TX.partial_match returned when TX.partial requested

[michaelgranzow-avi]

"SecRuleEngine On",
"SecRule REMOTE_ADDR \"@unconditionalMatch\" \"id:1,deny,setvar:TX.partial_match=1,chain\"",
"SecRule TX.partial \"@gt 0\" \"id:2,t:lowercase,t:none,status:444\""

The second (chained) rule should never fire because there is no variable 'TX.partial', only 'TX.partial_match'. But it does fire:

[8] Saving variable: TX:partial_match with value: 1
[4] Rule returned 1.
[4] Executing chained rule.
[4] (Rule: 2) Executing operator "Gt" with param "0" against TX:partial.
[9] Target value: "1" (Variable: TX:partial)
[9] Matched vars updated.
[4] Rule returned 1.

[zimmerle]

Hi @michaelgranzow-avi,

Thank you. We already saw your comments on victor`s pull request. It is on our queue to be fixed.

[michaelgranzow-avi]

This change fixes both issues (the partial match and the performance degradation) by going back to the original code:

commit ec90bad44e6bf27eeae98a9ca5474b303fec1110 (HEAD -> Issue-1818_partial-match_v3-master)
Author: michaelgranzow-avi <michael@avinetworks.com>
Date:   Mon Jun 25 21:43:33 2018 +0200

    Variable names must match fully, not partially; also revert to hash table lookup instead of linear search

diff --git a/src/collection/backend/in_memory-per_process.cc b/src/collection/backend/in_memory-per_process.cc
index 65e3371d..f627aaef 100644
--- a/src/collection/backend/in_memory-per_process.cc
+++ b/src/collection/backend/in_memory-per_process.cc
@@ -105,10 +105,9 @@ void InMemoryPerProcess::resolveMultiMatches(const std::string& var,
             l->insert(l->begin(), new VariableValue(&m_name, &i.first, &i.second));
         }
     } else {
-        for (auto &a : *this) {
-            if (a.first.compare(0, var.size(), var) == 0) {
-                l->insert(l->begin(), new VariableValue(&m_name, &var, &a.second));
-            }
+        auto range = this->equal_range(var);
+        for (auto it = range.first; it != range.second; ++it) {
+            l->insert(l->begin(), new VariableValue(&m_name, &var, &it->second));
         }
     }
 }
diff --git a/test/test-cases/regression/collection-tx.json b/test/test-cases/regression/collection-tx.json
index 127f701c..076d6b72 100644
--- a/test/test-cases/regression/collection-tx.json
+++ b/test/test-cases/regression/collection-tx.json
@@ -1,4 +1,43 @@
 [
+   {
+    "enabled": 1,
+    "version_min":300000,
+    "version_max":0,
+    "title":"AAAAA :: TX full vs partial match",
+    "client":{
+      "ip":"200.249.12.31",
+      "port":2313
+    },
+    "server":{
+      "ip":"200.249.12.31",
+      "port":80
+    },
+    "request":{
+      "headers":{
+        "User-Agent":"Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)"
+      },
+      "uri":"/",
+      "method":"GET",
+      "http_version":1.1,
+      "body":""
+    },
+    "response":{
+      "headers":{
+        "Content-Type":"text\/xml; charset=utf-8\n\r"
+      },
+      "body":[
+        "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n"
+      ]
+    },
+    "expected":{
+       "http_code":200
+    },
+    "rules":[
+      "SecRuleEngine On",
+      "SecRule REMOTE_ADDR \"@unconditionalMatch\" \"id:1,deny,setvar:TX.partial_match=1,chain\"",
+      "SecRule TX.partial \"@gt 0\" \"id:2,t:lowercase,t:none,status:444\""
+    ]
+  },
   {
     "enabled":1,
     "version_min":300000,

[michaelgranzow-avi]

Proposed fix: #1820 - this would make #1810 unnecessary.

[zimmerle]

fixed by: d810de9