github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-09-30 03:34:29 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix disruptive action flow while RuleEngine is in DetectionOnly

Browse Source
This commit is contained in:
Felipe Zimmerle
2015-09-17 10:49:12 -03:00
parent 490ad23e41
commit 11e1a67d58
8 changed files with 136 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/actions/block.cc
View File

@@ -20,6 +20,7 @@
#include "modsecurity/assay.h"
#include "src/rule.h"
#include "modsecurity/intervention.h"
namespace ModSecurity {
namespace actions {
@@ -32,6 +33,7 @@ Block::Block(std::string action)
bool Block::evaluate(Rule *rule, Assay *assay) {
assay->debug(8, "Running action block");
for (Action *a : rule->actions_runtime_pos) {
if (a->isDisruptive() == true) {
assay->actions.push_back(a);
@@ -41,7 +43,7 @@ bool Block::evaluate(Rule *rule, Assay *assay) {
}
void Block::fill_intervention(ModSecurityIntervention *i) {
i->disruptive = true;
}
} // namespace actions

6
src/actions/deny.cc
View File

@@ -31,13 +31,17 @@ Deny::Deny(std::string action)
bool Deny::evaluate(Rule *rule, Assay *assay) {
assay->debug(8, "Running action deny");
assay->actions.push_back(this);
return true;
}
void Deny::fill_intervention(ModSecurityIntervention *i) {
i->status = 403;
if (i->status == 200) {
i->status = 403;
}
i->log = "Deny action";
i->disruptive = true;
}
} // namespace actions

4
src/assay.cc
View File

@@ -1048,7 +1048,6 @@ void Assay::cleanup() {
*
*/
bool Assay::intervention(ModSecurityIntervention *it) {
bool ret = false;
it->status = 200;
it->url = NULL;
if (actions.size() > 0) {
@@ -1061,9 +1060,8 @@ bool Assay::intervention(ModSecurityIntervention *it) {
}
}
actions.clear();
ret = true;
}
return ret;
return it->disruptive;
}

84
src/rule.cc
View File

@@ -30,6 +30,7 @@
#include "actions/transformations/none.h"
#include "variables/variations/exclusion.h"
#include "src/utils.h"
#include "modsecurity/rules.h"
#include "src/macro_expansion.h"
using ModSecurity::Variables::Variations::Exclusion;
@@ -128,6 +129,7 @@ Rule::Rule(Operator *_op,
bool Rule::evaluateActions(Assay *assay) {
int none = 0;
bool containsDisruptive = false;
int transformations = 0;
for (Action *a : this->actions_runtime_pre) {
None *z = dynamic_cast<None *>(a);
@@ -168,17 +170,54 @@ bool Rule::evaluateActions(Assay *assay) {
}
}
for (Action *a : assay->m_rules->defaultActions[this->phase]) {
if (a->action_kind == actions::Action::RunTimeOnlyIfMatchKind) {
assay->debug(4, "(SecDefaultAction) Running action: " + a->action);
for (Action *a : this->actions_runtime_pos) {
if (a->isDisruptive() == false) {
assay->debug(4, "Running (_non_ disruptive) action: " + a->action);
a->evaluate(this, assay);
} else {
containsDisruptive = true;
}
}
for (Action *a :
this->actions_runtime_pos) {
assay->debug(4, "Running action: " + a->action);
a->evaluate(this, assay);
for (Action *a : assay->m_rules->defaultActions[this->phase]) {
if (a->action_kind == actions::Action::RunTimeOnlyIfMatchKind) {
if (a->isDisruptive()) {
if (containsDisruptive) {
assay->debug(4, "(SecDefaultAction) " \
"_ignoring_ action: " + a->action + \
" (rule contains a disruptive action)");
} else {
if (assay->m_rules->secRuleEngine
== Rules::EnabledRuleEngine) {
assay->debug(4, "(SecDefaultAction) " \
"Running action: " + a->action + \
" (rule _does not_ contains a " \
"disruptive action)");
a->evaluate(this, assay);
} else {
assay->debug(4, "(SecDefaultAction) " \
"_Not_ running action: " + a->action + \
". Rule _does not_ contains a " \
"disruptive action, but SecRuleEngine is not On.");
}
}
} else {
assay->debug(4, "(SecDefaultAction) Running action: " + \
a->action);
a->evaluate(this, assay);
}
}
}
for (Action *a : this->actions_runtime_pos) {
if (a->isDisruptive()
&& assay->m_rules->secRuleEngine == Rules::EnabledRuleEngine) {
assay->debug(4, "Running (disruptive) action: " + a->action);
a->evaluate(this, assay);
} else if (a->isDisruptive()) {
assay->debug(4, "Not running disruptive action: " + \
a->action + ". SecRuleEngine is not On");
}
}
return true;
@@ -343,24 +382,39 @@ bool Rule::evaluate(Assay *assay) {
"_ignoring_ action: " + a->action + \
" (rule contains a disruptive action)");
} else {
assay->debug(4, "(SecDefaultAction) " \
"Running action: " + a->action + \
" (rule _does not_ contains a " \
"disruptive action)");
a->evaluate(this, assay);
if (assay->m_rules->secRuleEngine
== Rules::EnabledRuleEngine) {
assay->debug(4, "(SecDefaultAction) " \
"Running action: " + a->action + \
" (rule _does not_ contains a " \
"disruptive action)");
a->evaluate(this, assay);
} else {
assay->debug(4, "(SecDefaultAction) " \
"_Not_ running action: " + a->action + \
". Rule _does not_ contains a " \
"disruptive action, but SecRuleEngine is not On.");
}
}
} else {
assay->debug(4, "(SecDefaultAction) Running " \
"action: " + a->action);
"action: " + a->action + "!!" + std::to_string(a->isDisruptive()));
a->evaluate(this, assay);
}
}
}
for (Action *a :
this->actions_runtime_pos) {
if (a->isDisruptive()) {
assay->debug(4, "Running (disruptive) action: " + a->action);
if (a->isDisruptive()
&& assay->m_rules->secRuleEngine
== Rules::EnabledRuleEngine) {
assay->debug(4, "Running (disruptive) action: " + \
a->action);
a->evaluate(this, assay);
} else if (a->isDisruptive()) {
assay->debug(4,
"Not running disruptive action: " + \
a->action + ". SecRuleEngine is not On");
}
}
}