mirror of
https://github.com/owasp-modsecurity/ModSecurity.git
synced 2025-11-17 01:51:52 +03:00
Adds new method for rule merge
IMPORTANT: SecDefaultAction specified on a child configuration will overwrite the ones specified on the parent; Previously it was concatenating.
This commit is contained in:
Felipe Zimmerle
@@ -37,6 +37,10 @@ namespace modsecurity {
|
||||
|
||||
class RuleWithActions : public Rule {
|
||||
public:
|
||||
int SEVERITY_NOT_SET = 10;
|
||||
int ACCURACY_NOT_SET = 10;
|
||||
int MATURITY_NOT_SET = 10;
|
||||
|
||||
RuleWithActions(
|
||||
Actions *a,
|
||||
Transformations *t,
|
||||
@@ -45,24 +49,61 @@ class RuleWithActions : public Rule {
|
||||
|
||||
~RuleWithActions();
|
||||
|
||||
virtual bool evaluate(Transaction *transaction, std::shared_ptr<RuleMessage> ruleMessage) override;
|
||||
RuleWithActions(const RuleWithActions &r)
|
||||
: Rule(r),
|
||||
m_ruleId(r.m_ruleId),
|
||||
m_chainedRuleChild(r.m_chainedRuleChild),
|
||||
m_chainedRuleParent(r.m_chainedRuleParent),
|
||||
m_disruptiveAction(r.m_disruptiveAction),
|
||||
m_logData(r.m_logData),
|
||||
m_msg(r.m_msg),
|
||||
m_actionsRuntimePos(r.m_actionsRuntimePos),
|
||||
m_actionsSetVar(r.m_actionsSetVar),
|
||||
m_actionsTag(r.m_actionsTag),
|
||||
m_defaultActionDisruptiveAction(r.m_defaultActionDisruptiveAction),
|
||||
m_defaultActionLogData(r.m_defaultActionLogData),
|
||||
m_defaultActionMsg(r.m_defaultActionMsg),
|
||||
m_defaultActionActionsRuntimePos(r.m_defaultActionActionsRuntimePos),
|
||||
m_defaultActionActionsSetVar(r.m_defaultActionActionsSetVar),
|
||||
m_defaultActionActionsTag(r.m_defaultActionActionsTag),
|
||||
m_transformations(r.m_transformations),
|
||||
m_defaultTransformations(r.m_defaultTransformations),
|
||||
m_severity(r.m_severity),
|
||||
m_revision(r.m_revision),
|
||||
m_version(r.m_version),
|
||||
m_accuracy(r.m_accuracy),
|
||||
m_maturity(r.m_maturity),
|
||||
m_containsCaptureAction(r.m_containsCaptureAction),
|
||||
m_containsLogAction(r.m_containsLogAction),
|
||||
m_containsNoLogAction(r.m_containsNoLogAction),
|
||||
m_containsMultiMatchAction(r.m_containsMultiMatchAction),
|
||||
m_containsStaticBlockAction(r.m_containsStaticBlockAction),
|
||||
m_defaultSeverity(r.m_defaultSeverity),
|
||||
m_defaultRevision(r.m_defaultRevision),
|
||||
m_defaultVersion(r.m_defaultVersion),
|
||||
m_defaultAccuracy(r.m_defaultAccuracy),
|
||||
m_defaultMaturity(r.m_defaultMaturity),
|
||||
m_defaultContainsCaptureAction(r.m_defaultContainsCaptureAction),
|
||||
m_defaultContainsLogAction(r.m_defaultContainsLogAction),
|
||||
m_defaultContainsNoLogAction(r.m_defaultContainsNoLogAction),
|
||||
m_defaultContainsMultiMatchAction(r.m_defaultContainsMultiMatchAction),
|
||||
m_defaultContainsStaticBlockAction(r.m_defaultContainsStaticBlockAction),
|
||||
m_isChained(r.m_isChained) { };
|
||||
|
||||
|
||||
virtual bool evaluate(Transaction *transaction) override;
|
||||
|
||||
|
||||
void executeActionsIndependentOfChainedRuleResult(
|
||||
Transaction *trasn,
|
||||
bool *containsDisruptive,
|
||||
std::shared_ptr<RuleMessage> ruleMessage);
|
||||
bool *containsDisruptive);
|
||||
|
||||
void executeActionsAfterFullMatch(
|
||||
Transaction *trasn,
|
||||
bool containsDisruptive,
|
||||
std::shared_ptr<RuleMessage> ruleMessage);
|
||||
bool containsDisruptive);
|
||||
|
||||
void executeAction(Transaction *trans,
|
||||
bool containsBlock,
|
||||
std::shared_ptr<RuleMessage> ruleMessage,
|
||||
actions::Action *a,
|
||||
bool context);
|
||||
|
||||
@@ -79,57 +120,278 @@ class RuleWithActions : public Rule {
|
||||
int *nth) const;
|
||||
|
||||
|
||||
void performLogging(Transaction *trans,
|
||||
std::shared_ptr<RuleMessage> ruleMessage,
|
||||
bool lastLog = true,
|
||||
bool chainedParentNull = false);
|
||||
void addAction(actions::Action *a);
|
||||
void addTransformation(std::shared_ptr<actions::transformations::Transformation> t) {
|
||||
m_transformations.push_back(t);
|
||||
}
|
||||
void addDefaultAction(std::shared_ptr<actions::Action>);
|
||||
void addDefaultTransformation(std::shared_ptr<actions::transformations::Transformation> t) {
|
||||
m_defaultTransformations.push_back(t);
|
||||
}
|
||||
|
||||
|
||||
std::vector<actions::Action *> getActionsByName(const std::string& name,
|
||||
Transaction *t);
|
||||
bool containsTag(const std::string& name, Transaction *t);
|
||||
bool containsTag(const std::string& name, Transaction *t) const;
|
||||
bool containsMsg(const std::string& name, Transaction *t);
|
||||
|
||||
inline bool isChained() const { return m_isChained == true; }
|
||||
inline bool hasCaptureAction() const { return m_containsCaptureAction == true; }
|
||||
inline void setChained(bool b) { m_isChained = b; }
|
||||
inline bool hasDisruptiveAction() const { return m_disruptiveAction != NULL; }
|
||||
inline bool hasBlockAction() const { return m_containsStaticBlockAction == true; }
|
||||
inline bool hasMultimatch() const { return m_containsMultiMatchAction == true; }
|
||||
|
||||
inline bool hasLogData() const { return m_logData != NULL; }
|
||||
std::string logData(Transaction *t);
|
||||
inline bool hasMsg() const { return m_msg != NULL; }
|
||||
std::string msg(Transaction *t);
|
||||
inline bool hasSeverity() const { return m_severity != NULL; }
|
||||
int severity() const;
|
||||
void clearDefaultActions() {
|
||||
m_defaultSeverity = SEVERITY_NOT_SET;
|
||||
m_defaultRevision = "";
|
||||
m_defaultVersion = "";
|
||||
m_defaultAccuracy = ACCURACY_NOT_SET;
|
||||
m_defaultMaturity = MATURITY_NOT_SET;
|
||||
m_defaultContainsCaptureAction = false;
|
||||
m_defaultContainsLogAction = false;
|
||||
m_defaultContainsNoLogAction = false;
|
||||
m_defaultContainsMultiMatchAction = false;
|
||||
m_defaultContainsStaticBlockAction = false;
|
||||
m_defaultActionLogData = nullptr;
|
||||
m_defaultActionMsg = nullptr;
|
||||
m_defaultActionActionsSetVar.clear();
|
||||
m_defaultActionActionsTag.clear();
|
||||
m_defaultActionActionsRuntimePos.clear();
|
||||
m_defaultActionDisruptiveAction = nullptr;
|
||||
m_defaultActionActionsRuntimePos.clear();
|
||||
m_defaultTransformations.clear();
|
||||
}
|
||||
|
||||
std::string m_rev;
|
||||
std::string m_ver;
|
||||
int m_accuracy;
|
||||
int m_maturity;
|
||||
Transformations getTransformation() const {
|
||||
Transformations dst;
|
||||
for (auto &a : m_defaultTransformations) {
|
||||
dst.push_back(a);
|
||||
}
|
||||
for (auto &a : m_transformations) {
|
||||
dst.push_back(a);
|
||||
}
|
||||
return dst;
|
||||
}
|
||||
|
||||
TransformationsPtr getTransformationPtr() const {
|
||||
TransformationsPtr dst;
|
||||
for (auto &a : m_defaultTransformations) {
|
||||
dst.push_back(a.get());
|
||||
}
|
||||
for (auto &a : m_transformations) {
|
||||
dst.push_back(a.get());
|
||||
}
|
||||
return dst;
|
||||
}
|
||||
|
||||
SetVars getSetVarsActions() const {
|
||||
SetVars dst;
|
||||
for (auto &a : m_defaultActionActionsSetVar) {
|
||||
dst.push_back(a);
|
||||
}
|
||||
for (auto &a : m_actionsSetVar) {
|
||||
dst.push_back(a);
|
||||
}
|
||||
return dst;
|
||||
}
|
||||
|
||||
SetVarsPtr getSetVarsActionsPtr() const {
|
||||
SetVarsPtr dst;
|
||||
for (auto &a : m_defaultActionActionsSetVar) {
|
||||
dst.push_back(a.get());
|
||||
}
|
||||
for (auto &a : m_actionsSetVar) {
|
||||
dst.push_back(a.get());
|
||||
}
|
||||
return dst;
|
||||
}
|
||||
|
||||
MatchActionsPtr getMatchActionsPtr() const {
|
||||
MatchActionsPtr dst;
|
||||
for (auto &a : m_defaultActionActionsRuntimePos) {
|
||||
dst.push_back(a.get());
|
||||
}
|
||||
for (auto &a : m_actionsRuntimePos) {
|
||||
dst.push_back(a.get());
|
||||
}
|
||||
return dst;
|
||||
}
|
||||
|
||||
MatchActions getMatchActions() const {
|
||||
MatchActions dst;
|
||||
for (auto &a : m_defaultActionActionsRuntimePos) {
|
||||
dst.push_back(a);
|
||||
}
|
||||
for (auto &a : m_actionsRuntimePos) {
|
||||
dst.push_back(a);
|
||||
}
|
||||
return dst;
|
||||
}
|
||||
|
||||
inline bool hasChainAction() const { return m_isChained == true; }
|
||||
inline void setHasChainAction(bool b) { m_isChained = b; }
|
||||
inline bool hasChainedParent() const { return m_chainedRuleParent != nullptr; }
|
||||
inline bool hasChainedChild() const { return m_chainedRuleChild.get() != nullptr; }
|
||||
|
||||
inline bool hasCaptureAction() const { return m_containsCaptureAction || m_defaultContainsCaptureAction; }
|
||||
|
||||
inline bool hasDisruptiveAction() const { return m_disruptiveAction != nullptr || m_defaultActionDisruptiveAction != nullptr; }
|
||||
inline void setDisruptiveAction(std::shared_ptr<actions::Action> a) { m_disruptiveAction = a; }
|
||||
inline std::shared_ptr<actions::Action> getDisruptiveAction() const { return m_disruptiveAction; }
|
||||
|
||||
inline bool hasBlockAction() const { return m_containsStaticBlockAction || m_defaultContainsStaticBlockAction; }
|
||||
inline void setHasBlockAction(bool b) { m_containsStaticBlockAction = b; }
|
||||
|
||||
inline bool hasMultimatchAction() const { return m_containsMultiMatchAction || m_defaultContainsMultiMatchAction; }
|
||||
|
||||
inline bool hasLogAction() const { return m_containsLogAction == true; }
|
||||
inline void setHasLogAction(bool b) { m_containsLogAction = b; }
|
||||
inline bool hasNoLogAction() const { return m_containsNoLogAction == true; }
|
||||
inline void setHasNoLogAction(bool b) { m_containsNoLogAction = b; }
|
||||
|
||||
inline bool hasLogDataAction() const { return m_logData != nullptr || m_defaultActionLogData != nullptr; }
|
||||
inline std::shared_ptr<actions::LogData> getLogDataAction() const { return m_logData; }
|
||||
std::string getLogData(/*const */Transaction *t);
|
||||
inline void setLogDataAction(std::shared_ptr<actions::LogData> data) { m_logData = data; }
|
||||
|
||||
inline bool hasMessageAction() const { return m_msg != nullptr || m_defaultActionMsg != nullptr; }
|
||||
inline std::shared_ptr<actions::Msg> getMessageAction() const { return m_msg; }
|
||||
inline void setMessageAction(std::shared_ptr<actions::Msg> msg) { m_msg = msg; }
|
||||
std::string getMessage(/*const */Transaction *t);
|
||||
|
||||
|
||||
inline bool hasSeverityAction() const { return m_severity != SEVERITY_NOT_SET || m_defaultSeverity != SEVERITY_NOT_SET; }
|
||||
inline int getSeverity() const { return (m_severity != SEVERITY_NOT_SET)?m_severity:m_defaultSeverity; }
|
||||
inline void setDefaultActionSeverity(unsigned int severity) { m_defaultSeverity = severity; }
|
||||
inline void setSeverity(unsigned int severity) { m_severity = severity; }
|
||||
|
||||
inline bool hasRevisionAction() const { return m_revision != ""; }
|
||||
inline std::string getRevision() const { return m_revision; };
|
||||
inline void setRevision(const std::string &revision) { m_revision.assign(revision); }
|
||||
|
||||
inline bool hasVersionAction() const { return m_version != ""; }
|
||||
inline std::string getVersion() const { return m_version; };
|
||||
inline void setVersion(const std::string &version) { m_version.assign(version); }
|
||||
|
||||
inline bool hasAccuracyAction() const { return m_accuracy != ACCURACY_NOT_SET || m_defaultAccuracy != ACCURACY_NOT_SET; }
|
||||
inline int getAccuracy() const { return m_accuracy; }
|
||||
inline void setAccuracy(unsigned int accuracy) { m_accuracy = accuracy; }
|
||||
|
||||
inline bool hasMaturityAction() const { return m_maturity != MATURITY_NOT_SET || m_defaultMaturity != MATURITY_NOT_SET; }
|
||||
inline int getMaturity() const { return m_maturity; }
|
||||
inline void setDefaultActionMaturity(unsigned int maturity) { m_defaultMaturity = maturity; }
|
||||
inline void setMaturity(unsigned int maturity) { m_maturity = maturity; }
|
||||
|
||||
inline bool hasTagAction() const { return m_actionsTag.size() > 0; }
|
||||
inline void setTags(Tags tags) {
|
||||
for (auto tag : tags) {
|
||||
m_actionsTag.push_back(tag);
|
||||
}
|
||||
}
|
||||
inline void cleanTags() {
|
||||
m_actionsTag.clear();
|
||||
}
|
||||
Tags getTagsAction() const {
|
||||
Tags dst;
|
||||
for (auto &a : m_defaultActionActionsTag) {
|
||||
dst.push_back(a);
|
||||
}
|
||||
for (auto &a : m_actionsTag) {
|
||||
dst.push_back(a);
|
||||
}
|
||||
return dst;
|
||||
}
|
||||
|
||||
TagsPtr getTagsActionPtr() const {
|
||||
TagsPtr dst;
|
||||
for (auto &a : m_defaultActionActionsTag) {
|
||||
dst.push_back(a.get());
|
||||
}
|
||||
for (auto &a : m_actionsTag) {
|
||||
dst.push_back(a.get());
|
||||
}
|
||||
return dst;
|
||||
}
|
||||
|
||||
|
||||
int64_t m_ruleId;
|
||||
|
||||
std::unique_ptr<RuleWithActions> m_chainedRuleChild;
|
||||
std::shared_ptr<RuleWithActions> m_chainedRuleChild;
|
||||
RuleWithActions *m_chainedRuleParent;
|
||||
|
||||
private:
|
||||
/* actions */
|
||||
actions::Action *m_disruptiveAction;
|
||||
actions::LogData *m_logData;
|
||||
actions::Msg *m_msg;
|
||||
actions::Severity *m_severity;
|
||||
std::shared_ptr<actions::Action> m_disruptiveAction;
|
||||
std::shared_ptr<actions::LogData> m_logData;
|
||||
std::shared_ptr<actions::Msg> m_msg;
|
||||
MatchActions m_actionsRuntimePos;
|
||||
SetVars m_actionsSetVar;
|
||||
Tags m_actionsTag;
|
||||
|
||||
/* actions || SecDefaultAction */
|
||||
std::shared_ptr<actions::Action> m_defaultActionDisruptiveAction;
|
||||
std::shared_ptr<actions::LogData> m_defaultActionLogData;
|
||||
std::shared_ptr<actions::Msg> m_defaultActionMsg;
|
||||
MatchActions m_defaultActionActionsRuntimePos;
|
||||
SetVars m_defaultActionActionsSetVar;
|
||||
Tags m_defaultActionActionsTag;
|
||||
|
||||
/* actions > transformations */
|
||||
Transformations m_transformations;
|
||||
|
||||
/* actions > transformations || SecDefaultAction */
|
||||
Transformations m_defaultTransformations;
|
||||
|
||||
|
||||
/* || */
|
||||
/**
|
||||
* 0 - EMERGENCY: is generated from correlation of anomaly
|
||||
* scoring data where there is an inbound
|
||||
* attack and an outbound leakage.
|
||||
* 1 - ALERT: is generated from correlation where there is
|
||||
* an inbound attack and an outbound application
|
||||
* level error.
|
||||
* 2 - CRITICAL: Anomaly Score of 5. Is the highest severity
|
||||
* level possible without correlation. It is
|
||||
* normally generated by the web attack rules
|
||||
* (40 level files).
|
||||
* 3 - ERROR: Error - Anomaly Score of 4. Is generated mostly
|
||||
* from outbound leakage rules (50 level files).
|
||||
* 4 - WARNING: Anomaly Score of 3. Is generated by malicious
|
||||
* client rules (35 level files).
|
||||
* 5 - NOTICE: Anomaly Score of 2. Is generated by the Protocol
|
||||
* policy and anomaly files.
|
||||
* 6 - INFO
|
||||
* 7 - DEBUG
|
||||
**/
|
||||
unsigned int m_severity:3;
|
||||
|
||||
std::string m_revision;
|
||||
std::string m_version;
|
||||
|
||||
/**
|
||||
* 1-9 where 9 is very strong and 1 has many false positives
|
||||
*/
|
||||
unsigned int m_accuracy:3;
|
||||
/**
|
||||
* 1-9 where 9 is extensively tested and 1 is a brand new experimental rule
|
||||
*/
|
||||
unsigned int m_maturity:3;
|
||||
|
||||
|
||||
bool m_containsCaptureAction:1;
|
||||
bool m_containsLogAction:1;
|
||||
bool m_containsNoLogAction:1;
|
||||
bool m_containsMultiMatchAction:1;
|
||||
bool m_containsStaticBlockAction:1;
|
||||
|
||||
/* || SecDefaultAction */
|
||||
unsigned int m_defaultSeverity:3;
|
||||
std::string m_defaultRevision;
|
||||
std::string m_defaultVersion;
|
||||
unsigned int m_defaultAccuracy:3;
|
||||
unsigned int m_defaultMaturity:3;
|
||||
bool m_defaultContainsCaptureAction:1;
|
||||
bool m_defaultContainsLogAction:1;
|
||||
bool m_defaultContainsNoLogAction:1;
|
||||
bool m_defaultContainsMultiMatchAction:1;
|
||||
bool m_defaultContainsStaticBlockAction:1;
|
||||
|
||||
bool m_isChained:1;
|
||||
};
|
||||
|
||||
|
||||
Reference in New Issue
Block a user