[adulau]

Adds owasp_crs_export to generate custom ModSecurity phase 1 deny rules for use alongside OWASP CRS. The exporter includes only attributes with an explicitly enabled to_ids flag and excludes deleted data, without changing the input flags.

Supports source IPs/CIDRs and source IP/port pairs, domains, hostnames and hostname/port pairs, HTTP(S) URLs, origin-form URIs, and user agents from event and object attributes. Composite conditions remain constrained, literals are validated and escaped, rules are deduplicated, and configurable IDs stay in the local 10000–99999 range. The module returns a base64-encoded .conf fragment, skipped counts and integration warnings.

The usage guide documents proxy visibility, client address handling, exact URL matching, scheme limitations for origin-form requests, TLS inspection, direct denial versus CRS anomaly scoring, and ID reservation. Resolved destination IP indicators are excluded because SERVER_ADDR does not reliably identify a proxy's upstream destination.

Validation:

• Export regression suite: 1,331 passed, 7 skipped.
• Native libModSecurity 3.0.14 tests cover matching/non-matching requests, chained constraints, escaping, inherited transformations, IDS filtering and DetectionOnly.
• Combined load with OWASP CRS 3.3.7: 919 rules loaded; indicator request denied with 403 and unrelated request unaffected.
• Black, isort, flake8, whitespace checks and documentation metadata generation passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-23T19:42:45.401527Z	f9bdb5c	PR opened
🔒 Security Review	✅ Completed 2026-10-23T19:46:03.215627Z	f9bdb5c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.