github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-15 23:55:03 +03:00
Code Issues Packages Projects Releases Wiki Activity

Adds support to SecAuditLogParts

Browse Source
This commit is contained in:
Felipe Zimmerle 2015-07-10 19:05:46 -03:00
parent 5e33a1a3c4
commit 0c98bdc80b
8 changed files with 76 additions and 63 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

123
src/assay.cc
View File

@ -695,6 +695,7 @@ std::string Assay::to_json(int parts) {
std::string ts = ascTime(&timeStamp).c_str(); std::string ts = ascTime(&timeStamp).c_str();
std::string uniqueId = UniqueId::uniqueId(); std::string uniqueId = UniqueId::uniqueId();
parts = 0;
g = yajl_gen_alloc(NULL); g = yajl_gen_alloc(NULL);
if (g == NULL) { if (g == NULL) {
return ""; return "";
@ -709,6 +710,7 @@ std::string Assay::to_json(int parts) {
strlen("transaction")); strlen("transaction"));
yajl_gen_map_open(g); yajl_gen_map_open(g);
/* Part: A (header mandatory) */
LOGFY_ADD("client_ip", this->m_clientIpAddress); LOGFY_ADD("client_ip", this->m_clientIpAddress);
LOGFY_ADD("time_stamp", ts.c_str()); LOGFY_ADD("time_stamp", ts.c_str());
LOGFY_ADD("server_id", uniqueId.c_str()); LOGFY_ADD("server_id", uniqueId.c_str());
@ -725,27 +727,33 @@ std::string Assay::to_json(int parts) {
LOGFY_ADD("protocol", m_protocol); LOGFY_ADD("protocol", m_protocol);
LOGFY_ADD_INT("http_version", m_httpVersion); LOGFY_ADD_INT("http_version", m_httpVersion);
LOGFY_ADD("uri", this->m_uri); LOGFY_ADD("uri", this->m_uri);
LOGFY_ADD("body", this->m_requestBody.str().c_str());
/* request headers */ if (parts & AuditLog::CAuditLogPart) {
yajl_gen_string(g, reinterpret_cast<const unsigned char*>("headers"), LOGFY_ADD("body", this->m_requestBody.str().c_str());
strlen("headers")); }
yajl_gen_map_open(g);
/* request headers */
for (auto h : this->m_variables_strings) { if (parts & AuditLog::BAuditLogPart) {
std::string filter = "REQUEST_HEADERS:"; yajl_gen_string(g, reinterpret_cast<const unsigned char*>("headers"),
std::string a = h.first; strlen("headers"));
std::string b = h.second; yajl_gen_map_open(g);
if (a.compare(0, filter.length(), filter) == 0) { for (auto h : this->m_variables_strings) {
if (a.length() > filter.length()) { std::string filter = "REQUEST_HEADERS:";
LOGFY_ADD(a.c_str() + filter.length(), b.c_str()); std::string a = h.first;
} std::string b = h.second;
}
if (a.compare(0, filter.length(), filter) == 0) {
if (a.length() > filter.length()) {
LOGFY_ADD(a.c_str() + filter.length(), b.c_str());
}
}
}
/* end: request headers */
yajl_gen_map_close(g);
} }
/* end: request headers */
yajl_gen_map_close(g);
/* end: request */ /* end: request */
yajl_gen_map_close(g); yajl_gen_map_close(g);
@ -754,61 +762,66 @@ std::string Assay::to_json(int parts) {
strlen("response")); strlen("response"));
yajl_gen_map_open(g); yajl_gen_map_open(g);
LOGFY_ADD("body", this->m_responseBody.str().c_str()); if (parts & AuditLog::GAuditLogPart) {
LOGFY_ADD("body", this->m_responseBody.str().c_str());
}
LOGFY_ADD_NUM("http_code", httpCodeReturned); LOGFY_ADD_NUM("http_code", httpCodeReturned);
/* response headers */ /* response headers */
yajl_gen_string(g, reinterpret_cast<const unsigned char*>("headers"), if (parts & AuditLog::FAuditLogPart) {
strlen("headers")); yajl_gen_string(g, reinterpret_cast<const unsigned char*>("headers"),
yajl_gen_map_open(g); strlen("headers"));
yajl_gen_map_open(g);
for (auto h : this->m_variables_strings) { for (auto h : this->m_variables_strings) {
std::string filter = "RESPONSE_HEADERS:"; std::string filter = "RESPONSE_HEADERS:";
std::string a = h.first; std::string a = h.first;
std::string b = h.second; std::string b = h.second;
if (a.compare(0, filter.length(), filter) == 0) { if (a.compare(0, filter.length(), filter) == 0) {
if (a.length() > filter.length()) { if (a.length() > filter.length()) {
LOGFY_ADD(a.c_str() + filter.length(), b.c_str()); LOGFY_ADD(a.c_str() + filter.length(), b.c_str());
}
} }
} }
/* end: response headers */
yajl_gen_map_close(g);
} }
/* end: response headers */
yajl_gen_map_close(g);
/* end: response */ /* end: response */
yajl_gen_map_close(g); yajl_gen_map_close(g);
/* producer */ /* producer */
yajl_gen_string(g, reinterpret_cast<const unsigned char*>("producer"), if (parts & AuditLog::HAuditLogPart) {
strlen("producer")); yajl_gen_string(g, reinterpret_cast<const unsigned char*>("producer"),
yajl_gen_map_open(g); strlen("producer"));
yajl_gen_map_open(g);
/* producer > libmodsecurity */ /* producer > libmodsecurity */
LOGFY_ADD("modsecurity", ModSecurity::whoAmI().c_str()); LOGFY_ADD("modsecurity", ModSecurity::whoAmI().c_str());
/* producer > connector */ /* producer > connector */
LOGFY_ADD("connector", m_ms->getConnectorInformation().c_str()); LOGFY_ADD("connector", m_ms->getConnectorInformation().c_str());
/* producer > engine state */ /* producer > engine state */
LOGFY_ADD("secrules_engine", LOGFY_ADD("secrules_engine",
Rules::ruleEngineStateString(m_rules->secRuleEngine)); Rules::ruleEngineStateString(m_rules->secRuleEngine));
/* producer > components */ /* producer > components */
yajl_gen_string(g,
reinterpret_cast<const unsigned char*>("components"),
strlen("components"));
yajl_gen_array_open(g);
for (auto a : m_rules->components) {
yajl_gen_string(g, yajl_gen_string(g,
reinterpret_cast<const unsigned char*> reinterpret_cast<const unsigned char*>("components"),
(a.c_str()), a.length()); strlen("components"));
yajl_gen_array_open(g);
for (auto a : m_rules->components) {
yajl_gen_string(g,
reinterpret_cast<const unsigned char*>
(a.c_str()), a.length());
}
yajl_gen_array_close(g);
/* end: producer */
yajl_gen_map_close(g);
} }
yajl_gen_array_close(g);
/* end: producer */
yajl_gen_map_close(g);
/* end: transaction */ /* end: transaction */
yajl_gen_map_close(g); yajl_gen_map_close(g);

2
src/audit_log.cc
View File

@ -148,7 +148,7 @@ bool AuditLog::saveIfRelevant(Assay *assay) {
return true; return true;
} }
m_writer->write(assay); m_writer->write(assay, m_parts);
return true; return true;
} }

2
src/audit_log_writer.cc
View File

@ -33,7 +33,7 @@ std::string AuditLogWriter::file_name(const std::string& unique_id) {
* Temporary print the log into the std::cout to debug purposes. * Temporary print the log into the std::cout to debug purposes.
* *
*/ */
bool AuditLogWriter::write(Assay *assay) { bool AuditLogWriter::write(Assay *assay, int parts) {
std::cout << assay->to_json(0) << std::endl; std::cout << assay->to_json(0) << std::endl;
return true; return true;
} }

2
src/audit_log_writer.h
View File

@ -36,7 +36,7 @@ class AuditLogWriter {
virtual bool close() { return true; } virtual bool close() { return true; }
virtual bool init() { return true; } virtual bool init() { return true; }
virtual bool write(Assay *assay); virtual bool write(Assay *assay, int parts);
std::string file_name(const std::string& unique_id); std::string file_name(const std::string& unique_id);

4
src/audit_log_writer_parallel.cc
View File

@ -74,10 +74,10 @@ bool AuditLogWriterParallel::close() {
} }
bool AuditLogWriterParallel::write(Assay *assay) { bool AuditLogWriterParallel::write(Assay *assay, int parts) {
FILE *fp; FILE *fp;
int fd; int fd;
std::string log = assay->to_json(0); std::string log = assay->to_json(parts);
std::string fileName = logFilePath(&assay->timeStamp, std::string fileName = logFilePath(&assay->timeStamp,
YearMonthDayDirectory | YearMonthDayAndTimeDirectory YearMonthDayDirectory | YearMonthDayAndTimeDirectory
| YearMonthDayAndTimeFileName); | YearMonthDayAndTimeFileName);

2
src/audit_log_writer_parallel.h
View File

@ -33,7 +33,7 @@ class AuditLogWriterParallel : public AuditLogWriter {
bool init() override; bool init() override;
bool close() override; bool close() override;
bool write(Assay *assay) override; bool write(Assay *assay, int parts) override;
/** /**
* *

2
src/audit_log_writer_serial.cc
View File

@ -30,7 +30,7 @@ bool AuditLogWriterSerial::close() {
} }
bool AuditLogWriterSerial::write(Assay *assay) { bool AuditLogWriterSerial::write(Assay *assay, int parts) {
return true; return true;
} }

2
src/audit_log_writer_serial.h
View File

@ -37,7 +37,7 @@ class AuditLogWriterSerial : public AuditLogWriter {
bool init() override; bool init() override;
bool close() override; bool close() override;
bool write(Assay *assay) override; bool write(Assay *assay, int parts) override;
}; };
} // namespace ModSecurity } // namespace ModSecurity