplify and improve sampling rule efficiency
May 21, 2021
6188741
Merge branch 'v3.4/dev' into improveSamplingEfficiency2
dune73 Jul 2, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 6 additions & 33 deletions rules/REQUEST-901-INITIALIZATION.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -369,11 +369,11 @@ SecRule TX:enforce_bodyproc_urlencoded "@eq 1" \
#
# We take the entropy contained in the UNIQUE_ID. We hash that variable and
# take the first integer numbers out of it. Theoretically, it is possible
# there are no integers in a sha1 hash. We make sure we get two
# integer numbers by taking the last two digits from the DURATION counter
# (in microseconds).
# Finally, leading zeros are removed from the two-digit random number.
#
# but highly improbable that there are no integers in a hexEncoded sha1 hash.
# In the very rare event that two integers are not matched (due to only being
# a-f in all, or all but one positions) 901450 will not be triggered.
# Leading zeros are not removed from the two-digit random number, and are
# handled gracefullly by 901450

SecRule TX:sampling_percentage "@eq 100" \
"id:901400,\
Expand All @@ -383,43 +383,16 @@ SecRule TX:sampling_percentage "@eq 100" \
ver:'OWASP_CRS/3.4.0-dev',\
skipAfter:END-SAMPLING"

SecRule UNIQUE_ID "@rx ^." \
SecRule UNIQUE_ID "@rx ^[a-f]*([0-9])[a-f]*([0-9])" \
"id:901410,\
phase:1,\
pass,\
t:sha1,t:hexEncode,\
nolog,\
ver:'OWASP_CRS/3.4.0-dev',\
setvar:'TX.sampling_rnd100=%{MATCHED_VAR}'"

SecRule DURATION "@rx (..)$" \
"id:901420,\
phase:1,\
pass,\
capture,\
nolog,\
ver:'OWASP_CRS/3.4.0-dev',\
setvar:'TX.sampling_rnd100=%{TX.sampling_rnd100}%{TX.1}'"

SecRule TX:sampling_rnd100 "@rx ^[a-f]*([0-9])[a-f]*([0-9])" \
"id:901430,\
phase:1,\
pass,\
capture,\
nolog,\
ver:'OWASP_CRS/3.4.0-dev',\
setvar:'TX.sampling_rnd100=%{TX.1}%{TX.2}'"

SecRule TX:sampling_rnd100 "@rx ^0([0-9])" \
"id:901440,\
phase:1,\
pass,\
capture,\
nolog,\
ver:'OWASP_CRS/3.4.0-dev',\
setvar:'TX.sampling_rnd100=%{TX.1}'"


#
# Sampling decision
#
Expand Down
0