Moves rule* headers to src/

src/actions/accuracy.cc

@@ -21,7 +21,8 @@
 #include "modsecurity/actions/action.h"
 #include "modsecurity/transaction.h"
 #include "modsecurity/rule.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
+
 
 namespace modsecurity {
 namespace actions {

src/actions/block.cc

@@ -24,7 +24,8 @@
 #include "modsecurity/rule.h"
 #include "modsecurity/intervention.h"
 #include "src/actions/data/status.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
+
 
 namespace modsecurity {
 namespace actions {

src/actions/chain.cc

@@ -20,7 +20,7 @@
 
 #include "modsecurity/transaction.h"
 #include "modsecurity/rule.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
 
 
 namespace modsecurity {

src/actions/maturity.cc

@@ -21,7 +21,8 @@
 #include "modsecurity/actions/action.h"
 #include "modsecurity/transaction.h"
 #include "modsecurity/rule.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
+
 
 namespace modsecurity {
 namespace actions {

src/actions/phase.cc

@@ -22,7 +22,7 @@
 #include "modsecurity/rule.h"
 #include "modsecurity/modsecurity.h"
 #include "src/utils/string.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
 
 
 namespace modsecurity {

src/actions/rev.cc

@@ -21,7 +21,7 @@
 #include "modsecurity/actions/action.h"
 #include "modsecurity/transaction.h"
 #include "modsecurity/rule.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
 
 
 namespace modsecurity {

src/actions/rule_id.cc

@@ -20,7 +20,7 @@
 
 #include "modsecurity/transaction.h"
 #include "modsecurity/rule.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
 
 
 namespace modsecurity {

src/actions/set_env.cc

@@ -21,7 +21,7 @@
 #include "modsecurity/transaction.h"
 #include "modsecurity/rule.h"
 #include "src/utils/string.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
 
 
 namespace modsecurity {

src/actions/set_var.cc

@@ -30,7 +30,8 @@
 #include "src/variables/tx.h"
 #include "src/variables/user.h"
 #include "src/variables/variable.h"
-#include "modsecurity/rule_with_operator.h"
+#include "src/rule_with_operator.h"
+
 
 namespace modsecurity {
 namespace actions {

src/actions/ver.cc

@@ -21,7 +21,7 @@
 #include "modsecurity/actions/action.h"
 #include "modsecurity/transaction.h"
 #include "modsecurity/rule.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
 
 
 namespace modsecurity {

src/operators/detect_sqli.cc

@@ -20,7 +20,7 @@
 
 #include "src/operators/operator.h"
 #include "others/libinjection/src/libinjection.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
 
 
 namespace modsecurity {

src/operators/detect_xss.cc

@@ -19,7 +19,7 @@
 
 #include "src/operators/operator.h"
 #include "others/libinjection/src/libinjection.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
 
 
 namespace modsecurity {

src/operators/pm.cc

@@ -28,7 +28,7 @@
 #include "src/operators/operator.h"
 #include "src/utils/acmp.h"
 #include "src/utils/string.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
 
 
 namespace modsecurity {

src/operators/rbl.cc

@@ -25,7 +25,7 @@
 
 #include "modsecurity/rules_set.h"
 #include "src/operators/operator.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
 
 
 namespace modsecurity {

src/operators/rx.cc

@@ -22,7 +22,7 @@
 #include "src/operators/operator.h"
 #include "modsecurity/rule.h"
 #include "modsecurity/rule_message.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
 
 
 namespace modsecurity {

src/operators/rx_global.cc

@@ -20,7 +20,7 @@
 #include <memory>
 
 #include "src/operators/operator.h"
-#include "modsecurity/rule.h"
+#include "src/rule_with_actions.h"
 #include "modsecurity/rule_message.h"
 
 namespace modsecurity {

src/operators/verify_cc.cc

@@ -21,7 +21,7 @@
 #include <vector>
 
 #include "src/operators/operator.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
 
 
 #if PCRE_HAVE_JIT

src/operators/verify_cpf.cc

@@ -19,7 +19,7 @@
 #include <list>
 
 #include "src/operators/operator.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
 
 
 namespace modsecurity {

src/operators/verify_ssn.cc

@@ -20,7 +20,7 @@
 #include <list>
 
 #include "src/operators/operator.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
 
 
 namespace modsecurity {

src/operators/verify_svnr.cc

@@ -9,7 +9,7 @@
 #include "modsecurity/rule_message.h"
 #include "modsecurity/rules_set_properties.h"
 
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
 
 namespace modsecurity {
 namespace operators {

src/parser/driver.cc

@@ -18,7 +18,7 @@
 #include "modsecurity/rules_set_properties.h"
 #include "src/parser/seclang-parser.hh"
 #include "modsecurity/audit_log.h"
-#include "modsecurity/rule_marker.h"
+#include "src/rule_marker.h"
 
 using modsecurity::audit_log::AuditLog;
 using modsecurity::RuleWithOperator;

src/parser/seclang-parser.hh

@@ -56,9 +56,9 @@ class Driver;
 }
 }
 
-#include "modsecurity/rule_unconditional.h"
-#include "modsecurity/rule_with_operator.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_unconditional.h"
+#include "src/rule_with_operator.h"
+#include "src/rule_with_actions.h"
 #include "src/rule_script.h"
 
 #include "src/actions/accuracy.h"

src/parser/seclang-parser.yy

@@ -17,9 +17,9 @@ class Driver;
 }
 }
 
-#include "modsecurity/rule_unconditional.h"
-#include "modsecurity/rule_with_operator.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_unconditional.h"
+#include "src/rule_with_operator.h"
+#include "src/rule_with_actions.h"
 #include "src/rule_script.h"
 
 #include "src/actions/accuracy.h"

src/rule_marker.h

@@ -0,0 +1,74 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#ifdef __cplusplus
+#include <stack>
+#include <vector>
+#include <string>
+#include <list>
+#include <memory>
+#include <utility>
+#endif
+
+#ifndef HEADERS_MODSECURITY_RULE_MARKER_H_
+#define HEADERS_MODSECURITY_RULE_MARKER_H_
+
+#include "modsecurity/transaction.h"
+#include "modsecurity/modsecurity.h"
+#include "modsecurity/variable_value.h"
+#include "modsecurity/rule.h"
+
+#ifdef __cplusplus
+
+namespace modsecurity {
+
+
+class RuleMarker : public Rule {
+ public:
+    RuleMarker(
+        const std::string &name,
+        std::unique_ptr<std::string> fileName,
+        int lineNumber)
+        : Rule(std::move(fileName), lineNumber),
+        m_name(std::make_shared<std::string>(name)) { }
+
+
+    virtual bool evaluate(Transaction *transaction) override {
+        if (transaction->isInsideAMarker()) {
+            if (*transaction->getCurrentMarker() == *m_name) {
+                transaction->removeMarker();
+                // FIXME: Move this to .cc
+                //        ms_dbg_a(transaction, 4, "Out of a SecMarker " + *m_name);
+            }
+        }
+
+        return true;
+    };
+
+
+    std::shared_ptr<std::string> getName() const {
+        return m_name;
+    }
+
+ private:
+    std::shared_ptr<std::string> m_name;
+};
+
+
+}  // namespace modsecurity
+
+#endif
+
+#endif  // HEADERS_MODSECURITY_RULE_MARKER_H_

src/rule_message.cc

@@ -20,7 +20,7 @@
 #include "modsecurity/transaction.h"
 #include "src/utils/string.h"
 #include "src/actions/tag.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
 
 
 namespace modsecurity {

src/rule_script.h

@@ -32,7 +32,7 @@
 #include "src/actions/log_data.h"
 #include "src/actions/severity.h"
 #include "src/variables/variable.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
 
 
 #ifndef SRC_RULE_SCRIPT_H_

src/rule_unconditional.cc

@@ -13,7 +13,7 @@
  *
  */
 
-#include "modsecurity/rule_unconditional.h"
+#include "src/rule_unconditional.h"
 
 
 namespace modsecurity {

src/rule_unconditional.h

@@ -0,0 +1,63 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#ifdef __cplusplus
+#include <stack>
+#include <vector>
+#include <string>
+#include <list>
+#include <memory>
+#include <utility>
+#endif
+
+#ifndef SRC_RULE_UNCONDITIONAL_H_
+#define SRC_RULE_UNCONDITIONAL_H_
+
+#include "modsecurity/modsecurity.h"
+#include "modsecurity/variable_value.h"
+#include "modsecurity/rule.h"
+#include "modsecurity/rules_set.h"
+#include "modsecurity/actions/action.h"
+#include "src/rule_with_actions.h"
+
+#ifdef __cplusplus
+
+namespace modsecurity {
+
+
+class RuleUnconditional : public RuleWithActions {
+ public:
+    RuleUnconditional(
+        std::vector<actions::Action *> *actions,
+        Transformations *transformations,
+        std::unique_ptr<std::string> fileName,
+        int lineNumber)
+        : RuleWithActions(actions, transformations, std::move(fileName), lineNumber) { }
+
+    RuleUnconditional(const RuleUnconditional &r)
+        : RuleWithActions(r)
+        { }
+
+    virtual bool evaluate(Transaction *transaction) override;
+
+ private:
+};
+
+
+}  // namespace modsecurity
+
+#endif
+
+#endif  // SRC_RULE_UNCONDITIONAL_H_

src/rule_with_actions.cc

@@ -29,7 +29,7 @@
 #include "modsecurity/modsecurity.h"
 #include "modsecurity/rule_message.h"
 #include "modsecurity/rules_set.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
 #include "src/actions/accuracy.h"
 #include "src/actions/block.h"
 #include "src/actions/capture.h"
@@ -360,10 +360,8 @@ void RuleWithActions::executeTransformations(
     int none = 0;
 
     ModSecString ssin;
-    ssin.assign(in.c_str());
-
-    TransformationResult a = TransformationResult(&ssin);
-    results.push_back(a);
+    ssin.assign(in.c_str(), in.size());
+    results.push_back(TransformationResult(&ssin));
 
 
     std::string path("");
@@ -418,8 +416,8 @@ void RuleWithActions::executeTransformations(
             + std::to_string(results.size()) + \
             " values to be tested.");
     } else {
-        results.pop_front();
-        results.push_back(TransformationResult(&ssin));
+        //results.push_back(TransformationResult(nullptr, ssin));
+        //results.pop_front();
     }
 */
 }
@@ -441,7 +439,7 @@ void RuleWithActions::executeTransformation(
 
 void RuleWithActions::executeTransformation(
     Transaction *transaction,
-    ModSecString in,
+    ModSecString &in,
     TransformationsResults *ret,
     Transformation *transformation) {
 

src/rule_with_actions.h

@@ -0,0 +1,549 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#ifdef __cplusplus
+#include <stack>
+#include <vector>
+#include <string>
+#include <list>
+#include <memory>
+#include <utility>
+#endif
+
+#ifndef SRC_RULE_WITH_ACTIONS_H_
+#define SRC_RULE_WITH_ACTIONS_H_
+
+#include "modsecurity/transaction.h"
+#include "modsecurity/modsecurity.h"
+#include "modsecurity/variable_value.h"
+#include "modsecurity/rule.h"
+
+
+#ifdef __cplusplus
+
+namespace modsecurity {
+
+namespace actions {
+class Action;
+class Severity;
+class LogData;
+class Msg;
+class Rev;
+class SetVar;
+class Tag;
+class XmlNS;
+namespace transformations {
+class Transformation;
+}
+}
+
+using Transformation = actions::transformations::Transformation;
+using Transformations = std::vector<std::shared_ptr<Transformation> >;
+using TransformationsPtr = std::vector<Transformation *>;
+using Action = actions::Action;
+using Actions = std::vector<actions::Action *>;
+using Tags = std::vector<std::shared_ptr<actions::Tag> >;
+using TagsPtr = std::vector<actions::Tag *>;
+using SetVars = std::vector<std::shared_ptr<actions::SetVar> >;
+using SetVarsPtr = std::vector<actions::SetVar *>;
+using MatchActions = std::vector<std::shared_ptr<actions::Action > >;
+using MatchActionsPtr = std::vector<actions::Action *>;
+
+using XmlNSs = std::vector<std::shared_ptr<actions::XmlNS> >;
+using XmlNSsPtr = std::vector<actions::XmlNS *>;
+
+
+class TransformationResult {
+ public:
+    TransformationResult(
+        ModSecString *after,
+        std::string *transformation)
+        : m_after(*after),
+        m_transformation(transformation) { };
+
+    explicit TransformationResult(
+        ModSecString *after)
+        : m_after(*after),
+        m_transformation(nullptr) { };
+
+    TransformationResult(const TransformationResult &t2)
+        : m_after(t2.m_after),
+        m_transformation(t2.m_transformation) { };
+
+
+    ModSecString *getAfter() {
+        return &m_after;
+    }
+
+
+    std::string *getTransformationName() {
+        return m_transformation;
+    }
+
+
+ private:
+    ModSecString m_after;
+    std::string *m_transformation;
+};
+
+using TransformationsResults = std::list<TransformationResult>;
+
+
+class RuleWithActions : public Rule {
+ public:
+    int SEVERITY_NOT_SET = 10;
+    int ACCURACY_NOT_SET = 10;
+    int MATURITY_NOT_SET = 10;
+
+
+    RuleWithActions(
+        Actions *a,
+        Transformations *t,
+        std::unique_ptr<std::string> fileName,
+        int lineNumber);
+    ~RuleWithActions();
+
+    RuleWithActions(const RuleWithActions &r)
+        : Rule(r),
+        m_ruleId(r.m_ruleId),
+        m_chainedRuleChild(r.m_chainedRuleChild),
+        m_chainedRuleParent(r.m_chainedRuleParent),
+        m_disruptiveAction(r.m_disruptiveAction),
+        m_logData(r.m_logData),
+        m_msg(r.m_msg),
+        m_actionsRuntimePos(r.m_actionsRuntimePos),
+        m_actionsSetVar(r.m_actionsSetVar),
+        m_actionsTag(r.m_actionsTag),
+        m_XmlNSs(r.m_XmlNSs),
+        m_defaultActionDisruptiveAction(r.m_defaultActionDisruptiveAction),
+        m_defaultActionLogData(r.m_defaultActionLogData),
+        m_defaultActionMsg(r.m_defaultActionMsg),
+        m_defaultActionActionsRuntimePos(r.m_defaultActionActionsRuntimePos),
+        m_defaultActionActionsSetVar(r.m_defaultActionActionsSetVar),
+        m_defaultActionActionsTag(r.m_defaultActionActionsTag),
+        m_transformations(r.m_transformations),
+        m_defaultTransformations(r.m_defaultTransformations),
+        m_severity(r.m_severity),
+        m_revision(r.m_revision),
+        m_version(r.m_version),
+        m_accuracy(r.m_accuracy),
+        m_maturity(r.m_maturity),
+        m_containsCaptureAction(r.m_containsCaptureAction),
+        m_containsLogAction(r.m_containsLogAction),
+        m_containsNoLogAction(r.m_containsNoLogAction),
+        m_containsMultiMatchAction(r.m_containsMultiMatchAction),
+        m_containsStaticBlockAction(r.m_containsStaticBlockAction),
+        m_defaultSeverity(r.m_defaultSeverity),
+        m_defaultRevision(r.m_defaultRevision),
+        m_defaultVersion(r.m_defaultVersion),
+        m_defaultAccuracy(r.m_defaultAccuracy),
+        m_defaultMaturity(r.m_defaultMaturity),
+        m_defaultContainsCaptureAction(r.m_defaultContainsCaptureAction),
+        m_defaultContainsLogAction(r.m_defaultContainsLogAction),
+        m_defaultContainsNoLogAction(r.m_defaultContainsNoLogAction),
+        m_defaultContainsMultiMatchAction(r.m_defaultContainsMultiMatchAction),
+        m_defaultContainsStaticBlockAction(r.m_defaultContainsStaticBlockAction),
+        m_isChained(r.m_isChained) { };
+
+    RuleWithActions &operator=(const RuleWithActions& r) {
+        Rule::operator = (r);
+        m_ruleId = r.m_ruleId;
+        m_chainedRuleChild = r.m_chainedRuleChild;
+        m_chainedRuleParent = r.m_chainedRuleParent;
+        m_disruptiveAction = r.m_disruptiveAction;
+        m_logData = r.m_logData;
+        m_msg = r.m_msg;
+        m_actionsRuntimePos = r.m_actionsRuntimePos;
+        m_actionsSetVar = r.m_actionsSetVar;
+        m_actionsTag = r.m_actionsTag;
+        m_XmlNSs = r.m_XmlNSs;
+        m_defaultActionDisruptiveAction = r.m_defaultActionDisruptiveAction;
+        m_defaultActionLogData = r.m_defaultActionLogData;
+        m_defaultActionMsg = r.m_defaultActionMsg;
+        m_defaultActionActionsRuntimePos = r.m_defaultActionActionsRuntimePos;
+        m_defaultActionActionsSetVar = r.m_defaultActionActionsSetVar;
+        m_defaultActionActionsTag = r.m_defaultActionActionsTag;
+        m_transformations = r.m_transformations;
+        m_defaultTransformations = r.m_defaultTransformations;
+        m_severity = r.m_severity;
+        m_revision = r.m_revision;
+        m_version = r.m_version;
+        m_accuracy = r.m_accuracy;
+        m_maturity = r.m_maturity;
+        m_containsCaptureAction = r.m_containsCaptureAction;
+        m_containsLogAction = r.m_containsLogAction;
+        m_containsNoLogAction = r.m_containsNoLogAction;
+        m_containsMultiMatchAction = r.m_containsMultiMatchAction;
+        m_containsStaticBlockAction = r.m_containsStaticBlockAction;
+        m_defaultSeverity = r.m_defaultSeverity;
+        m_defaultRevision = r.m_defaultRevision;
+        m_defaultVersion = r.m_defaultVersion;
+        m_defaultAccuracy = r.m_defaultAccuracy;
+        m_defaultMaturity = r.m_defaultMaturity;
+        m_defaultContainsCaptureAction = r.m_defaultContainsCaptureAction;
+        m_defaultContainsLogAction = r.m_defaultContainsLogAction;
+        m_defaultContainsNoLogAction = r.m_defaultContainsNoLogAction;
+        m_defaultContainsMultiMatchAction = r.m_defaultContainsMultiMatchAction;
+        m_defaultContainsStaticBlockAction = r.m_defaultContainsStaticBlockAction;
+        m_isChained = r.m_isChained;
+        return *this;
+    }
+
+
+    virtual bool evaluate(Transaction *transaction) override;
+
+
+    void executeActionsIndependentOfChainedRuleResult(
+        Transaction *trasn);
+
+    void executeActionsAfterFullMatch(
+        Transaction *trasn);
+
+    void executeAction(Transaction *trans,
+        Action *a,
+        bool context);
+
+
+    static void executeTransformation(
+        Transaction *transaction,
+        TransformationsResults *ret,
+        Transformation *transformation);
+
+    static void executeTransformation(
+        Transaction *transaction,
+        ModSecString &in,
+        TransformationsResults *ret,
+        Transformation *transformation);
+
+    void executeTransformations(
+        Transaction *transaction,
+        const std::string &value,
+        TransformationsResults &results);
+
+    void addAction(actions::Action *a);
+    void addTransformation(std::shared_ptr<actions::transformations::Transformation> t) {
+        m_transformations.push_back(t);
+    }
+    void addDefaultAction(std::shared_ptr<actions::Action>);
+    void addDefaultTransformation(std::shared_ptr<actions::transformations::Transformation> t) {
+        m_defaultTransformations.push_back(t);
+    }
+
+
+    std::vector<actions::Action *> getActionsByName(const std::string& name,
+        Transaction *t);
+    bool containsTag(const std::string& name, Transaction *t) const;
+    bool containsMsg(const std::string& name, Transaction *t);
+
+
+    void clearDefaultActions() {
+        m_defaultSeverity = SEVERITY_NOT_SET;
+        m_defaultRevision = "";
+        m_defaultVersion = "";
+        m_defaultAccuracy = ACCURACY_NOT_SET;
+        m_defaultMaturity = MATURITY_NOT_SET;
+        m_defaultContainsCaptureAction = false;
+        m_defaultContainsLogAction = false;
+        m_defaultContainsNoLogAction = false;
+        m_defaultContainsMultiMatchAction = false;
+        m_defaultContainsStaticBlockAction = false;
+        m_defaultActionLogData = nullptr;
+        m_defaultActionMsg = nullptr;
+        m_defaultActionActionsSetVar.clear();
+        m_defaultActionActionsTag.clear();
+        m_defaultActionActionsRuntimePos.clear();
+        m_defaultActionDisruptiveAction = nullptr;
+        m_defaultActionActionsRuntimePos.clear();
+        m_defaultTransformations.clear();
+    }
+
+    Transformations getTransformation() const {
+        Transformations dst;
+        for (auto &a : m_defaultTransformations) {
+            dst.push_back(a);
+        }
+        for (auto &a : m_transformations) {
+            dst.push_back(a);
+        }
+        return dst;
+    }
+
+    TransformationsPtr getTransformationPtr() const {
+        TransformationsPtr dst;
+        for (auto &a : m_defaultTransformations) {
+            dst.push_back(a.get());
+        }
+        for (auto &a : m_transformations) {
+            dst.push_back(a.get());
+        }
+        return dst;
+    }
+
+    SetVars getSetVarsActions() const {
+        SetVars dst;
+        for (auto &a : m_defaultActionActionsSetVar) {
+            dst.push_back(a);
+        }
+        for (auto &a : m_actionsSetVar) {
+            dst.push_back(a);
+        }
+        return dst;
+    }
+
+    SetVarsPtr getSetVarsActionsPtr() const {
+        SetVarsPtr dst;
+        for (auto &a : m_defaultActionActionsSetVar) {
+            dst.push_back(a.get());
+        }
+        for (auto &a : m_actionsSetVar) {
+            dst.push_back(a.get());
+        }
+        return dst;
+    }
+
+    MatchActionsPtr getMatchActionsPtr() const {
+        MatchActionsPtr dst;
+        for (auto &a : m_defaultActionActionsRuntimePos) {
+            dst.push_back(a.get());
+        }
+        for (auto &a : m_actionsRuntimePos) {
+            dst.push_back(a.get());
+        }
+        return dst;
+    }
+
+    MatchActions getMatchActions() const {
+        MatchActions dst;
+        for (auto &a : m_defaultActionActionsRuntimePos) {
+            dst.push_back(a);
+        }
+        for (auto &a : m_actionsRuntimePos) {
+            dst.push_back(a);
+        }
+        return dst;
+    }
+
+    inline bool hasChainAction() const { return m_isChained == true; }
+    inline void setHasChainAction(bool b) { m_isChained = b; }
+    inline bool hasChainedParent() const { return m_chainedRuleParent != nullptr; }
+    inline bool hasChainedChild() const { return m_chainedRuleChild.get() != nullptr; }
+
+    inline bool hasCaptureAction() const { return m_containsCaptureAction || m_defaultContainsCaptureAction; }
+
+    inline bool hasDisruptiveAction() const { return m_disruptiveAction != nullptr || m_defaultActionDisruptiveAction != nullptr; }
+    inline void setDisruptiveAction(const std::shared_ptr<actions::Action> &a) { m_disruptiveAction = a; }
+    inline std::shared_ptr<actions::Action> getDisruptiveAction() const { return m_disruptiveAction; }
+
+    inline bool hasBlockAction() const { return m_containsStaticBlockAction || m_defaultContainsStaticBlockAction; }
+    inline void setHasBlockAction(bool b) { m_containsStaticBlockAction = b; }
+
+    inline bool hasMultimatchAction() const { return m_containsMultiMatchAction || m_defaultContainsMultiMatchAction; }
+
+    inline bool hasLogAction() const { return m_containsLogAction == true; }
+    inline void setHasLogAction(bool b) { m_containsLogAction = b; }
+    inline bool hasNoLogAction() const { return m_containsNoLogAction == true; }
+    inline void setHasNoLogAction(bool b) { m_containsNoLogAction = b; }
+
+    inline bool hasLogDataAction() const { return m_logData != nullptr || m_defaultActionLogData != nullptr; }
+    inline std::shared_ptr<actions::LogData> getLogDataAction() const { return m_logData; }
+    std::string getLogData(/*const */Transaction *t);
+    inline void setLogDataAction(const std::shared_ptr<actions::LogData> &data) { m_logData = data; }
+
+    inline bool hasMessageAction() const { return m_msg != nullptr || m_defaultActionMsg != nullptr; }
+    inline std::shared_ptr<actions::Msg> getMessageAction() const { return m_msg; }
+    inline void setMessageAction(const std::shared_ptr<actions::Msg> &msg) { m_msg = msg; }
+    std::string getMessage(/*const */Transaction *t);
+
+
+    inline bool hasSeverityAction() const { return m_severity != SEVERITY_NOT_SET || m_defaultSeverity != SEVERITY_NOT_SET; }
+    inline int getSeverity() const { return (m_severity != SEVERITY_NOT_SET)?m_severity:m_defaultSeverity; }
+    inline void setDefaultActionSeverity(unsigned int severity) { m_defaultSeverity = severity; }
+    inline void setSeverity(unsigned int severity) { m_severity = severity; }
+
+    inline bool hasRevisionAction() const { return m_revision != ""; }
+    inline std::string getRevision() const { return m_revision; };
+    inline void setRevision(const std::string &revision) { m_revision.assign(revision); }
+
+    inline bool hasVersionAction() const { return m_version != ""; }
+    inline std::string getVersion() const { return m_version; };
+    inline void setVersion(const std::string &version) { m_version.assign(version); }
+
+    inline bool hasAccuracyAction() const { return m_accuracy != ACCURACY_NOT_SET || m_defaultAccuracy != ACCURACY_NOT_SET; }
+    inline int getAccuracy() const { return m_accuracy; }
+    inline void setAccuracy(unsigned int accuracy) { m_accuracy = accuracy; }
+
+    inline bool hasMaturityAction() const { return m_maturity != MATURITY_NOT_SET || m_defaultMaturity != MATURITY_NOT_SET; }
+    inline int getMaturity() const { return m_maturity; }
+    inline void setDefaultActionMaturity(unsigned int maturity) { m_defaultMaturity = maturity; }
+    inline void setMaturity(unsigned int maturity) { m_maturity = maturity; }
+
+    inline bool hasTagAction() const { return m_actionsTag.size() > 0; }
+    inline void setTags(Tags tags) {
+        for (auto tag : tags) {
+            m_actionsTag.push_back(tag);
+        }
+    }
+    inline void cleanTags() {
+        m_actionsTag.clear();
+    }
+    Tags getTagsAction() const {
+        Tags dst;
+        for (auto &a : m_defaultActionActionsTag) {
+            dst.push_back(a);
+        }
+        for (auto &a : m_actionsTag) {
+            dst.push_back(a);
+        }
+        return dst;
+    }
+
+    TagsPtr getTagsActionPtr() const {
+        TagsPtr dst;
+        for (auto &a : m_defaultActionActionsTag) {
+            dst.push_back(a.get());
+        }
+        for (auto &a : m_actionsTag) {
+            dst.push_back(a.get());
+        }
+        return dst;
+    }
+
+    inline int64_t getId() const { return m_ruleId; }
+    void setId(int id) {
+        m_ruleId = id;
+    }
+
+    void setChainedNext(std::unique_ptr<RuleWithActions> r) {
+        m_chainedRuleChild = std::move(r);
+    }
+
+    inline RuleWithActions *getChainedNext() const {
+        return m_chainedRuleChild.get();
+    }
+
+    void setChainedParent(RuleWithActions *r) {
+        m_chainedRuleParent = r;
+    }
+
+    inline RuleWithActions *getChainedParent() {
+        return m_chainedRuleParent;
+    }
+
+    XmlNSsPtr getXmlNSsPtr() const {
+        /**
+         * FIXME: this is not conteplating SecRuleUpdateActionBy* yet.
+         *
+         */
+        XmlNSsPtr dst;
+        for (auto &a : m_XmlNSs) {
+            dst.push_back(a.get());
+        }
+        
+        return dst;
+    }
+
+ private:
+    int64_t m_ruleId;
+
+    std::shared_ptr<RuleWithActions> m_chainedRuleChild;
+    RuleWithActions *m_chainedRuleParent;
+
+    /* actions */
+    std::shared_ptr<actions::Action> m_disruptiveAction;
+    std::shared_ptr<actions::LogData> m_logData;
+    std::shared_ptr<actions::Msg> m_msg;
+    MatchActions m_actionsRuntimePos;
+    SetVars m_actionsSetVar;
+    Tags m_actionsTag;
+    XmlNSs m_XmlNSs;
+
+    /* actions || SecDefaultAction */
+    std::shared_ptr<actions::Action> m_defaultActionDisruptiveAction;
+    std::shared_ptr<actions::LogData> m_defaultActionLogData;
+    std::shared_ptr<actions::Msg> m_defaultActionMsg;
+    MatchActions m_defaultActionActionsRuntimePos;
+    SetVars m_defaultActionActionsSetVar;
+    Tags m_defaultActionActionsTag;
+
+    /* actions > transformations */
+    Transformations m_transformations;
+
+    /* actions > transformations || SecDefaultAction */
+    Transformations m_defaultTransformations;
+
+
+    /* || */
+    /**
+     * 0 - EMERGENCY: is generated from correlation of anomaly
+     *                scoring data where there is an inbound
+     *                attack and an outbound leakage.
+     * 1 - ALERT: is generated from correlation where there is
+     *                an inbound attack and an outbound application
+     *                level error.
+     * 2 - CRITICAL: Anomaly Score of 5. Is the highest severity
+     *               level possible without correlation. It is
+     *               normally generated by the web attack rules
+     *               (40 level files).
+     * 3 - ERROR: Error - Anomaly Score of 4. Is generated mostly
+     *            from outbound leakage rules (50 level files).
+     * 4 - WARNING: Anomaly Score of 3. Is generated by malicious
+     *              client rules (35 level files).
+     * 5 - NOTICE: Anomaly Score of 2. Is generated by the Protocol
+     *             policy and anomaly files.
+     * 6 - INFO
+     * 7 - DEBUG
+     **/
+    unsigned int m_severity:3;
+
+    std::string m_revision;
+    std::string m_version;
+
+    /**
+     * 1-9 where 9 is very strong and 1 has many false positives
+     */
+    unsigned int m_accuracy:3;
+    /**
+     * 1-9 where 9 is extensively tested and 1 is a brand new experimental rule
+     */
+    unsigned int m_maturity:3;
+
+
+    bool m_containsCaptureAction:1;
+    bool m_containsLogAction:1;
+    bool m_containsNoLogAction:1;
+    bool m_containsMultiMatchAction:1;
+    bool m_containsStaticBlockAction:1;
+
+    /* || SecDefaultAction */
+    unsigned int m_defaultSeverity:3;
+    std::string m_defaultRevision;
+    std::string m_defaultVersion;
+    unsigned int m_defaultAccuracy:3;
+    unsigned int m_defaultMaturity:3;
+    bool m_defaultContainsCaptureAction:1;
+    bool m_defaultContainsLogAction:1;
+    bool m_defaultContainsNoLogAction:1;
+    bool m_defaultContainsMultiMatchAction:1;
+    bool m_defaultContainsStaticBlockAction:1;
+
+    bool m_isChained:1;
+};
+
+}  // namespace modsecurity
+#endif
+
+
+#endif  // SRC_RULE_WITH_ACTIONS_H_
+

src/rule_with_operator.cc

@@ -13,7 +13,6 @@
  *
  */
 
-#include "modsecurity/rule_with_operator.h"
 
 #include <stdio.h>
 
@@ -41,6 +40,7 @@
 #include "src/actions/set_var.h"
 #include "src/actions/block.h"
 #include "src/variables/variable.h"
+#include "src/rule_with_operator.h"
 
 
 namespace modsecurity {
@@ -265,6 +265,7 @@ bool RuleWithOperator::evaluate(Transaction *trans) {
         }
         var->evaluate(trans, this, &e);
         for (const VariableValue *v : e) {
+            TransformationsResults transformationsResults;
             const std::string &value = v->getValue();
             const std::string &key = v->getKeyWithCollection();
 
@@ -291,8 +292,6 @@ bool RuleWithOperator::evaluate(Transaction *trans) {
                 continue;
             }
 
-            TransformationsResults transformationsResults;
-
             executeTransformations(trans, value, transformationsResults);
 
             auto iter = transformationsResults.begin();
@@ -303,8 +302,8 @@ bool RuleWithOperator::evaluate(Transaction *trans) {
             while (iter != transformationsResults.end()) {
                 bool ret;
                 auto &valueTemp = *iter;
-                // FIXME: this copy is not necessary.
-                std::string *valueAfterTrans = new std::string(valueTemp.getAfter()->c_str());
+                // FIXME: this copy is not necessary.                
+                std::string *valueAfterTrans = new std::string(valueTemp.getAfter()->c_str(), valueTemp.getAfter()->size());
 
                 ret = executeOperatorAt(trans, key, *valueAfterTrans);
 
@@ -315,6 +314,7 @@ bool RuleWithOperator::evaluate(Transaction *trans) {
                     for (auto &i : v->getOrigin()) {
                         trans->messageGetLast()->m_reference.append(i->toText());
                     }
+
                     auto iter2 = transformationsResults.begin();
                     while (iter2 != transformationsResults.end()) {
                         if (iter2->getTransformationName()) {
@@ -323,8 +323,8 @@ bool RuleWithOperator::evaluate(Transaction *trans) {
                         /*
                         if (iter == iter2) {
                             break;
-                        } else {
-                            trans->messageGetLast()->m_reference.append("--");
+                        } else if (iter2->getTransformationName()) {
+                            trans->messageGetLast()->m_reference.append(",");
                         }
                         */
                         iter2++;

src/rule_with_operator.h

@@ -0,0 +1,94 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#ifdef __cplusplus
+#include <stack>
+#include <vector>
+#include <string>
+#include <list>
+#include <memory>
+#include <utility>
+#endif
+
+#ifndef SRC_RULE_WITH_OPERATOR_H_
+#define SRC_RULE_WITH_OPERATOR_H_
+
+#include "modsecurity/transaction.h"
+#include "modsecurity/modsecurity.h"
+#include "modsecurity/variable_value.h"
+#include "modsecurity/rule.h"
+#include "src/rule_with_actions.h"
+
+#ifdef __cplusplus
+
+namespace modsecurity {
+
+
+class RuleWithOperator : public RuleWithActions {
+ public:
+    RuleWithOperator(operators::Operator *op,
+        variables::Variables *variables,
+        std::vector<actions::Action *> *actions,
+        Transformations *transformations,
+        std::unique_ptr<std::string> fileName,
+        int lineNumber);
+
+    RuleWithOperator(const RuleWithOperator &op)
+        : RuleWithActions(op),
+        m_variables(op.m_variables),
+        m_operator(op.m_operator) { };
+
+    RuleWithOperator &operator=(const RuleWithOperator& r) {
+        RuleWithActions::operator = (r);
+        m_variables = r.m_variables;
+        m_operator = r.m_operator;
+        return *this;
+    }
+
+    virtual ~RuleWithOperator();
+
+    bool evaluate(Transaction *transaction) override;
+
+    void getVariablesExceptions(Transaction *t,
+        variables::Variables *exclusion, variables::Variables *addition);
+    inline void getFinalVars(variables::Variables *vars,
+        variables::Variables *eclusion, Transaction *trans);
+
+    bool executeOperatorAt(Transaction *trasn, const std::string &key,
+        std::string value);
+
+    static void updateMatchedVars(Transaction *trasn, const std::string &key,
+        const std::string &value);
+    static void cleanMatchedVars(Transaction *trasn);
+
+
+    std::string getOperatorName() const;
+
+    virtual std::string getReference() override {
+        return std::to_string(getId());
+    }
+
+ private:
+    std::shared_ptr<modsecurity::variables::Variables> m_variables;
+    std::shared_ptr<operators::Operator> m_operator;
+};
+
+
+}  // namespace modsecurity
+#endif
+
+
+#endif  // SRC_RULE_WITH_OPERATOR_H_
+

src/rules.cc

@@ -14,7 +14,7 @@
  */
 
 #include "modsecurity/rules.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
 
 
 namespace modsecurity {

src/rules_set.cc

@@ -20,7 +20,7 @@
 #include <vector>
 
 #include "modsecurity/rules_set.h"
-#include "modsecurity/rule_marker.h"
+#include "src/rule_marker.h"
 #include "modsecurity/modsecurity.h"
 #include "modsecurity/transaction.h"
 #include "src/parser/driver.h"

src/rules_set_phases.cc

@@ -13,17 +13,8 @@
  *
  */
 
-#include <ctime>
-#include <iostream>
-#include <fstream>
-#include <string>
-#include <vector>
-
 #include "modsecurity/rules_set_phases.h"
-#include "modsecurity/rule.h"
-#include "modsecurity/rules.h"
-#include "modsecurity/modsecurity.h"
-
+#include "src/rule_with_operator.h"
 
 
 namespace modsecurity {
@@ -47,6 +38,7 @@ int RulesSetPhases::append(RulesSetPhases *from, std::ostringstream *err) {
         v.reserve(m_rulesAtPhase[i].size());
         for (size_t z = 0; z < m_rulesAtPhase[i].size(); z++) {
             RuleWithOperator *rule_ckc = dynamic_cast<RuleWithOperator *>(m_rulesAtPhase[i].at(z).get());
+            //RuleWithOperator *rule_ckc = dynamic_cast<RuleWithOperator *>(m_rulesAtPhase->at(i).get());
             if (!rule_ckc) {
                 continue;
             }
@@ -62,7 +54,6 @@ int RulesSetPhases::append(RulesSetPhases *from, std::ostringstream *err) {
         }
         amount_of_rules = amount_of_rules + res;
 
-
         /**
          * An action set in a child will overwrite an action set on a parent.
          *
@@ -91,6 +82,7 @@ int RulesSetPhases::append(RulesSetPhases *from, std::ostringstream *err) {
 
 void RulesSetPhases::dump() const {
     for (int i = 0; i <= modsecurity::Phases::NUMBER_OF_PHASES; i++) {
+        const Rules *rules = &m_rulesAtPhase[i];
         std::cout << "Phase: " << std::to_string(i);
         std::cout << " (" << std::to_string(m_rulesAtPhase[i].size());
         std::cout << " rules)" << std::endl;
@@ -99,5 +91,14 @@ void RulesSetPhases::dump() const {
 }
 
 
-}  // namespace modsecurity
+Rules *RulesSetPhases::operator[](int index) {
+    return &m_rulesAtPhase[index];
+}
 
+
+Rules *RulesSetPhases::at(int index) {
+    return &m_rulesAtPhase[index];
+}
+
+
+}  // namespace modsecurity

src/run_time_string.cc

@@ -25,7 +25,7 @@
 #include "src/variables/highest_severity.h"
 #include "src/utils/string.h"
 #include "src/variables/variable.h"
-#include "modsecurity/rule_with_operator.h"
+#include "src/rule_with_operator.h"
 
 
 namespace modsecurity {

src/transaction.cc

@@ -52,6 +52,7 @@
 #include "modsecurity/rules_set_properties.h"
 #include "src/actions/disruptive/allow.h"
 #include "src/variables/remote_user.h"
+#include "src/rule_with_actions.h"
 
 
 

src/variables/rule.h

@@ -24,7 +24,8 @@
 #include "src/actions/severity.h"
 #include "src/actions/log_data.h"
 #include "src/actions/msg.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
+
 
 namespace modsecurity {
 

src/variables/xml.cc

@@ -42,7 +42,7 @@
 #include "src/request_body_processor/xml.h"
 #include "modsecurity/actions/action.h"
 #include "src/actions/xmlns.h"
-#include "modsecurity/rule_with_actions.h"
+#include "src/rule_with_actions.h"
 
 
 namespace modsecurity {