CRS and v3 incompatibility due to ruleRemoveByTag

[theMiddleBlue]

Hi all,

it seems that we've a compatibility problem with CRS and v3 due to missing ctl:ruleRemoveTargetByTag and ctl:ruleRemoveByTag. Can you confirm the following two issues?

• libmodsecurity (v3) incompatible ctl:ruleRemoveByTag in rules/REQUEST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf SpiderLabs/owasp-modsecurity-crs#1418
• Exclusion rules doesn't work with libmodsecurity (v3) due to ctl:ruleRemoveTargetByTag SpiderLabs/owasp-modsecurity-crs#1419

If yes, is there a plan on when they will be implemented on v3?

thank you!

[theMiddleBlue]

additional bit: it seems that ctl:ruleRemoveById works only if the first argument is an id and not a range, example:

• ctl:ruleRemoveById=1234 work
• ctl:ruleRemoveById=900000-999999 doesn't work (used in some CRS exclusion rule files)

thanks.

[theMiddleBlue]

all problems seems to be related just to ctl:ruleRemoveTargetByTag and ctl:ruleRemoveByTag (thanks @airween). I'm trying to understand why some of my exclusion rules that use ranges in ctl:ruleRemoveById doesn't work as expected on v3.

[airween]

Okay, the ruleRemoveById issue had been cleared :).

Here is a possible solution for ruleRemoveByTag:
https://github.com/airween/ModSecurity/tree/v3/issue2099
v3/master...airween:v3/issue2099

Please check that if works as well or you found any other problem (only with ruleRemoveByTag ctl action).

I'll continue with the ruleRemoveTargetByTag investigation.

[theMiddleBlue]

Thank you @airween

after testing your patch it seems that all works like a charm! Maybe I've tested ctl: ruleRemoveTargetByTag with a buggy rule because it works too!

thank you so much for your support, as always!

[airween]

PR sent: #2102