Huge performance improvement: passing variables as pointers avoiding copies

headers/modsecurity/assay.h

@@ -92,9 +92,23 @@ class ModSecurityCollectionsVariables :
 };
 
 
+class ModSecurityStringVar {
+ public:
+     ModSecurityStringVar(const std::string& key, const std::string& value) :
+        m_key(key),
+        m_value(value) { }
+     std::string m_key;
+     std::string m_value;
+};
+
 class ModSecurityStringVariables :
     public std::unordered_multimap<std::string, std::string> {
  public:
+
+    ModSecurityStringVariables() {
+        this->reserve(1000);
+    }
+
     void storeVariable(std::string key, std::string value) {
         this->emplace(key, value);
     }
@@ -123,34 +137,44 @@ class ModSecurityStringVariables :
         this->erase(key);
     }
 
-
-    std::list<std::pair<std::string, std::string>>
-        resolveVariable(const std::string& key) {
-        std::list<std::pair<std::string, std::string>> l;
-        std::pair<std::string, std::string> pair;
+    std::list<ModSecurityStringVar *>
+        resolveVariable(const std::string& key,
+        std::list<ModSecurityStringVar *> *l) {
 
         auto range = this->equal_range(key);
 
         for (auto it = range.first; it != range.second; ++it) {
-            pair = std::make_pair(std::string(key), std::string(it->second));
-            l.push_back(pair);
+            l->push_back(new ModSecurityStringVar(key, it->second));
         }
 
-        if (l.size() == 0 && key.find(":") == std::string::npos) {
+        if (key.find(":") == std::string::npos && l->size() == 0) {
+            size_t keySize = key.size() + 1;
             for (auto& x : *this) {
-                if ((x.first.substr(0, key.size() + 1).compare(key + ":") != 0)
-                    && (x.first != key)) {
+                if (x.first.size() <= keySize) {
                     continue;
                 }
-                std::list<std::pair<std::string, std::string>> t;
-                t = this->resolveVariable(x.first);
-                if (t.empty() == false) {
-                    l.insert(l.end(), t.begin(), t.end());
+                if (x.first.at(keySize - 1) != ':') {
+                    continue;
                 }
+                if (x.first.compare(0, keySize, key + ":") != 0) {
+                    continue;
+                }
+                //auto range = this->equal_range(x.first);
+
+                //for (auto it = range.first; it != range.second; ++it) {
+                l->push_back(new ModSecurityStringVar(x.first, x.second));
+                //}
             }
         }
 
-        return l;
+        return *l;
+    }
+
+    std::list<ModSecurityStringVar *>
+        resolveVariable(const std::string& key) {
+        std::list<ModSecurityStringVar *> l;
+
+        return resolveVariable(key, &l);
     }
 };
 
@@ -225,8 +249,12 @@ class Assay {
     const char *getResponseBody();
     int getResponseBodyLenth();
 
-    std::list<std::pair<std::string, std::string>>
+    std::list<ModSecurityStringVar *> *
         resolve_variable(const std::string& var);
+
+    void resolve_variable(const std::string& var,
+        std::list<ModSecurityStringVar *> *);
+
     std::string* resolve_variable_first(const std::string& key);
     std::string* resolve_variable_first(const std::string& collectionName,
        const std::string& var);

src/Makefile.am

@@ -201,8 +201,9 @@ libmodsecurity_la_CPPFLAGS = \
 	-I.. \
 	-g \
 	-fPIC \
-	-O0 \
+	-O3 \
 	-I ../headers \
+	-DNO_LOGS=1 \
 	$(GEOIP_CFLAGS) \
 	$(PCRE_CPPFLAGS)
 

src/actions/capture.cc

@@ -32,34 +32,33 @@ namespace actions {
 
 bool Capture::evaluate(Rule *rule, Assay *assay) {
     operators::Operator *op = rule->op;
-    std::list<std::string> match;
+    std::list<std::string> *match;
 
     operators::Pm *pm = dynamic_cast<operators::Pm *>(op);
     if (pm != NULL) {
-        match = pm->matched;
+        match = &pm->matched;
     }
 
     operators::Rx *rx = dynamic_cast<operators::Rx *>(op);
     if (rx != NULL) {
-        match = rx->matched;
+        match = &rx->matched;
     }
 
     operators::Contains *contains = dynamic_cast<operators::Contains *>(op);
     if (contains != NULL) {
-        match = contains->matched;
+        match = &contains->matched;
     }
 
-    if (match.empty()) {
+    if (match->empty()) {
         return false;
     }
 
     int i = 0;
-    while (match.empty() == false) {
-        assay->setCollection("TX", std::to_string(i), match.back());
-        match.pop_back();
+    while (match->empty() == false) {
+        assay->setCollection("TX", std::to_string(i), match->back());
+        match->pop_back();
         i++;
     }
-
     return true;
 }
 

src/actions/set_var.cc

@@ -116,21 +116,19 @@ bool SetVar::evaluate(Rule *rule, Assay *assay) {
         value = 0;
     }
 
+
+    std::string resolvedPre = MacroExpansion::expand(predicate, assay);
+    if (operation == setOperation) {
+        targetValue = resolvedPre;
+    } else {
         int pre = 0;
         try {
-        pre = stoi(predicate);
-    } catch (...) {
-        try {
-            pre = stoi(MacroExpansion::expand(predicate, assay));
+            pre = stoi(resolvedPre);
         } catch (...) {
             pre = 0;
         }
-    }
 
         switch (operation) {
-        case setOperation:
-            targetValue = MacroExpansion::expand(predicate, assay);
-            break;
             case sumAndSetOperation:
                 targetValue = std::to_string(value + pre);
                 break;
@@ -141,6 +139,7 @@ bool SetVar::evaluate(Rule *rule, Assay *assay) {
                 targetValue = std::string("1");
                 break;
         }
+    }
 
 #ifndef NO_LOGS
     assay->debug(8, "Saving variable: " + collectionName + ":" + \

src/actions/transformations/remove_nulls.cc

@@ -35,24 +35,18 @@ namespace transformations {
 
 std::string RemoveNulls::evaluate(std::string value,
     Assay *assay) {
-    int64_t i, j;
+    int64_t i;
 
-    char *input = reinterpret_cast<char *>(malloc(value.size()
-        * sizeof(char)));
-    memcpy(input, value.c_str(), value.size());
+    std::string ret;
 
-    i = j = 0;
+    i = 0;
     while (i < value.size()) {
-        if (input[i] != '\0') {
-            input[j] = input[i];
-            j++;
+        if (value.at(i) != '\0') {
+            ret += value.at(i);
         }
         i++;
     }
 
-    std::string ret(input, 0, j);
-    free(input);
-
     return ret;
 }
 

src/assay.cc

@@ -664,10 +664,12 @@ int Assay::processRequestBody() {
      * computationally intensive.
      */
     std::string fullRequest;
-    for (auto &a : resolve_variable("REQUEST_HEADERS")) {
+    std::list<ModSecurityStringVar *> l;
+    resolve_variable("REQUEST_HEADERS", &l);
+    for (auto &a : l) {
         fullRequest = fullRequest + \
-            std::string(a.first, 16, a.first.length() - 16) + ": " \
-            + a.second + "\n";
+            std::string(a->m_key, 16, a->m_key.length() - 16) + ": " \
+            + a->m_value + "\n";
     }
     fullRequest = fullRequest + "\n\n";
     fullRequest = fullRequest + m_requestBody.str();
@@ -1471,24 +1473,26 @@ void Assay::delete_variable(std::string key) {
 }
 
 
-std::list<std::pair<std::string, std::string>>
-    Assay::resolve_variable(const std::string& var) {
-    std::list<std::pair<std::string, std::string>> l;
-    std::pair<std::string, std::string> pair;
+void Assay::resolve_variable(const std::string& var,
+    std::list<ModSecurityStringVar *> *l) {
 
-    l = m_variables_strings.resolveVariable(var);
+    m_variables_strings.resolveVariable(var, l);
 
     size_t ac = var.find(":");
     if (ac != std::string::npos) {
         /* It may be a collection */
         for (auto &a : collections) {
-            std::list<std::pair<std::string, std::string>> l2 = a.second->resolveVariable(var);
-            if (l2.empty() == false) {
-                l.insert(l.end(), l2.begin(), l2.end());
+            a.second->resolveVariable(var, l);
         }
     }
 }
 
+std::list<ModSecurityStringVar *> *
+    Assay::resolve_variable(const std::string& var) {
+    std::list<ModSecurityStringVar *> *l = new std::list<ModSecurityStringVar *>();
+
+    resolve_variable(var, l);
+
     return l;
 }
 

src/operators/rx.cc

@@ -30,7 +30,7 @@ bool Rx::evaluate(Assay *assay, const std::string& input) {
     SMatch match;
 
     if (regex_search(input, &match, *m_re) && match.size() >= 1) {
-        this->matched.push_back(match.match);
+        //this->matched.push_back(match.match);
         return true;
     }
 

src/operators/rx.h

@@ -37,8 +37,7 @@ class Rx : public Operator {
     Rx(std::string op, std::string param, bool negation)
         : Operator(op, param, negation),
         m_param(param) {
-            Regex r(param);
-            m_re = &r;
+            m_re = new Regex(param);
         }
 
     bool evaluate(Assay *assay, const std::string &input);

src/rule.cc

@@ -276,10 +276,10 @@ bool Rule::evaluate(Assay *assay) {
         Exclusion *exl = dynamic_cast<Exclusion *>(variable);
 
         if (exl != NULL) {
-            std::list<std::pair<std::string, std::string>> z =
+            std::list<ModSecurityStringVar *> *z =
                 variable->evaluate(assay);
-            for (auto &y : z) {
-                exclusions.push_back(y.first);
+            for (auto &y : *z) {
+                exclusions.push_back(y->m_key);
             }
             exclusions.push_back(variable->name);
         }
@@ -293,19 +293,19 @@ bool Rule::evaluate(Assay *assay) {
             continue;
         }
 
-        std::list<std::pair<std::string, std::string>> e =
+        std::list<ModSecurityStringVar *> *e =
             variable->evaluate(assay);
 
-        for (auto &v : e) {
+        for (auto &v : *e) {
             if (std::find(exclusions.begin(), exclusions.end(),
-                v.first) != exclusions.end()) {
+                v->m_key) != exclusions.end()) {
 #ifndef NO_LOGS
-                assay->debug(9, "Variable: " + v.first + " is part of the" +
+                assay->debug(9, "Variable: " + v.m_key + " is part of the" +
                     " exclusion list, skipping...");
 #endif
                 continue;
             }
-            std::string value = v.second;
+            std::string value = v->m_value;
             int none = 0;
             for (Action *a : this->actions_runtime_pre) {
                 None *z = dynamic_cast<None *>(a);
@@ -349,7 +349,7 @@ bool Rule::evaluate(Assay *assay) {
 
 #ifndef NO_LOGS
             assay->debug(9, "Target value: \"" + limitTo(80, toHexIfNeeded(value)) + \
-                "\" (Variable: " + v.first + ")");
+                "\" (Variable: " + v.m_key + ")");
 #endif
 
             ret = this->op->evaluate(assay, value);
@@ -397,17 +397,17 @@ bool Rule::evaluate(Assay *assay) {
                         assay->store_variable("MATCHED_VAR", value);
                     }
                     if (assay->update_variable_first("MATCHED_VAR_NAME",
-                        v.first) == false) {
-                        assay->store_variable("MATCHED_VAR_NAME", v.first);
+                        v->m_key) == false) {
+                        assay->store_variable("MATCHED_VAR_NAME", v->m_key);
                     }
-                    assay->store_variable("MATCHED_VARS:" + v.first, value);
-                    assay->store_variable("MATCHED_VARS_NAMES:" + v.first,
-                        v.first);
+                    assay->store_variable("MATCHED_VARS:" + v->m_key, value);
+                    assay->store_variable("MATCHED_VARS_NAMES:" + v->m_key,
+                        v->m_key);
                     chainResult = this->chainedRule->evaluate(assay);
                     assay->update_variable_first("MATCHED_VAR", "");
-                    assay->delete_variable("MATCHED_VARS:" + v.first);
-                    assay->delete_variable("MATCHED_VARS_NAMES:" + v.first);
-                    assay->delete_variable("MATCHED_VARS_NAMES:" + v.first);
+                    assay->delete_variable("MATCHED_VARS:" + v->m_key);
+                    assay->delete_variable("MATCHED_VARS_NAMES:" + v->m_key);
+                    assay->delete_variable("MATCHED_VARS_NAME");
                 }
                 if (this->chained && chainResult == true || !this->chained) {
                     for (Action *a : assay->m_rules->defaultActions[this->phase]) {
@@ -473,6 +473,11 @@ bool Rule::evaluate(Assay *assay) {
 #endif
             }
         }
+
+        while (e->empty() == false) {
+            delete e->front();
+            e->pop_front();
+        }
     }
     return ret;
 }

src/utils/regex.cc

@@ -46,15 +46,13 @@ Regex::Regex(const std::string& pattern_)
 
 int regex_search(const std::string& s, SMatch *match,
     const Regex& regex) {
-    int *ovector = 0;
-    int ovecsize = 0;
-    return pcre_exec(regex.m_pc, regex.m_pce, s.c_str(), s.size(), 0, 0, ovector, ovecsize) > 0;
+    int ovector[OVECCOUNT];
+    return pcre_exec(regex.m_pc, regex.m_pce, s.c_str(), s.size(), 0, 0, ovector, OVECCOUNT) > 0;
 }
 
 int regex_search(const std::string& s, const Regex& regex) {
-    int *ovector = 0;
-    int ovecsize = 0;
-    return pcre_exec(regex.m_pc, regex.m_pce, s.c_str(), s.size(), 0, 0, ovector, ovecsize) > 0;
+    int ovector[OVECCOUNT];
+    return pcre_exec(regex.m_pc, regex.m_pce, s.c_str(), s.size(), 0, 0, ovector, OVECCOUNT) > 0;
 }
 
 }  // namespace Utils

src/utils/regex.h

@@ -25,6 +25,7 @@
 namespace ModSecurity {
 namespace Utils {
 
+#define OVECCOUNT 30
 
 class Regex {
  public:
@@ -32,7 +33,7 @@ class Regex {
     std::string pattern;
     pcre *m_pc = NULL;
     pcre_extra *m_pce = NULL;
-
+    int m_ovector[OVECCOUNT];
 };
 
 

src/variables/duration.cc

@@ -27,18 +27,16 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<std::pair<std::string, std::string>>
+std::list<ModSecurityStringVar *> *
     Duration::evaluate(Assay *assay) {
-    std::list<std::pair<std::string, std::string>> resl;
+    std::list<ModSecurityStringVar *> *resl = new std::list<ModSecurityStringVar *>();
     std::string res;
-    std::pair<std::string, std::string> pair;
 
     double e = cpu_seconds() - assay->start;
 
     res = std::to_string(e);
 
-    pair = std::make_pair(std::string("DURATION"), std::string(res));
-    resl.push_back(pair);
+    resl->push_back(new ModSecurityStringVar("DURATION",  std::string(res)));
 
     return resl;
 }

src/variables/duration.h

@@ -33,7 +33,7 @@ class Duration : public Variable {
     explicit Duration(std::string _name)
         : Variable(_name) { }
 
-    std::list<std::pair<std::string, std::string>>
+    std::list<ModSecurityStringVar *> *
         evaluate(Assay *assay) override;
 };
 

src/variables/env.cc

@@ -33,9 +33,9 @@ extern char **environ;
 namespace ModSecurity {
 namespace Variables {
 
-std::list<std::pair<std::string, std::string>>
+std::list<ModSecurityStringVar *> *
     Env::evaluate(Assay *assay) {
-    std::list<std::pair<std::string, std::string>> resl;
+    std::list<ModSecurityStringVar *> *resl = new std::list<ModSecurityStringVar *>();
 
     std::map<std::string, std::string> envs;
     for (char **current = environ; *current; current++) {
@@ -49,9 +49,7 @@ std::list<std::pair<std::string, std::string>>
 
         envs.insert(std::pair<std::string, std::string>("ENV:" + key, value));
         if ("env:" + key == name) {
-            std::pair<std::string, std::string> pair;
-            pair = std::make_pair(name, value);
-            resl.push_back(pair);
+            resl->push_back(new ModSecurityStringVar(name, value));
             return resl;
         }
     }
@@ -61,9 +59,7 @@ std::list<std::pair<std::string, std::string>>
             && (x.first != name)) {
             continue;
         }
-        std::pair<std::string, std::string> pair;
-        pair = std::make_pair(x.first, x.second);
-        resl.push_back(pair);
+        resl->push_back(new ModSecurityStringVar(x.first, x.second));
     }
 
     return resl;

src/variables/env.h

@@ -33,7 +33,7 @@ class Env : public Variable {
     explicit Env(std::string _name)
         : Variable(_name) { }
 
-    std::list<std::pair<std::string, std::string>>
+    std::list<ModSecurityStringVar *> *
         evaluate(Assay *assay) override;
 };
 

src/variables/highest_severity.cc

@@ -26,14 +26,12 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<std::pair<std::string, std::string>>
+std::list<ModSecurityStringVar *> *
     HighestSeverity::evaluate(Assay *assay) {
-    std::list<std::pair<std::string, std::string>> resl;
-    std::pair<std::string, std::string> pair;
+    std::list<ModSecurityStringVar *> *resl = new std::list<ModSecurityStringVar *>();
 
-    pair = std::make_pair(std::string("HIGHEST_SEVERITY"),
-        std::to_string(assay->highest_severity));
-    resl.push_back(pair);
+    resl->push_back(new ModSecurityStringVar("HIGHEST_SEVERITY",
+        std::to_string(assay->highest_severity)));
 
     return resl;
 }

src/variables/highest_severity.h

@@ -33,7 +33,7 @@ class HighestSeverity : public Variable {
     explicit HighestSeverity(std::string _name)
         : Variable(_name) { }
 
-    std::list<std::pair<std::string, std::string>>
+    std::list<ModSecurityStringVar *> *
         evaluate(Assay *assay) override;
 };
 

src/variables/modsec_build.cc

@@ -27,10 +27,9 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<std::pair<std::string, std::string>>
+std::list<ModSecurityStringVar *> *
     ModsecBuild::evaluate(Assay *assay) {
-    std::list<std::pair<std::string, std::string>> resl;
-    std::pair<std::string, std::string> pair;
+    std::list<ModSecurityStringVar *> *resl = new std::list<ModSecurityStringVar *>();
 
     std::ostringstream ss;
     ss << std::setw(2) << std::setfill('0') << MODSECURITY_MAJOR;
@@ -38,8 +37,7 @@ std::list<std::pair<std::string, std::string>>
     ss << std::setw(2) << std::setfill('0') << MODSECURITY_PATCHLEVEL;
     ss << std::setw(2) << std::setfill('0') << MODSECURITY_TAG_NUM;
 
-    pair = std::make_pair(std::string("MODSEC_BUILD"), ss.str());
-    resl.push_back(pair);
+    resl->push_back(new ModSecurityStringVar("MODSEC_BUILD", ss.str()));
 
     return resl;
 }

src/variables/modsec_build.h

@@ -33,7 +33,7 @@ class ModsecBuild : public Variable {
     explicit ModsecBuild(std::string _name)
         : Variable(_name) { }
 
-    std::list<std::pair<std::string, std::string>>
+    std::list<ModSecurityStringVar *> *
         evaluate(Assay *assay) override;
 };
 

src/variables/time.cc

@@ -33,10 +33,10 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<std::pair<std::string, std::string>>
+std::list<ModSecurityStringVar *> *
     Time::evaluate(Assay *assay) {
-    std::list<std::pair<std::string, std::string>> resl;
-    std::pair<std::string, std::string> pair;
+    std::list<ModSecurityStringVar *> *resl = new std::list<ModSecurityStringVar *>();
+
     char tstr[200];
     struct tm timeinfo;
     time_t timer;
@@ -47,9 +47,7 @@ std::list<std::pair<std::string, std::string>>
     localtime_r(&timer, &timeinfo);
     strftime(tstr, 200, "%H:%M:%S", &timeinfo);
 
-    pair = std::make_pair(std::string("TIME"),
-       std::string(tstr));
-    resl.push_back(pair);
+    resl->push_back(new ModSecurityStringVar("TIME", std::string(tstr)));
 
     return resl;
 }

src/variables/time.h

@@ -34,7 +34,7 @@ class Time : public Variable {
     explicit Time(std::string _name)
         : Variable(_name) { }
 
-    std::list<std::pair<std::string, std::string>>
+    std::list<ModSecurityStringVar *> *
         evaluate(Assay *assay) override;
 };
 

src/variables/time_day.cc

@@ -33,10 +33,10 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<std::pair<std::string, std::string>>
+std::list<ModSecurityStringVar *> *
     TimeDay::evaluate(Assay *assay) {
-    std::list<std::pair<std::string, std::string>> resl;
-    std::pair<std::string, std::string> pair;
+    std::list<ModSecurityStringVar *> *resl = new std::list<ModSecurityStringVar *>();
+
     char tstr[200];
     struct tm timeinfo;
     time_t timer;
@@ -47,9 +47,7 @@ std::list<std::pair<std::string, std::string>>
     localtime_r(&timer, &timeinfo);
     strftime(tstr, 200, "%d", &timeinfo);
 
-    pair = std::make_pair(std::string("TIME_DAY"),
-       std::string(tstr));
-    resl.push_back(pair);
+    resl->push_back(new ModSecurityStringVar("TIME_DAY",  std::string(tstr)));
 
     return resl;
 }

src/variables/time_day.h

@@ -33,7 +33,7 @@ class TimeDay : public Variable {
     explicit TimeDay(std::string _name)
         : Variable(_name) { }
 
-    std::list<std::pair<std::string, std::string>>
+    std::list<ModSecurityStringVar *> *
         evaluate(Assay *assay) override;
 };
 

src/variables/time_epoch.cc

@@ -33,14 +33,11 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<std::pair<std::string, std::string>>
+std::list<ModSecurityStringVar *> *
     TimeEpoch::evaluate(Assay *assay) {
-    std::list<std::pair<std::string, std::string>> resl;
-    std::pair<std::string, std::string> pair;
+    std::list<ModSecurityStringVar *> *resl = new std::list<ModSecurityStringVar *>();
 
-    pair = std::make_pair(std::string("TIME_EPOCH"),
-       std::to_string(std::time(nullptr)));
-    resl.push_back(pair);
+    resl->push_back(new ModSecurityStringVar("TIME_EPOCH",  std::to_string(std::time(nullptr))));
 
     return resl;
 }

src/variables/time_epoch.h

@@ -33,7 +33,7 @@ class TimeEpoch : public Variable {
     explicit TimeEpoch(std::string _name)
         : Variable(_name) { }
 
-    std::list<std::pair<std::string, std::string>>
+    std::list<ModSecurityStringVar *> *
         evaluate(Assay *assay) override;
 };
 

src/variables/time_hour.cc

@@ -33,10 +33,10 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<std::pair<std::string, std::string>>
+std::list<ModSecurityStringVar *> *
     TimeHour::evaluate(Assay *assay) {
-    std::list<std::pair<std::string, std::string>> resl;
-    std::pair<std::string, std::string> pair;
+    std::list<ModSecurityStringVar *> *resl = new std::list<ModSecurityStringVar *>();
+
     char tstr[200];
     struct tm timeinfo;
     time_t timer;
@@ -47,9 +47,7 @@ std::list<std::pair<std::string, std::string>>
     localtime_r(&timer, &timeinfo);
     strftime(tstr, 200, "%H", &timeinfo);
 
-    pair = std::make_pair(std::string("TIME_HOUR"),
-       std::string(tstr));
-    resl.push_back(pair);
+    resl->push_back(new ModSecurityStringVar("TIME_HOUR",  std::string(tstr)));
 
     return resl;
 }

src/variables/time_hour.h

@@ -33,7 +33,7 @@ class TimeHour : public Variable {
     explicit TimeHour(std::string _name)
         : Variable(_name) { }
 
-    std::list<std::pair<std::string, std::string>>
+    std::list<ModSecurityStringVar *> *
         evaluate(Assay *assay) override;
 };
 

src/variables/time_min.cc

@@ -33,10 +33,10 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<std::pair<std::string, std::string>>
+std::list<ModSecurityStringVar *> *
     TimeMin::evaluate(Assay *assay) {
-    std::list<std::pair<std::string, std::string>> resl;
-    std::pair<std::string, std::string> pair;
+    std::list<ModSecurityStringVar *> *resl = new std::list<ModSecurityStringVar *>();
+
     char tstr[200];
     struct tm timeinfo;
     time_t timer;
@@ -47,9 +47,7 @@ std::list<std::pair<std::string, std::string>>
     localtime_r(&timer, &timeinfo);
     strftime(tstr, 200, "%M", &timeinfo);
 
-    pair = std::make_pair(std::string("TIME_MIN"),
-       std::string(tstr));
-    resl.push_back(pair);
+    resl->push_back(new ModSecurityStringVar("TIME_MIN",  std::string(tstr)));
 
     return resl;
 }

src/variables/time_min.h

@@ -33,7 +33,7 @@ class TimeMin : public Variable {
     explicit TimeMin(std::string _name)
         : Variable(_name) { }
 
-    std::list<std::pair<std::string, std::string>>
+    std::list<ModSecurityStringVar *> *
         evaluate(Assay *assay) override;
 };
 

src/variables/time_mon.cc

@@ -33,10 +33,10 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<std::pair<std::string, std::string>>
+std::list<ModSecurityStringVar *> *
     TimeMon::evaluate(Assay *assay) {
-    std::list<std::pair<std::string, std::string>> resl;
-    std::pair<std::string, std::string> pair;
+    std::list<ModSecurityStringVar *> *resl = new std::list<ModSecurityStringVar *>();
+
     char tstr[200];
     struct tm timeinfo;
     time_t timer;
@@ -49,9 +49,7 @@ std::list<std::pair<std::string, std::string>>
     int a = atoi(tstr);
     a--;
 
-    pair = std::make_pair(std::string("TIME_MON"),
-       std::to_string(a));
-    resl.push_back(pair);
+    resl->push_back(new ModSecurityStringVar("TIME_MON",  std::to_string(a)));
 
     return resl;
 }

src/variables/time_mon.h

@@ -33,7 +33,7 @@ class TimeMon : public Variable {
     explicit TimeMon(std::string _name)
         : Variable(_name) { }
 
-    std::list<std::pair<std::string, std::string>>
+    std::list<ModSecurityStringVar *> *
         evaluate(Assay *assay) override;
 };
 

src/variables/time_sec.cc

@@ -33,10 +33,10 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<std::pair<std::string, std::string>>
+std::list<ModSecurityStringVar *> *
     TimeSec::evaluate(Assay *assay) {
-    std::list<std::pair<std::string, std::string>> resl;
-    std::pair<std::string, std::string> pair;
+    std::list<ModSecurityStringVar *> *resl = new std::list<ModSecurityStringVar *>();
+
     char tstr[200];
     struct tm timeinfo;
     time_t timer;
@@ -47,9 +47,7 @@ std::list<std::pair<std::string, std::string>>
     localtime_r(&timer, &timeinfo);
     strftime(tstr, 200, "%S", &timeinfo);
 
-    pair = std::make_pair(std::string("TIME_SEC"),
-       std::string(tstr));
-    resl.push_back(pair);
+    resl->push_back(new ModSecurityStringVar("TIME_SEC",  std::string(tstr)));
 
     return resl;
 }

src/variables/time_sec.h

@@ -33,7 +33,7 @@ class TimeSec : public Variable {
     explicit TimeSec(std::string _name)
         : Variable(_name) { }
 
-    std::list<std::pair<std::string, std::string>>
+    std::list<ModSecurityStringVar *> *
         evaluate(Assay *assay) override;
 };
 

src/variables/time_wday.cc

@@ -33,10 +33,10 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<std::pair<std::string, std::string>>
+std::list<ModSecurityStringVar *> *
     TimeWDay::evaluate(Assay *assay) {
-    std::list<std::pair<std::string, std::string>> resl;
-    std::pair<std::string, std::string> pair;
+    std::list<ModSecurityStringVar *> *resl = new std::list<ModSecurityStringVar *>();
+
     char tstr[200];
     struct tm timeinfo;
     time_t timer;
@@ -49,9 +49,7 @@ std::list<std::pair<std::string, std::string>>
     int a = atoi(tstr);
     a--;
 
-    pair = std::make_pair(std::string("TIME_WDAY"),
-       std::to_string(a));
-    resl.push_back(pair);
+    resl->push_back(new ModSecurityStringVar("TIME_WDAY",  std::to_string(a)));
 
     return resl;
 }

src/variables/time_wday.h

@@ -33,7 +33,7 @@ class TimeWDay : public Variable {
     explicit TimeWDay(std::string _name)
         : Variable(_name) { }
 
-    std::list<std::pair<std::string, std::string>>
+    std::list<ModSecurityStringVar *> *
         evaluate(Assay *assay) override;
 };
 

src/variables/time_year.cc

@@ -33,10 +33,10 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<std::pair<std::string, std::string>>
+std::list<ModSecurityStringVar *> *
     TimeYear::evaluate(Assay *assay) {
-    std::list<std::pair<std::string, std::string>> resl;
-    std::pair<std::string, std::string> pair;
+    std::list<ModSecurityStringVar *> *resl = new std::list<ModSecurityStringVar *>();
+
     char tstr[200];
     struct tm timeinfo;
     time_t timer;
@@ -47,9 +47,7 @@ std::list<std::pair<std::string, std::string>>
     localtime_r(&timer, &timeinfo);
     strftime(tstr, 200, "%Y", &timeinfo);
 
-    pair = std::make_pair(std::string("TIME_YEAR"),
-       std::string(tstr));
-    resl.push_back(pair);
+    resl->push_back(new ModSecurityStringVar("TIME_YEAR",  std::string(tstr)));
 
     return resl;
 }

src/variables/time_year.h

@@ -33,7 +33,7 @@ class TimeYear : public Variable {
     explicit TimeYear(std::string _name)
         : Variable(_name) { }
 
-    std::list<std::pair<std::string, std::string>>
+    std::list<ModSecurityStringVar *> *
         evaluate(Assay *assay) override;
 };
 

src/variables/tx.cc

@@ -33,15 +33,11 @@
 namespace ModSecurity {
 namespace Variables {
 
-std::list<std::pair<std::string, std::string>>
+std::list<ModSecurityStringVar *> *
     Tx::evaluate(Assay *assay) {
-    std::list<std::pair<std::string, std::string>> resl;
-    std::pair<std::string, std::string> pair;
+    std::list<ModSecurityStringVar *> *resl = new std::list<ModSecurityStringVar *>();
 
-    pair = std::make_pair(std::string("TX:0"),
-       std::string("teste"));
-
-    resl.push_back(pair);
+    resl->push_back(new ModSecurityStringVar("TX:0", "teste"));
 
     return resl;
 }

src/variables/tx.h

@@ -34,7 +34,7 @@ class Tx : public Variable {
     explicit Tx(std::string _name)
         : Variable(_name) { }
 
-    std::list<std::pair<std::string, std::string>>
+    std::list<ModSecurityStringVar *> *
         evaluate(Assay *assay) override;
 };
 

src/variables/variable.cc

@@ -28,9 +28,11 @@ using ModSecurity::Variables::Variations::Exclusion;
 namespace ModSecurity {
 namespace Variables {
 
-std::list<std::pair<std::string, std::string>>
+std::list<ModSecurityStringVar *> *
     Variable::evaluate(Assay *assay) {
-    return assay->resolve_variable(this->name);
+    std::list<ModSecurityStringVar *> *l = new std::list<ModSecurityStringVar *>();
+    assay->resolve_variable(this->name, l);
+    return l;
 }
 
 std::string Variable::to_s(

src/variables/variable.h

@@ -17,6 +17,7 @@
 #include <string>
 #include <list>
 #include <utility>
+#include "modsecurity/assay.h"
 
 #ifndef SRC_VARIABLES_VARIABLE_H_
 #define SRC_VARIABLES_VARIABLE_H_
@@ -32,7 +33,7 @@ class Variable {
         : name(_name) { }
 
     static std::string to_s(std::vector<Variable *> *variables);
-    virtual std::list<std::pair<std::string, std::string>>
+    virtual std::list<ModSecurityStringVar *> *
         evaluate(Assay *assay);
     std::string name;
 };

src/variables/variations/count.cc

@@ -28,23 +28,22 @@ namespace ModSecurity {
 namespace Variables {
 namespace Variations {
 
-std::list<std::pair<std::string, std::string>>
+std::list<ModSecurityStringVar *> *
     Count::evaluate(Assay *assay) {
-    std::list<std::pair<std::string, std::string>> reslIn;
-    std::list<std::pair<std::string, std::string>> reslOut;
-    std::pair<std::string, std::string> pair;
+    std::list<ModSecurityStringVar *> *reslIn;
+    std::list<ModSecurityStringVar *> *reslOut = new std::list<ModSecurityStringVar *>();
     int count = 0;
 
     reslIn = var->evaluate(assay);
 
-    for (auto &a : reslIn) {
+    for (auto &a : *reslIn) {
         count++;
     }
 
     std::string res = std::to_string(count);
 
-    pair = std::make_pair(std::string(var->name), std::string(res));
-    reslOut.push_back(pair);
+    reslOut->push_back(new ModSecurityStringVar(std::string(var->name),
+        std::string(res)));
 
     return reslOut;
 }

src/variables/variations/count.h

@@ -35,7 +35,7 @@ class Count : public Variable {
         : Variable("count(" + v->name + ")"),
         var(v) { }
 
-    std::list<std::pair<std::string, std::string>>
+    std::list<ModSecurityStringVar *> *
         evaluate(Assay *assay) override;
 
     Variable *var;

src/variables/variations/exclusion.cc

@@ -29,9 +29,11 @@ namespace Variables {
 namespace Variations {
 
 
-std::list<std::pair<std::string, std::string>>
+std::list<ModSecurityStringVar *> *
     Exclusion::evaluate(Assay *assay) {
-    return assay->resolve_variable(this->name);
+    std::list<ModSecurityStringVar *> *l = new std::list<ModSecurityStringVar *>();
+    assay->resolve_variable(this->name, l);
+    return l;
 }
 
 

src/variables/variations/exclusion.h

@@ -36,7 +36,7 @@ class Exclusion : public Variable {
         : Variable(v->name),
         var(v) { }
 
-    std::list<std::pair<std::string, std::string>>
+    std::list<ModSecurityStringVar *> *
         evaluate(Assay *assay) override;
 
     Variable *var;