Adds support to the variable DURATION

This commit is contained in:
Felipe Zimmerle 2015-07-14 19:39:32 -03:00
parent 33dff0f1bf
commit 27252bc801
6 changed files with 146 additions and 2 deletions

View File

@ -94,6 +94,7 @@ libmodsecurity_la_SOURCES = \
rule.cc \
unique_id.cc \
variable.cc \
variable_duration.cc \
operators/operator.cc \
operators/detect_sqli.cc \
operators/detect_xss.cc \

View File

@ -95,6 +95,7 @@ Assay::Assay(ModSecurity *ms, Rules *rules)
m_namesArgs(NULL),
m_namesArgsPost(NULL),
m_namesArgsGet(NULL),
start(std::chrono::system_clock::now()),
m_ms(ms) {
id = std::to_string(this->timeStamp) + \
std::to_string(generate_assay_unique_id());

View File

@ -15,11 +15,13 @@ class Driver;
#include "actions/transformations/transformation.h"
#include "operators/operator.h"
#include "rule.h"
#include "variable_duration.h"
using ModSecurity::actions::Action;
using ModSecurity::actions::transformations::Transformation;
using ModSecurity::operators::Operator;
using ModSecurity::Variable;
using ModSecurity::VariableDuration;
using ModSecurity::Rule;
}
@ -246,13 +248,13 @@ variables:
| variables PIPE RUN_TIME_VAR_DUR
{
std::vector<Variable *> *v = $1;
v->push_back(new Variable($3));
v->push_back(new VariableDuration($3));
$$ = $1;
}
| RUN_TIME_VAR_DUR
{
std::vector<Variable *> *variables = new std::vector<Variable *>;
variables->push_back(new Variable($1));
variables->push_back(new VariableDuration($1));
$$ = variables;
}

47
src/variable_duration.cc Normal file
View File

@ -0,0 +1,47 @@
/**
* ModSecurity, http://www.modsecurity.org/
* Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
*
* You may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* If any of the files related to licensing are missing or if you have any
* other questions related to licensing please contact Trustwave Holdings, Inc.
* directly using the email address security@modsecurity.org.
*
*/
#include "src/variable_duration.h"
#include <iostream>
#include <string>
#include <vector>
#include <list>
#include <chrono>
#include <utility>
#include "modsecurity/assay.h"
namespace ModSecurity {
std::list<std::pair<std::string, std::string>>
VariableDuration::evaluate(Assay *assay) {
std::list<std::pair<std::string, std::string>> resl;
std::string res;
std::pair<std::string, std::string> pair;
auto e = std::chrono::high_resolution_clock::now() - assay->start;
res = std::to_string(
std::chrono::duration_cast<std::chrono::microseconds>(e).count());
pair = std::make_pair(std::string("DURATION"), std::string(res));
resl.push_back(pair);
return resl;
}
} // namespace ModSecurity

41
src/variable_duration.h Normal file
View File

@ -0,0 +1,41 @@
/**
* ModSecurity, http://www.modsecurity.org/
* Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
*
* You may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* If any of the files related to licensing are missing or if you have any
* other questions related to licensing please contact Trustwave Holdings, Inc.
* directly using the email address security@modsecurity.org.
*
*/
#include <vector>
#include <string>
#include <list>
#include <utility>
#ifndef SRC_VARIABLE_DURATION_H_
#define SRC_VARIABLE_DURATION_H_
#include "src/variable.h"
namespace ModSecurity {
class Assay;
class VariableDuration : public Variable {
public:
explicit VariableDuration(std::string _name)
: Variable(_name) { }
std::list<std::pair<std::string, std::string>>
evaluate(Assay *assay) override;
};
} // namespace ModSecurity
#endif // SRC_VARIABLE_DURATION_H_

View File

@ -0,0 +1,52 @@
[
{
"enabled":1,
"version_min":300000,
"title":"Testing Variables :: AUTH_TYPE",
"client":{
"ip":"200.249.12.31",
"port":123
},
"server":{
"ip":"200.249.12.31",
"port":80
},
"request":{
"headers":{
"Host":"localhost",
"User-Agent":"curl/7.38.0",
"Accept":"*/*",
"Content-Length": "27",
"Content-Type": "application/x-www-form-urlencoded",
"Authorization": "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ=="
},
"uri":"/",
"protocol":"POST",
"body": [
"param1=value1&param2=value2"
]
},
"response":{
"headers":{
"Date":"Mon, 13 Jul 2015 20:02:41 GMT",
"Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT",
"Content-Type":"text/html"
},
"body":[
"no need."
]
},
"expected":{
"debug_log":"Target value: \"[0-9]+\""
},
"rules":[
"SecRuleEngine On",
"SecDebugLog \/tmp\/modsec_debug.log",
"SecDebugLogLevel 9",
"SecRule DURATION \"@contains test \" \"phase:3,pass,t:trim\"",
"SecRule DURATION \"@contains test \" \"phase:3,pass,t:trim\"",
"SecRule DURATION \"@contains test \" \"phase:3,pass,t:trim\""
]
}
]