Allow connectors to avoid unused intervention log payload overhead

[upgle]

what

• add C++ and C APIs to omit unused ModSecurityIntervention::log payload generation
• keep payload generation enabled by default without changing intervention behavior or other logging channels
• apply the option to all five existing paths—deny, drop, redirect, and request/response body-limit rejection—with focused tests for each path and both APIs

API

modsecurity.setInterventionLogPayloadEnabled(false);

msc_set_intervention_log_payload_enabled(modsec, 0);

Payload generation remains enabled by default; the C API treats any nonzero value as enabled. The setting is scoped to a ModSecurity instance; configure it before publishing to worker threads. Changing it during active transactions is unsupported.

The implementation reuses a reserved private log-property bit, adding no object field or virtual function. Existing callback setters preserve the bit.

why

The need surfaced while testing ModSecurity in an Envoy integration. The connector consumes intervention status, redirect URLs, and bounded structured rule events, but not the free-form ModSecurityIntervention::log payload; ModSecurity still formats, allocates, copies, and frees it on disruptive requests. This opt-out is intended for high-throughput or latency-sensitive connectors with the same usage pattern while preserving intervention behavior and other logging channels.

An isolated Linux release microbenchmark used 12 alternating-order paired rounds with 50,000 transactions per sample. Enabled and disabled medians were 20.290 and 14.735 microseconds per transaction; the 5.541-microsecond median paired difference represents 27.3% lower phase-1 deny time, with all 12 pairs favoring omission.

[Copilot]

Pull request overview

Adds an instance-scoped switch to let connectors skip generating the human-readable ModSecurityIntervention::log payload (while preserving disruptive behavior and other logging channels), plus regression coverage and a reproducible benchmark/plot workflow to quantify the savings.

Changes:

• Introduces C++ and C APIs to enable/disable intervention log payload generation (default: enabled).
• Centralizes all intervention-log payload producers behind a single helper that respects the instance setting.
• Adds regression tests and a benchmark + deterministic SVG renderer, with a dedicated GitHub Actions validation workflow.

Reviewed changes

Copilot reviewed 21 out of 22 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
test/test-suite.in	Registers the new regression JSON in the automake test list.
test/test-cases/regression/intervention-log.json	Adds regression cases covering default behavior, C/C++ APIs, status/actions preservation, and body-limit paths.
test/regression/regression.cc	Captures whether an intervention occurred and whether a payload was present, then asserts expected behavior.
test/regression/regression_test.h	Extends the test model with payload enablement inputs and payload presence/content expectations.
test/regression/regression_test.cc	Parses/serializes the new regression fields from/to JSON.
test/common/modsecurity_test_results.h	Adds result fields for intervention seen + payload presence/content.
test/common/modsecurity_test_context.h	Adds helpers to reset server-log callbacks while exercising property/state preservation.
test/benchmark/plot_intervention_log_benchmark.py	Adds a stdlib-only deterministic SVG renderer for paired benchmark results (with accessibility metadata).
test/benchmark/Makefile.am	Builds the new intervention_log_benchmark tool.
test/benchmark/intervention_log_benchmark.cc	Adds a paired microbenchmark that toggles the payload setting and writes CSV + summary.
test/benchmark/evidence/README.md	Documents the committed benchmark evidence bundle and reproduction steps.
test/benchmark/evidence/intervention-log-run-30621986766.svg	Commits an example generated paired estimation plot as evidence.
test/benchmark/evidence/intervention-log-run-30621986766.csv	Commits the raw CSV backing the example plot.
src/transaction.cc	Routes body-limit intervention log strings through the new payload-setting-aware helper.
src/modsecurity.cc	Preserves the reserved payload bit across setServerLogCb calls; implements the new C++/C APIs.
src/Makefile.am	Adds the new internal header to the build sources list.
src/intervention_log.h	Introduces intervention::setLogPayload(...) helpers gated by the instance setting.
src/actions/disruptive/redirect.cc	Uses the centralized helper instead of always formatting/allocating the intervention log payload.
src/actions/disruptive/drop.cc	Uses the centralized helper instead of always formatting/allocating the intervention log payload.
src/actions/disruptive/deny.cc	Uses the centralized helper instead of always formatting/allocating the intervention log payload.
headers/modsecurity/modsecurity.h	Declares the new public APIs and reserves a private bit in m_logProperties with a non-overlap assertion.
.github/workflows/intervention-log-validation.yml	Adds a targeted CI workflow to build, run the regression subset, benchmark, and upload artifacts.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[upgle]

references

• Envoy integration PR
• benchmark evidence and reproduction
• benchmark run 30644388937