diff --git a/src/Makefile.am b/src/Makefile.am index 5768a2c3..40db6522 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -94,6 +94,7 @@ libmodsecurity_la_SOURCES = \ rule.cc \ unique_id.cc \ variable.cc \ + variable_duration.cc \ operators/operator.cc \ operators/detect_sqli.cc \ operators/detect_xss.cc \ diff --git a/src/assay.cc b/src/assay.cc index 048239f9..22f8531d 100644 --- a/src/assay.cc +++ b/src/assay.cc @@ -95,6 +95,7 @@ Assay::Assay(ModSecurity *ms, Rules *rules) m_namesArgs(NULL), m_namesArgsPost(NULL), m_namesArgsGet(NULL), + start(std::chrono::system_clock::now()), m_ms(ms) { id = std::to_string(this->timeStamp) + \ std::to_string(generate_assay_unique_id()); diff --git a/src/parser/seclang-parser.yy b/src/parser/seclang-parser.yy index 28156d61..91f925ae 100644 --- a/src/parser/seclang-parser.yy +++ b/src/parser/seclang-parser.yy @@ -15,11 +15,13 @@ class Driver; #include "actions/transformations/transformation.h" #include "operators/operator.h" #include "rule.h" +#include "variable_duration.h" using ModSecurity::actions::Action; using ModSecurity::actions::transformations::Transformation; using ModSecurity::operators::Operator; using ModSecurity::Variable; +using ModSecurity::VariableDuration; using ModSecurity::Rule; } @@ -246,13 +248,13 @@ variables: | variables PIPE RUN_TIME_VAR_DUR { std::vector *v = $1; - v->push_back(new Variable($3)); + v->push_back(new VariableDuration($3)); $$ = $1; } | RUN_TIME_VAR_DUR { std::vector *variables = new std::vector; - variables->push_back(new Variable($1)); + variables->push_back(new VariableDuration($1)); $$ = variables; } diff --git a/src/variable_duration.cc b/src/variable_duration.cc new file mode 100644 index 00000000..ba0ae224 --- /dev/null +++ b/src/variable_duration.cc @@ -0,0 +1,47 @@ +/** + * ModSecurity, http://www.modsecurity.org/ + * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/) + * + * You may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * If any of the files related to licensing are missing or if you have any + * other questions related to licensing please contact Trustwave Holdings, Inc. + * directly using the email address security@modsecurity.org. + * + */ + +#include "src/variable_duration.h" + +#include +#include +#include +#include +#include +#include + +#include "modsecurity/assay.h" + +namespace ModSecurity { + +std::list> + VariableDuration::evaluate(Assay *assay) { + std::list> resl; + std::string res; + std::pair pair; + + auto e = std::chrono::high_resolution_clock::now() - assay->start; + + res = std::to_string( + std::chrono::duration_cast(e).count()); + + pair = std::make_pair(std::string("DURATION"), std::string(res)); + resl.push_back(pair); + + return resl; +} + + +} // namespace ModSecurity diff --git a/src/variable_duration.h b/src/variable_duration.h new file mode 100644 index 00000000..1a793b4d --- /dev/null +++ b/src/variable_duration.h @@ -0,0 +1,41 @@ +/** + * ModSecurity, http://www.modsecurity.org/ + * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/) + * + * You may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * If any of the files related to licensing are missing or if you have any + * other questions related to licensing please contact Trustwave Holdings, Inc. + * directly using the email address security@modsecurity.org. + * + */ + +#include +#include +#include +#include + +#ifndef SRC_VARIABLE_DURATION_H_ +#define SRC_VARIABLE_DURATION_H_ + +#include "src/variable.h" + +namespace ModSecurity { + +class Assay; + +class VariableDuration : public Variable { + public: + explicit VariableDuration(std::string _name) + : Variable(_name) { } + + std::list> + evaluate(Assay *assay) override; +}; + +} // namespace ModSecurity + +#endif // SRC_VARIABLE_DURATION_H_ diff --git a/test/test-cases/regression/variable-DURATION.json b/test/test-cases/regression/variable-DURATION.json new file mode 100644 index 00000000..624840a5 --- /dev/null +++ b/test/test-cases/regression/variable-DURATION.json @@ -0,0 +1,52 @@ +[ + { + "enabled":1, + "version_min":300000, + "title":"Testing Variables :: AUTH_TYPE", + "client":{ + "ip":"200.249.12.31", + "port":123 + }, + "server":{ + "ip":"200.249.12.31", + "port":80 + }, + "request":{ + "headers":{ + "Host":"localhost", + "User-Agent":"curl/7.38.0", + "Accept":"*/*", + "Content-Length": "27", + "Content-Type": "application/x-www-form-urlencoded", + "Authorization": "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" + }, + "uri":"/", + "protocol":"POST", + "body": [ + "param1=value1¶m2=value2" + ] + }, + "response":{ + "headers":{ + "Date":"Mon, 13 Jul 2015 20:02:41 GMT", + "Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT", + "Content-Type":"text/html" + }, + "body":[ + "no need." + ] + }, + "expected":{ + "debug_log":"Target value: \"[0-9]+\"" + }, + "rules":[ + "SecRuleEngine On", + "SecDebugLog \/tmp\/modsec_debug.log", + "SecDebugLogLevel 9", + "SecRule DURATION \"@contains test \" \"phase:3,pass,t:trim\"", + "SecRule DURATION \"@contains test \" \"phase:3,pass,t:trim\"", + "SecRule DURATION \"@contains test \" \"phase:3,pass,t:trim\"" + ] + } +] +