SpiderLabs/ModSecurity — pull request #592 by zimmerle (2013-11-04 15:18:23+00:00)
Title: Adds support to suspicious and whitelist to Connections Read and Write limits

The operators @ipMatch, @ipMatchF and @ipMatchFromFile were added to the functions: SecReadStateLimit and SecReadStateLimit. Using them it is possible to declare a suspicious list. When a suspicious list is given, the {Read|Write}StateLimit will be applied just to the IPs that belongs to that restricted list. Note that the negative of those operators (e.g. !@ipMatch) can be used to place a whitelist. The {Read|Write}StateLimit restrictions will not be applied to those in the whitelist. This current version the Sec{Read|Write}StateLimit can be used various times to add elements to both lists, however, the last informed limit will be applied for the entire group. (See #353 for further details)

The Sec{Read|Write}StateLimits are filters related to the connections, when the server did not know yet which vhost the request goes to. This means that once those configurations are set it will be applied to entire server. This merge request also renames the Sec{Read|Write}StateLimits to SecConn{Read|Write}StateLimits to make it more clear to the user. SecConnectionEngine was also renamed to SecConnEngine.

This merge request also improve the performance of the @ipMatch operator, now searches goes under a RadixTress instead of a List.

Last improvement added by this merge request is the possibility to turn On, Off or event place the connection filters to DetectionOnly, analog to SecRuleEngine.