From 60be385ebeadfbc573b857b6990dbd1cad5048a0 Mon Sep 17 00:00:00 2001 From: Felipe Zimmerle Date: Tue, 21 Jun 2016 10:51:34 -0300 Subject: [PATCH] Adds support to the SERVER_NAME variable --- Makefile.am | 1 + src/parser/seclang-scanner.ll | 2 +- src/transaction.cc | 5 ++ .../regression/variable-SERVER_NAME.json | 89 +++++++++++++++++++ 4 files changed, 96 insertions(+), 1 deletion(-) create mode 100644 test/test-cases/regression/variable-SERVER_NAME.json diff --git a/Makefile.am b/Makefile.am index 54f2666e..3d10bbc3 100644 --- a/Makefile.am +++ b/Makefile.am @@ -220,3 +220,4 @@ TESTS+=test/test-cases/regression/variable-URLENCODED_ERROR.json TESTS+=test/test-cases/regression/variable-RULE.json TESTS+=test/test-cases/regression/variable-STATUS.json TESTS+=test/test-cases/regression/variable-RESPONSE_PROTOCOL.json +TESTS+=test/test-cases/regression/variable-SERVER_NAME.json diff --git a/src/parser/seclang-scanner.ll b/src/parser/seclang-scanner.ll index 22e771b4..dccc03b7 100755 --- a/src/parser/seclang-scanner.ll +++ b/src/parser/seclang-scanner.ll @@ -126,7 +126,7 @@ OPERATOR_GEOIP (?i:@geoLookup) TRANSFORMATION t:(?i:(parityZero7bit|parityOdd7bit|parityEven7bit|sqlHexDecode|cmdLine|sha1|md5|hexEncode|lowercase|urlDecodeUni|urlDecode|none|compressWhitespace|removeWhitespace|replaceNulls|removeNulls|htmlEntityDecode|jsDecode|cssDecode|trim|normalizePathWin|normalisePathWin|normalisePath|length|utf8toUnicode|urldecode|removeCommentsChar|removeComments|replaceComments)) -VARIABLE (?i:(MULTIPART_DATA_AFTER|RESOURCE|ARGS_COMBINED_SIZE|ARGS_GET_NAMES|ARGS_POST_NAMES|FILES_TMPNAMES|FILES_COMBINED_SIZE|FULL_REQUEST_LENGTH|REQUEST_BODY_LENGTH|REQUEST_URI_RAW|UNIQUE_ID|SERVER_PORT|SERVER_ADDR|REMOTE_PORT|REMOTE_HOST|PATH_INFO|MULTIPART_CRLF_LF_LINES|MATCHED_VAR_NAME|MATCHED_VAR|INBOUND_DATA_ERROR|OUTBOUND_DATA_ERROR|FULL_REQUEST|AUTH_TYPE|ARGS_NAMES|REMOTE_ADDR|REQUEST_BASENAME|REQUEST_BODY|REQUEST_FILENAME|REQUEST_HEADERS_NAMES|REQUEST_METHOD|REQUEST_PROTOCOL|REQUEST_URI|RESPONSE_BODY|RESPONSE_CONTENT_LENGTH|RESPONSE_CONTENT_TYPE|RESPONSE_HEADERS_NAMES|RESPONSE_PROTOCOL|RESPONSE_STATUS|USERID|SESSIONID)) +VARIABLE (?i:(SERVER_NAME|MULTIPART_DATA_AFTER|RESOURCE|ARGS_COMBINED_SIZE|ARGS_GET_NAMES|ARGS_POST_NAMES|FILES_TMPNAMES|FILES_COMBINED_SIZE|FULL_REQUEST_LENGTH|REQUEST_BODY_LENGTH|REQUEST_URI_RAW|UNIQUE_ID|SERVER_PORT|SERVER_ADDR|REMOTE_PORT|REMOTE_HOST|PATH_INFO|MULTIPART_CRLF_LF_LINES|MATCHED_VAR_NAME|MATCHED_VAR|INBOUND_DATA_ERROR|OUTBOUND_DATA_ERROR|FULL_REQUEST|AUTH_TYPE|ARGS_NAMES|REMOTE_ADDR|REQUEST_BASENAME|REQUEST_BODY|REQUEST_FILENAME|REQUEST_HEADERS_NAMES|REQUEST_METHOD|REQUEST_PROTOCOL|REQUEST_URI|RESPONSE_BODY|RESPONSE_CONTENT_LENGTH|RESPONSE_CONTENT_TYPE|RESPONSE_HEADERS_NAMES|RESPONSE_PROTOCOL|RESPONSE_STATUS|USERID|SESSIONID)) VARIABLE_COL (?i:(SESSION|GLOBAL|ARGS_POST|ARGS_GET|ARGS|FILES_SIZES|FILES_NAMES|FILES_TMP_CONTENT|MULTIPART_FILENAME|MULTIPART_NAME|MATCHED_VARS_NAMES|MATCHED_VARS|FILES|QUERY_STRING|REQUEST_COOKIES|REQUEST_HEADERS|RESPONSE_HEADERS|GEO|IP|REQUEST_COOKIES_NAMES)) VARIABLE_STATUS (?i:(STATUS[^:])) diff --git a/src/transaction.cc b/src/transaction.cc index 4f350ec4..f0962c5f 100644 --- a/src/transaction.cc +++ b/src/transaction.cc @@ -522,6 +522,11 @@ int Transaction::addRequestHeader(const std::string& key, m_collections.store("REQBODY_PROCESSOR", "URLENCODED"); } } + + if (keyl == "host") { + std::vector host = split(value, ':'); + m_collections.store("SERVER_NAME", host[0]); + } return 1; } diff --git a/test/test-cases/regression/variable-SERVER_NAME.json b/test/test-cases/regression/variable-SERVER_NAME.json new file mode 100644 index 00000000..6318539b --- /dev/null +++ b/test/test-cases/regression/variable-SERVER_NAME.json @@ -0,0 +1,89 @@ +[ + { + "enabled":1, + "version_min":300000, + "title":"Testing Variables :: SERVER_NAME (1/2)", + "client":{ + "ip":"200.249.12.31", + "port":123 + }, + "server":{ + "ip":"200.249.12.31", + "port":80 + }, + "request":{ + "headers":{ + "Host":"localhost", + "User-Agent":"curl/7.38.0", + "Accept":"*/*" + }, + "uri":"/?key=value&key=other_value", + "method":"GET", + "http_version":1.1 + }, + "response":{ + "protocol": "HTTP/1.1", + "headers":{ + "Date":"Mon, 13 Jul 2015 20:02:41 GMT", + "Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT", + "Content-Type":"text/html" + }, + "body":[ + "no need." + ] + }, + "expected":{ + "debug_log":"Target value: \"localhost\" \\(Variable: SERVER_NAME\\)" + }, + "rules":[ + "SecRuleEngine On", + "SecDebugLog \/tmp\/modsec_debug.log", + "SecDebugLogLevel 9", + "SecRule SERVER_NAME \"^HTTP\" \"id:1,phase:5,pass,t:trim\"" + ] + }, + { + "enabled":1, + "version_min":300000, + "title":"Testing Variables :: SERVER_NAME (2/2)", + "client":{ + "ip":"200.249.12.31", + "port":123 + }, + "server":{ + "ip":"200.249.12.31", + "port":80 + }, + "request":{ + "headers":{ + "Host":"www.zimmerle.org:4443", + "User-Agent":"curl/7.38.0", + "Accept":"*/*" + }, + "uri":"/?key=value&key=other_value", + "method":"GET", + "http_version":1.1 + }, + "response":{ + "protocol": "HTTP/1.1", + "headers":{ + "Date":"Mon, 13 Jul 2015 20:02:41 GMT", + "Last-Modified":"Sun, 26 Oct 2014 22:33:37 GMT", + "Content-Type":"text/html" + }, + "body":[ + "no need." + ] + }, + "expected":{ + "debug_log":"Target value: \"www.zimmerle.org\" \\(Variable: SERVER_NAME\\)" + }, + "rules":[ + "SecRuleEngine On", + "SecDebugLog \/tmp\/modsec_debug.log", + "SecDebugLogLevel 9", + "SecRule SERVER_NAME \"^HTTP\" \"id:1,phase:5,pass,t:trim\"" + ] + } +] +