New TAG for each ruleset file

Motivation

sometimes I need to exclude a whole CRS ruleset file (included on the main modsecurity.conf) just when occurs a certain condition. For example when 2 different websites share the same modsecurity.conf but need two completely different configurations.

Proposed solution

Add a tag for each rule on the same ruleset file that could be used to remove them “on the fly”. For example: all rules in REQUEST-912-DOS-PROTECTION.conf have the tag file-request-dos-protection all rules in REQUEST-930-APPLICATION-ATTACK-LFI.conf have the tag file-request-application-attack-lfi etc…

Alternatives

Or just set a tag based on rules prefix number, something like: all rules in REQUEST-912-DOS-PROTECTION.conf have the tag request-912 all rules in REQUEST-930-APPLICATION-ATTACK-LFI.conf have the tag request-930 etc…

if you all agree, I can send a PR

[dune73]

Awesome plan. Let’s talk about a good placement at the next project chat (-> add to agenda)

[theMiddleBlue]

thanks to @airween msc_pyparser module, I’ve created a script to append, rename or remove tags from rules in file (if someone need it I can push it somewhere):

python3 rule-ctl.py \
   --config ../../rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf \
   --filter-rule-id '^933.+' \
   --append-tag 'req-933' > tmp/test.conf

how about adding a short tag like (req|res)-❤️ digit id> ?