diff --git a/src/modsecurity.cc b/src/modsecurity.cc index 61948f7d..f0e97ce9 100644 --- a/src/modsecurity.cc +++ b/src/modsecurity.cc @@ -58,7 +58,9 @@ ModSecurity::~ModSecurity() { #ifdef MSC_WITH_CURL curl_global_cleanup(); #endif +#ifdef WITH_GEOIP Utils::GeoLookup::getInstance().cleanUp(); +#endif } diff --git a/src/operators/geo_lookup.cc b/src/operators/geo_lookup.cc index 4f45063c..54f185a9 100644 --- a/src/operators/geo_lookup.cc +++ b/src/operators/geo_lookup.cc @@ -15,7 +15,9 @@ #include "operators/geo_lookup.h" +#ifdef WITH_GEOIP #include +#endif #include #include @@ -31,10 +33,11 @@ namespace operators { bool GeoLookup::evaluate(Assay *assay, const std::string &exp) { using std::placeholders::_1; using std::placeholders::_2; - - GeoIPRecord *gir; bool ret = true; +#ifdef WITH_GEOIP + GeoIPRecord *gir; + if (assay) { ret = Utils::GeoLookup::getInstance().lookup(exp, &gir, std::bind(&GeoLookup::debug, this, assay, _1, _2)); @@ -85,6 +88,7 @@ bool GeoLookup::evaluate(Assay *assay, const std::string &exp) { GeoIPRecord_delete(gir); } +#endif // WITH_GEOIP return ret; } diff --git a/src/parser/seclang-parser.yy b/src/parser/seclang-parser.yy index e4ec5f47..615fcf62 100644 --- a/src/parser/seclang-parser.yy +++ b/src/parser/seclang-parser.yy @@ -220,6 +220,7 @@ using ModSecurity::Variables::Tx; %token CONFIG_DIR_GEO_DB %token OPERATOR +%token OPERATOR_GEOIP %token FREE_TEXT %token ACTION %token ACTION_ACCURACY @@ -361,6 +362,23 @@ op: } $$ = op; } + | OPERATOR_GEOIP + { +#ifdef WITH_GEOIP + Operator *op = Operator::instantiate($1); + const char *error = NULL; + if (op->init(driver.ref.back(), &error) == false) { + driver.error(@0, error); + YYERROR; + } + $$ = op; +#else + std::stringstream ss; + ss << "This version of ModSecurity was not compiled with GeoIP support."; + driver.error(@0, ss.str()); + YYERROR; +#endif // WITH_GEOIP + } | FREE_TEXT { Operator *op = Operator::instantiate("\"@rx " + $1 + "\""); @@ -521,6 +539,7 @@ expression: /* Debug log: end */ | CONFIG_DIR_GEO_DB { +#ifdef WITH_GEOIP std::string file = ModSecurity::find_resource($1, driver.ref.back()); if (GeoLookup::getInstance().setDataBase(file) == false) { std::stringstream ss; @@ -529,6 +548,12 @@ expression: driver.error(@0, ss.str()); YYERROR; } +#else + std::stringstream ss; + ss << "This version of ModSecurity was not compiled with GeoIP support."; + driver.error(@0, ss.str()); + YYERROR; +#endif // WITH_GEOIP } /* Body limits */ | CONFIG_DIR_REQ_BODY_LIMIT diff --git a/src/parser/seclang-scanner.ll b/src/parser/seclang-scanner.ll index 1585e057..e18d26ac 100755 --- a/src/parser/seclang-scanner.ll +++ b/src/parser/seclang-scanner.ll @@ -103,8 +103,8 @@ DICT_ELEMENT [^ \t|]+ OPERATOR (?i:(?:@inspectFile|@fuzzyHash|@validateByteRange|@validateDTD|@validateHash|@validateSchema|@verifyCC|@verifyCPF|@verifySSN|@gsbLookup|@rsub)|(?:\!{0,1})(?:@within|@containsWord|@contains|@endsWith|@eq|@ge|@gt|@ipMatchF|@ipMatch|@ipMatchFromFile|@le|@lt|@pmf|@pm|@pmFromFile|@rbl|@rx|@streq|@strmatch|@beginsWith)) -OPERATORNOARG (?i:@detectSQLi|@detectXSS|@geoLookup|@validateUrlEncoding|@validateUtf8Encoding) - +OPERATORNOARG (?i:@detectSQLi|@detectXSS|@validateUrlEncoding|@validateUtf8Encoding) +OPERATOR_GEOIP (?i:@geoLookup) TRANSFORMATION t:(sha1|hexEncode|lowercase|urlDecodeUni|urlDecode|none|compressWhitespace|removeWhitespace|replaceNulls|removeNulls|htmlEntityDecode|jsDecode|cssDecode|trim|normalizePathWin|normalisePath|length|utf8toUnicode|urldecode|removeComments|replaceComments) @@ -281,7 +281,8 @@ CONFIG_DIR_UNICODE_MAP_FILE (?i:SecUnicodeMapFile) { {SOMETHING} { BEGIN(INITIAL); return yy::seclang_parser::make_FREE_TEXT(yytext, *driver.loc.back()); } ["]{OPERATOR}[ ]{FREE_TEXT}["] { BEGIN(INITIAL); return yy::seclang_parser::make_OPERATOR(yytext, *driver.loc.back()); } -["]{OPERATORNOARG}[\t ]*["] { BEGIN(INITIAL); return yy::seclang_parser::make_OPERATOR(yytext, *driver.loc.back()); } +["]{OPERATORNOARG}[\t ]*["] { BEGIN(INITIAL); return yy::seclang_parser::make_OPERATOR(yytext, *driver.loc.back()); } +["]{OPERATOR_GEOIP}[\t ]*["] { BEGIN(INITIAL); return yy::seclang_parser::make_OPERATOR_GEOIP(yytext, *driver.loc.back()); } } {ACTION} { return yy::seclang_parser::make_ACTION(yytext, *driver.loc.back()); } diff --git a/src/utils/geo_lookup.cc b/src/utils/geo_lookup.cc index d860c114..1d4401c1 100644 --- a/src/utils/geo_lookup.cc +++ b/src/utils/geo_lookup.cc @@ -31,9 +31,13 @@ namespace Utils { GeoLookup::~GeoLookup() { +#ifdef WITH_GEOIP cleanUp(); +#endif // WITH_GEOIP } +#ifdef WITH_GEOIP + void GeoLookup::cleanUp() { if (m_gi != NULL) { GeoIP_delete(m_gi); @@ -41,10 +45,8 @@ void GeoLookup::cleanUp() { } } - bool GeoLookup::setDataBase(const std::string& filePath) { m_gi = GeoIP_open(filePath.c_str(), GEOIP_INDEX_CACHE); - if (m_gi == NULL) { return false; } @@ -71,6 +73,8 @@ bool GeoLookup::lookup(const std::string& target, GeoIPRecord **gir, return true; } +#endif // WITH_GEOIP + } // namespace Utils } // namespace ModSecurity diff --git a/src/utils/geo_lookup.h b/src/utils/geo_lookup.h index d13000d4..67f6f10a 100644 --- a/src/utils/geo_lookup.h +++ b/src/utils/geo_lookup.h @@ -18,7 +18,9 @@ #include #include +#ifdef WITH_GEOIP // WITH_GEOIP #include +#endif #ifndef SRC_UTILS_GEO_LOOKUP_H_ #define SRC_UTILS_GEO_LOOKUP_H_ @@ -35,11 +37,12 @@ class GeoLookup { static GeoLookup instance; return instance; } - +#ifdef WITH_GEOIP bool setDataBase(const std::string& filePath); bool lookup(const std::string& target, GeoIPRecord **georec, std::function callback); void cleanUp(); +#endif // WITH_GEOIP private: GeoLookup() @@ -47,8 +50,11 @@ class GeoLookup { ~GeoLookup(); GeoLookup(GeoLookup const&); void operator=(GeoLookup const&); - +#ifdef WITH_GEOIP GeoIP *m_gi; +#else // WITH_GEOIP + void *m_gi; +#endif // WITH_GEOIP };