Expand macro functionality

[rcbarnett-zz]

MODSEC-64: Some ideas for making macros more useful:

• %{&COLLECTION} -- count of COLLECTION variables
• %{t(lowercase,ARGS)} -- Allow transformations in macros
• %{rand(N)} -- Allow other functions like random values (should be extendible via API)
• Allow defining macros -- SecMacro FOO "foo"
  These are config time macros vs runtime. Maybe use %{{CONFIG_MACRO}}?
• Allow defining macros with parameters -- SecMacro FOO(bar) "foo%{bar}"
• Allow macro expansion in TARGETS (at least config-time) -- ARGS|%{{CUSTOM_FIELDS}}
  {noformat}
  SecMacro CUSTOM_TARGETS "ARGS|!ARGS:description"
  ...
  SecRule %{{CUSTOM_TARGETS}} "foo" "..."
  {noformat}

[rcbarnett-zz]

Original reporter: brectanus

[rcbarnett-zz]

marcstern: About defining macros, does it worth to include this in ModSecurity when there is mod_define & mod_macro?
Would it add something more?

[rcbarnett-zz]

brectanus: Yes:

1. They can use internal modsecurity values
2. They can be interpreted at runtime (not just config time)

[rcbarnett-zz]

rbarnett: It would be useful of macro expansion could support collections such as:

%{matched_vars}
%{args}
%{request_headers}

[zimmerle]

Having support for variable counter on macros at v3/dev/issue_215 -- 7857031

In v3 collection variables (Anchored ones, e.g. REQUEST_HEADERS) are expanded to all values.