github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-13 21:36:00 +03:00
Code Issues Packages Projects Releases Wiki Activity

Refactoring on Action - having RuleWithAction and RuleWithActionsProperties

Browse Source
This commit is contained in:
Felipe Zimmerle 2020-09-23 13:48:15 -03:00
parent 2da2d372d8
commit 6ced3b3921
No known key found for this signature in database
GPG Key ID: E6DFB08CE8B11277
43 changed files with 1794 additions and 1531 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/Makefile.am
View File

@ -288,6 +288,7 @@ libmodsecurity_la_SOURCES = \
rules.cc \
rule_unconditional.cc \
rule_with_actions.cc \
rule_with_actions_properties.cc \
rule_with_operator.cc \
rule_message.cc \
rule_script.cc \

4
src/actions/action_with_run_time_string.h
View File

@ -43,14 +43,14 @@ class ActionWithRunTimeString : public virtual Action {
return *this;
}
virtual void populate(RuleWithActions *rule) {
virtual void populate(const RuleWithActions *rule) {
if (m_string) {
m_string->populate(rule);
}
}
std::string getEvaluatedRunTimeString(const Transaction *transaction) const noexcept {
return (m_string == nullptr)?"":m_string->evaluate(transaction);
return (!m_string)?"":m_string->evaluate(transaction);
}
bool hasRunTimeString() const noexcept {

2
src/actions/audit_log.h
View File

@ -36,7 +36,7 @@ class AuditLog : public ActionTypeRuleMetaData,
{ }
void configure(RuleWithActions *rule) override {
rule->setHasAuditLogAction(true);
rule->setAuditLog(true);
}
};

2
src/actions/block.h
View File

@ -37,7 +37,7 @@ class Block : public ActionTypeRuleMetaData,
{ }
void configure(RuleWithActions *rule) override {
rule->setHasBlockAction(true);
rule->setBlock(true);
}
};

2
src/actions/capture.h
View File

@ -33,7 +33,7 @@ class Capture : public ActionTypeRuleMetaData {
: Action("capture") { }
void configure(RuleWithActions *rule) override {
rule->setHasCaptureAction(true);
rule->setHasCapture(true);
}
};

2
src/actions/log.h
View File

@ -37,7 +37,7 @@ class Log : public ActionTypeRuleMetaData,
{ }
void configure(RuleWithActions *rule) override {
rule->setHasLogAction(true);
rule->setLog(true);
}
};

2
src/actions/multi_match.h
View File

@ -34,7 +34,7 @@ class MultiMatch : public ActionTypeRuleMetaData {
void configure(RuleWithActions *rule) override {
rule->setHasMultimatchAction(true);
rule->setMultiMatch(true);
}
};

2
src/actions/no_audit_log.h
View File

@ -36,7 +36,7 @@ class NoAuditLog : public ActionTypeRuleMetaData,
{ }
void configure(RuleWithActions *rule) override {
rule->setHasNoAuditLogAction(true);
rule->setNoAuditLog(true);
}
};

2
src/actions/no_log.h
View File

@ -36,7 +36,7 @@ class NoLog : public ActionTypeRuleMetaData,
{ }
void configure(RuleWithActions *rule) override {
rule->setHasNoLogAction(true);
rule->setNoLog(true);
}
};

2
src/actions/set_var.h
View File

@ -87,7 +87,7 @@ class SetVar : public ActionWithRunTimeString, public ActionWithExecution {
bool execute(Transaction *transaction) const noexcept override;
void populate(RuleWithActions *rule) override {
void populate(const RuleWithActions *rule) override {
ActionWithRunTimeString::populate(rule);
variables::RuleVariable *rulev =
dynamic_cast<variables::RuleVariable *>(

2
src/actions/tag.h
View File

@ -47,7 +47,7 @@ class Tag : public ActionWithRunTimeString,
bool execute(Transaction *transaction) const noexcept override;
inline std::string getTagName(Transaction *transaction) const {
inline std::string getTagName(const Transaction *transaction) const {
return getEvaluatedRunTimeString(transaction);
}

2
src/operators/detect_sqli.cc
View File

@ -45,7 +45,7 @@ bool DetectSQLi::evaluate(Transaction *transaction,
ms_dbg_a(transaction, 4, "detected SQLi using libinjection with " \
"fingerprint '" + std::string(fingerprint) + "' at: '" +
input.to_string() + "'");
if (rule && rule->hasCaptureAction()) {
if (rule && rule->hasCapture()) {
transaction->m_collections.m_tx_collection->storeOrUpdateFirst(
"0", std::string(fingerprint));
ms_dbg_a(transaction, 7, "Added DetectSQLi match TX.0: " + \

2
src/operators/detect_xss.cc
View File

@ -37,7 +37,7 @@ bool DetectXSS::evaluate(Transaction *transaction,
if (transaction) {
if (is_xss) {
ms_dbg_a(transaction, 5, "detected XSS using libinjection.");
if (rule && rule->hasCaptureAction()) {
if (rule && rule->hasCapture()) {
transaction->m_collections.m_tx_collection->storeOrUpdateFirst(
"0", std::string(input));
ms_dbg_a(transaction, 7, "Added DetectXSS match TX.0: " + \

2
src/operators/pm.cc
View File

@ -105,7 +105,7 @@ bool Pm::evaluate(Transaction *transaction,
logOffset(ruleMessage, rc - match_.size() + 1, match_.size());
transaction->m_matched.push_back(match_);
if (rule && rule->hasCaptureAction()) {
if (rule && rule->hasCapture()) {
transaction->m_collections.m_tx_collection->storeOrUpdateFirst("0",
match_);
ms_dbg_a(transaction, 7, "Added pm match TX.0: " + \

2
src/operators/rbl.cc
View File

@ -229,7 +229,7 @@ bool Rbl::evaluate(Transaction *transaction,
furtherInfo(sin, str.c_str(), transaction, m_provider);
freeaddrinfo(info);
if (rule && transaction && rule->hasCaptureAction()) {
if (rule && transaction && rule->hasCapture()) {
transaction->m_collections.m_tx_collection->storeOrUpdateFirst(
"0", std::string(str));
ms_dbg_a(transaction, 7, "Added RXL match TX.0: " + \

2
src/operators/rx.cc
View File

@ -58,7 +58,7 @@ bool Rx::evaluate(Transaction *transaction,
std::vector<Utils::SMatchCapture> captures;
// FIXME: searchOneMatch should accept string_view.
re->searchOneMatch(input.c_str(), captures);
if (rule && rule->hasCaptureAction() && transaction) {
if (rule && rule->hasCapture() && transaction) {
for (const Utils::SMatchCapture& capture : captures) {
const std::string capture_substring(input.substr(capture.m_offset,capture.m_length));
transaction->m_collections.m_tx_collection->storeOrUpdateFirst(

2
src/operators/rx_global.cc
View File

@ -54,7 +54,7 @@ bool RxGlobal::evaluate(Transaction *transaction, const RuleWithActions *rule,
std::vector<Utils::SMatchCapture> captures;
re->searchGlobal(input.c_str(), captures);
if (rule && rule->hasCaptureAction() && transaction) {
if (rule && rule->hasCapture() && transaction) {
for (const Utils::SMatchCapture& capture : captures) {
const std::string capture_substring(input.substr(capture.m_offset,capture.m_length));
transaction->m_collections.m_tx_collection->storeOrUpdateFirst(

2
src/operators/verify_cc.cc
View File

@ -145,7 +145,7 @@ bool VerifyCC::evaluate(Transaction *transaction,
int is_cc = luhnVerify(match.c_str(), match.size());
if (is_cc) {
if (transaction) {
if (rule && rule->hasCaptureAction()) {
if (rule && rule->hasCapture()) {
transaction->m_collections.m_tx_collection->storeOrUpdateFirst(
"0", std::string(match));
ms_dbg_a(transaction, 7, "Added VerifyCC match TX.0: " + \

2
src/operators/verify_cpf.cc
View File

@ -128,7 +128,7 @@ bool VerifyCPF::evaluate(Transaction *transaction,
is_cpf = verify(m.str().c_str(), m.str().size());
if (is_cpf) {
logOffset(ruleMessage, m.offset(), m.str().size());
if (rule && transaction && rule->hasCaptureAction()) {
if (rule && transaction && rule->hasCapture()) {
transaction->m_collections.m_tx_collection->storeOrUpdateFirst(
"0", m.str());
ms_dbg_a(transaction, 7, "Added VerifyCPF match TX.0: " + \

2
src/operators/verify_ssn.cc
View File

@ -130,7 +130,7 @@ bool VerifySSN::evaluate(Transaction *transaction,
is_ssn = verify(j.str().c_str(), j.str().size());
if (is_ssn) {
logOffset(ruleMessage, j.offset(), j.str().size());
if (rule && transaction && rule->hasCaptureAction()) {
if (rule && transaction && rule->hasCapture()) {
transaction->m_collections.m_tx_collection->storeOrUpdateFirst(
"0", j.str());
ms_dbg_a(transaction, 7, "Added VerifySSN match TX.0: " + \

2
src/operators/verify_svnr.cc
View File

@ -97,7 +97,7 @@ bool VerifySVNR::evaluate(Transaction *t,
is_svnr = verify(j.str().c_str(), j.str().size());
if (is_svnr) {
logOffset(ruleMessage, j.offset(), j.str().size());
if (rule && t && rule->hasCaptureAction()) {
if (rule && t && rule->hasCapture()) {
t->m_collections.m_tx_collection->storeOrUpdateFirst(
"0", j.str());
ms_dbg_a(t, 7, "Added VerifySVNR match TX.0: " + \

39
src/parser/driver.cc
View File

@ -109,59 +109,62 @@ int Driver::addSecRule(std::unique_ptr<RuleWithActions> r) {
);
firstRule->setLogDataAction(nullptr);
}
if (firstRule->hasSeverityAction()) {
if (firstRule->hasSeverity()) {
firstRule->getChainedParent()->setSeverity(
firstRule->getSeverity()
);
}
if (firstRule->hasRevisionAction()) {
if (firstRule->hasRevision()) {
firstRule->getChainedParent()->setRevision(
firstRule->getRevision()
);
}
if (firstRule->hasVersionAction()) {
if (firstRule->hasVersion()) {
firstRule->getChainedParent()->setVersion(
firstRule->getVersion()
);
}
if (firstRule->hasAccuracyAction()) {
if (firstRule->hasAccuracy()) {
firstRule->getChainedParent()->setAccuracy(
firstRule->getAccuracy()
);
}
if (firstRule->hasMaturityAction()) {
if (firstRule->hasMaturity()) {
firstRule->getChainedParent()->setMaturity(
firstRule->getMaturity()
);
}
if (firstRule->hasTagAction()) {
if (firstRule->hasTags()) {
firstRule->getChainedParent()->setTags(
firstRule->getTagsAction()
firstRule->getTags()
);
firstRule->cleanTags();
firstRule->clearTags();
}
/* disruptive can only be set on the first rule
if (firstRule->hasDisruptiveAction()) {
firstRule->getChainedParent()->setDisruptiveAction(
firstRule->getDisruptiveAction()
);
firstRule->setDisruptiveAction(nullptr);
}
firstRule->getChainedParent()->setHasBlockAction(
firstRule->hasBlockAction()
*/
firstRule->getChainedParent()->setBlock(
firstRule->hasBlock()
);
firstRule->getChainedParent()->setHasLogAction(
firstRule->hasLogAction()
firstRule->getChainedParent()->setLog(
firstRule->hasLog()
);
firstRule->getChainedParent()->setHasLogAction(
firstRule->hasNoLogAction()
firstRule->getChainedParent()->setNoLog(
firstRule->hasNoLog()
);
firstRule->getChainedParent()->setHasAuditLogAction(
firstRule->hasAuditLogAction()
firstRule->getChainedParent()->setAuditLog(
firstRule->hasAuditLog()
);
firstRule->getChainedParent()->setHasNoAuditLogAction(
firstRule->hasNoAuditLogAction()
firstRule->getChainedParent()->setNoAuditLog(
firstRule->hasNoAuditLog()
);
firstRule = firstRule->getChainedParent();
}

1577
src/parser/seclang-parser.cc
View File

File diff suppressed because it is too large Load Diff

47
src/parser/seclang-parser.yy
View File

@ -1075,7 +1075,7 @@ expression:
audit_log
| DIRECTIVE variables op actions
{
std::vector<actions::Action *> *a = new std::vector<actions::Action *>();
std::vector<std::shared_ptr<actions::Action>> *a = new std::vector<std::shared_ptr<actions::Action>>();
std::vector<std::shared_ptr<actions::transformations::Transformation> > *t = new std::vector<std::shared_ptr<actions::transformations::Transformation> >();
for (auto &i : *$4.get()) {
if (dynamic_cast<actions::transformations::Transformation *>(i.get())) {
@ -1083,7 +1083,7 @@ expression:
std::shared_ptr<actions::transformations::Transformation> t2 = std::dynamic_pointer_cast<actions::transformations::Transformation>(std::move(at));
t->push_back(std::move(t2));
} else {
a->push_back(i.release());
a->push_back(std::move(i));
}
}
variables::Variables *v = new variables::Variables();
@ -1100,7 +1100,7 @@ expression:
/* file name */ std::unique_ptr<std::string>(new std::string(*@1.end.filename)),
/* line number */ @1.end.line
));
// TODO: filename should be a shared_ptr.
if (driver.addSecRule(std::move(rule)) == false) {
YYERROR;
}
@ -1126,7 +1126,7 @@ expression:
}
| CONFIG_DIR_SEC_ACTION actions
{
std::vector<actions::Action *> *a = new std::vector<actions::Action *>();
std::vector<std::shared_ptr<actions::Action>> *a = new std::vector<std::shared_ptr<actions::Action>>();
std::vector<std::shared_ptr<actions::transformations::Transformation> > *t = new std::vector<std::shared_ptr<actions::transformations::Transformation> >();
for (auto &i : *$2.get()) {
if (dynamic_cast<actions::transformations::Transformation *>(i.get())) {
@ -1134,7 +1134,7 @@ expression:
std::shared_ptr<actions::transformations::Transformation> t2 = std::dynamic_pointer_cast<actions::transformations::Transformation>(std::move(at));
t->push_back(std::move(t2));
} else {
a->push_back(i.release());
a->push_back(std::move(i));
}
}
std::unique_ptr<RuleUnconditional> rule(new RuleUnconditional(
@ -1148,7 +1148,7 @@ expression:
| DIRECTIVE_SECRULESCRIPT actions
{
std::string err;
std::vector<actions::Action *> *a = new std::vector<actions::Action *>();
std::vector<std::shared_ptr<actions::Action>> *a = new std::vector<std::shared_ptr<actions::Action>>();
std::vector<std::shared_ptr<actions::transformations::Transformation> > *t = new std::vector<std::shared_ptr<actions::transformations::Transformation> >();
for (auto &i : *$2.get()) {
if (dynamic_cast<actions::transformations::Transformation *>(i.get())) {
@ -1156,7 +1156,7 @@ expression:
std::shared_ptr<actions::transformations::Transformation> t2 = std::dynamic_pointer_cast<actions::transformations::Transformation>(std::move(at));
t->push_back(std::move(t2));
} else {
a->push_back(i.release());
a->push_back(std::move(i));
}
}
std::unique_ptr<RuleScript> r(new RuleScript(
@ -1178,25 +1178,25 @@ expression:
| CONFIG_DIR_SEC_DEFAULT_ACTION actions
{
bool hasDisruptive = false;
std::vector<actions::Action *> *actions = new std::vector<actions::Action *>();
std::vector<std::shared_ptr<actions::Action>> *actions = new std::vector<std::shared_ptr<actions::Action>>();
for (auto &i : *$2.get()) {
actions->push_back(i.release());
actions->push_back(std::move(i));
}
std::vector<actions::Action *> checkedActions;
std::vector<std::shared_ptr<actions::Action>> checkedActions;
int definedPhase = -1;
int secRuleDefinedPhase = -1;
for (actions::Action *a : *actions) {
actions::Phase *phase = dynamic_cast<actions::Phase *>(a);
if (dynamic_cast<actions::disruptive::ActionDisruptive *>(a) != NULL
&& dynamic_cast<actions::Block *>(a) == NULL) {
for (auto &a : *actions) {
actions::Phase *phase = dynamic_cast<actions::Phase *>(a.get());
if (dynamic_cast<actions::disruptive::ActionDisruptive *>(a.get()) != NULL
&& dynamic_cast<actions::Block *>(a.get()) == NULL) {
hasDisruptive = true;
}
if (phase != NULL) {
definedPhase = phase->getPhase();
secRuleDefinedPhase = phase->getSecRulePhase();
delete phase;
} else if (dynamic_cast<actions::ActionAllowedAsSecDefaultAction *>(a)
&& !dynamic_cast<actions::transformations::None *>(a)) {
} else if (dynamic_cast<actions::ActionAllowedAsSecDefaultAction *>(a.get())
&& !dynamic_cast<actions::transformations::None *>(a.get())) {
checkedActions.push_back(a);
} else {
driver.error(@0, "The action '" + *a->getName() + "' is not suitable to be part of the SecDefaultActions");
@ -1206,12 +1206,10 @@ expression:
if (definedPhase == -1) {
definedPhase = modsecurity::Phases::RequestHeadersPhase;
}
if (hasDisruptive == false) {
driver.error(@0, "SecDefaultAction must specify a disruptive action.");
YYERROR;
}
if (!driver.m_rulesSetPhases[definedPhase]->m_defaultActions.empty()) {
std::stringstream ss;
ss << "SecDefaultActions can only be placed once per phase and configuration context. Phase ";
@ -1220,18 +1218,15 @@ expression:
driver.error(@0, ss.str());
YYERROR;
}
for (actions::Action *a : checkedActions) {
if (dynamic_cast<actions::transformations::Transformation *>(a)) {
for (auto &a : checkedActions) {
if (dynamic_cast<actions::transformations::Transformation *>(a.get())) {
driver.m_rulesSetPhases[definedPhase]->m_defaultTransformations.push_back(
std::shared_ptr<actions::transformations::Transformation>(
dynamic_cast<actions::transformations::Transformation *>(a)));
std::dynamic_pointer_cast<actions::transformations::Transformation>(a));
} else {
driver.m_rulesSetPhases[definedPhase]->m_defaultActions.push_back(std::unique_ptr<Action>(a));
driver.m_rulesSetPhases[definedPhase]->m_defaultActions.push_back(a);
}
}
delete actions;
//delete actions;
}
| CONFIG_DIR_SEC_MARKER
{

2
src/rule_message.cc
View File

@ -218,7 +218,7 @@ std::string RuleMessage::getUri() const {
bool RuleMessage::isDisruptive() const {
if (m_rule) {
return m_rule->hasDisruptiveAction();
return m_rule->isDisruptive();
}
return 0;
}

2
src/rule_script.h
View File

@ -47,7 +47,7 @@ using actions::Action;
class RuleScript : public RuleWithActions {
public:
RuleScript(const std::string &name,
std::vector<Action *> *actions,
Actions *actions,
Transformations *t,
std::unique_ptr<std::string> fileName,
int lineNumber)

2
src/rule_unconditional.h
View File

@ -40,7 +40,7 @@ namespace modsecurity {
class RuleUnconditional : public RuleWithActions {
public:
RuleUnconditional(
std::vector<actions::Action *> *actions,
Actions *actions,
Transformations *transformations,
std::unique_ptr<std::string> fileName,
int lineNumber)

459
src/rule_with_actions.cc
View File

@ -54,142 +54,223 @@
#include "src/actions/rule_id.h"
#include "src/actions/ver.h"
#include "src/actions/action_type_rule_metadata.h"
#include "src/actions/action_allowed_in_sec_default_action.h"
namespace modsecurity {
RuleWithActions::RuleWithActions(
Actions *actions,
Transformations *transformations,
std::unique_ptr<std::string> fileName,
int lineNumber)
: Rule(std::move(fileName), lineNumber),
RuleWithActionsProperties(transformations),
m_ruleId(0),
m_chainedRuleChild(nullptr),
m_chainedRuleParent(nullptr),
m_disruptiveAction(nullptr),
m_logData(nullptr),
m_msg(nullptr),
m_actionsRuntimePos(),
m_actionsSetVar(),
m_actionsTag(),
m_XmlNSs(),
m_defaultActionDisruptiveAction(nullptr),
m_defaultActionLogData(nullptr),
m_defaultActionMsg(nullptr),
m_defaultActionActionsRuntimePos(),
m_defaultActionActionsSetVar(),
m_defaultActionActionsTag(),
m_transformations(transformations != nullptr ? *transformations : Transformations()),
m_defaultTransformations(),
m_severity(SEVERITY_NOT_SET),
m_revision(""),
m_version(""),
m_accuracy(ACCURACY_NOT_SET),
m_maturity(MATURITY_NOT_SET),
m_containsCaptureAction(false),
m_containsLogAction(false),
m_containsNoLogAction(false),
m_containsAuditLogAction(false),
m_containsNoAuditLogAction(false),
m_containsMultiMatchAction(false),
m_containsStaticBlockAction(false),
m_defaultSeverity(SEVERITY_NOT_SET),
m_defaultRevision(""),
m_defaultVersion(""),
m_defaultAccuracy(ACCURACY_NOT_SET),
m_defaultMaturity(MATURITY_NOT_SET),
m_defaultContainsCaptureAction(false),
m_defaultContainsLogAction(false),
m_defaultContainsNoLogAction(false),
m_defaultContainsAuditLogAction(false),
m_defaultContainsNoAuditLogAction(false),
m_defaultContainsMultiMatchAction(false),
m_defaultContainsStaticBlockAction(false),
m_isChained(false) {
m_severity(SEVERITY_NOT_SET),
m_containsCapture(false),
m_isChained(false),
m_revision(""),
m_version(""),
m_actionMsg(nullptr),
m_actionLogData(nullptr),
m_defaultActions()
{
// FIXME: split confs on parser.
std::vector<std::shared_ptr<ActionTypeRuleMetaData>> confs;
std::vector<std::shared_ptr<Action>> newActions;
if (actions) {
for (actions::Action *a : *actions) {
addAction(a);
for (auto &a : *actions) {
if (std::dynamic_pointer_cast<ActionTypeRuleMetaData>(a)) {
confs.push_back(std::dynamic_pointer_cast<ActionTypeRuleMetaData>(a));
continue;
} else if (std::dynamic_pointer_cast<ActionDisruptive>(a)) {
setDisruptiveAction(std::dynamic_pointer_cast<ActionDisruptive>(a));
continue;
}
newActions.push_back(a);
}
}
/**
*
* Those are actions that only fit the propose to update something in
* the rule: META-DATA; e.g. RuleID.
*
* The merge action takes care of those properties. Once configured the
* action can be forgotten.
*
*/
for (auto &c : confs) {
c->configure(this);
}
for (auto &a : newActions) {
if (std::dynamic_pointer_cast<actions::SetVar>(a)) {
addSetVar(std::dynamic_pointer_cast<actions::SetVar>(a));
continue;
}
if (std::dynamic_pointer_cast<actions::Tag>(a)) {
addTag(std::dynamic_pointer_cast<actions::Tag>(a));
continue;
}
if (std::dynamic_pointer_cast<actions::XmlNS>(a)) {
m_XmlNSs.push_back(std::dynamic_pointer_cast<actions::XmlNS>(a));
continue;
}
if (std::dynamic_pointer_cast<actions::LogData>(a)) {
m_actionLogData = std::dynamic_pointer_cast<actions::LogData>(a);
continue;
}
if (std::dynamic_pointer_cast<actions::Msg>(a)) {
m_actionMsg = std::dynamic_pointer_cast<actions::Msg>(a);
continue;
}
addGenericMatchAction(std::dynamic_pointer_cast<ActionWithExecution>(a));
}
populate(this);
}
RuleWithActions::RuleWithActions(const RuleWithActions &r)
: Rule(r),
RuleWithActionsProperties(r),
m_ruleId(r.m_ruleId),
m_chainedRuleChild(r.m_chainedRuleChild),
m_chainedRuleParent(r.m_chainedRuleParent),
m_XmlNSs(/*r.m_XmlNSs*/),
m_accuracy(r.m_accuracy),
m_maturity(r.m_maturity),
m_severity(r.m_severity),
m_containsCapture(r.m_containsCapture),
m_isChained(r.m_isChained),
m_revision(r.m_revision),
m_version(r.m_version),
m_actionMsg(nullptr /*r.m_actionMsg*/),
m_actionLogData(nullptr /* r.m_actionLogData */),
m_defaultActions(r.m_defaultActions) {
copyActionsWithRunTimeStrings(r);
m_defaultActions.populate(this);
populate(this);
}
RuleWithActions &RuleWithActions::operator=(const RuleWithActions& r) {
Rule::operator = (r);
RuleWithActionsProperties::operator = (r);
m_ruleId = r.m_ruleId;
m_chainedRuleChild = r.m_chainedRuleChild;
m_chainedRuleParent = r.m_chainedRuleParent;
/*m_XmlNSs = r.m_XmlNSs;*/
m_accuracy = r.m_accuracy;
m_maturity = r.m_maturity;
m_severity = r.m_severity;
m_containsCapture = r.m_containsCapture;
m_isChained = r.m_isChained;
m_revision = r.m_revision;
m_version = r.m_version;
/*m_actionMsg = r.m_actionMsg;*/
/*m_actionLogData = r.m_actionLogData;*/
m_defaultActions = r.m_defaultActions;
copyActionsWithRunTimeStrings(r);
m_defaultActions.populate(this);
populate(this);
return *this;
}
void inline RuleWithActions::copyActionsWithRunTimeStrings(const RuleWithActions &r) {
if (r.m_actionLogData) {
actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(r.m_actionLogData.get());
if (!arts) {
/* Humpf? */
m_actionLogData = r.m_actionLogData;
} else {
std::shared_ptr<actions::LogData> z(dynamic_cast<actions::LogData *>(arts->clone()));
actions::ActionWithRunTimeString *aa = dynamic_cast<actions::ActionWithRunTimeString *>(z.get());
aa->populate(nullptr);
m_actionLogData = z;
}
}
if (r.m_actionMsg) {
actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(r.m_actionMsg.get());
if (!arts) {
/* Humpf? */
m_actionMsg = r.m_actionMsg;
} else {
std::shared_ptr<actions::Msg> z(dynamic_cast<actions::Msg *>(arts->clone()));
actions::ActionWithRunTimeString *aa = dynamic_cast<actions::ActionWithRunTimeString *>(z.get());
aa->populate(nullptr);
m_actionMsg = z;
}
}
for (auto &i : r.m_XmlNSs) {
actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(i.get());
if (!arts) {
/* Humpf? */
m_XmlNSs.push_back(i);
} else {
std::shared_ptr<actions::XmlNS> z(dynamic_cast<actions::XmlNS *>(arts->clone()));
actions::ActionWithRunTimeString *aa = dynamic_cast<actions::ActionWithRunTimeString *>(z.get());
aa->populate(nullptr);
m_XmlNSs.push_back(z);
}
}
}
void RuleWithActions::addDefaultAction(std::shared_ptr<actions::Action> a) {
void RuleWithActions::addDefaultAction(std::shared_ptr<actions::Action> a) {
actions::ActionAllowedAsSecDefaultAction *d = dynamic_cast<actions::ActionAllowedAsSecDefaultAction *>(a.get());
if (d == nullptr) {
throw std::runtime_error("Action is being used as DefaultAction but not allowed.");
}
/**
*
* ActionWithRunTimeString needs to be aware of the Rule that it
* belongs to. It is necessary to resolve some variables
* (e.g. Rule); Clone and associate are mandatory.
*
*/
actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(a.get());
if (arts != nullptr) {
a = std::unique_ptr<actions::Action>(arts->clone());
arts = dynamic_cast<actions::ActionWithRunTimeString *>(a.get());
arts->populate(this);
}
if (dynamic_cast<ActionTypeRuleMetaData *>(a.get())) {
ActionTypeRuleMetaData *conf = dynamic_cast<ActionTypeRuleMetaData *>(a.get());
conf->configure(this);
if (std::dynamic_pointer_cast<actions::SetVar>(a)) {
m_defaultActions.addSetVar(std::dynamic_pointer_cast<actions::SetVar>(a));
return;
}
if (dynamic_cast<actions::LogData *>(a.get())) {
m_defaultActionLogData.reset(dynamic_cast<actions::LogData *>(a.get()));
} else if (dynamic_cast<actions::Msg *>(a.get())) {
m_defaultActionMsg.reset(dynamic_cast<actions::Msg *>(a.get()));
} else if (dynamic_cast<actions::SetVar *>(a.get())) {
actions::SetVar *var = dynamic_cast<actions::SetVar *>(a.get());
m_actionsSetVar.push_back(std::unique_ptr<actions::SetVar>(var));
} else if (dynamic_cast<actions::Tag *>(a.get())) {
m_defaultActionActionsTag.push_back(std::dynamic_pointer_cast<actions::Tag>(a));
} else if (dynamic_cast<actions::Block *>(a.get())) {
m_defaultActionActionsRuntimePos.push_back(std::dynamic_pointer_cast<ActionWithExecution>(a));
m_defaultContainsStaticBlockAction = true;
} else if (std::dynamic_pointer_cast<ActionDisruptive>(a) != NULL) {
m_defaultActionDisruptiveAction = std::dynamic_pointer_cast<ActionDisruptive>(a);
} else {
m_defaultActionActionsRuntimePos.push_back(std::dynamic_pointer_cast<ActionWithExecution>(a));
}
}
void RuleWithActions::addAction(actions::Action *a) {
actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(a);
if (arts != nullptr) {
a = arts->clone();
arts = dynamic_cast<actions::ActionWithRunTimeString *>(a);
arts->populate(this);
}
if (dynamic_cast<ActionTypeRuleMetaData *>(a)) {
ActionTypeRuleMetaData *conf = dynamic_cast<ActionTypeRuleMetaData *>(a);
conf->configure(this);
delete a;
if (std::dynamic_pointer_cast<actions::Tag>(a)) {
m_defaultActions.addTag(std::dynamic_pointer_cast<actions::Tag>(a));
return;
}
if (dynamic_cast<actions::LogData *>(a)) {
m_logData = std::unique_ptr<actions::LogData>(dynamic_cast<actions::LogData*>(a));
} else if (dynamic_cast<actions::Msg *>(a)) {
m_msg = std::unique_ptr<actions::Msg>(dynamic_cast<actions::Msg*>(a));
} else if (dynamic_cast<actions::SetVar *>(a)) {
actions::SetVar *var = dynamic_cast<actions::SetVar *>(a);
m_actionsSetVar.push_back(std::unique_ptr<actions::SetVar>(var));
} else if (dynamic_cast<actions::Tag *>(a)) {
m_actionsTag.push_back(std::unique_ptr<actions::Tag>(dynamic_cast<actions::Tag *>(a)));
} else if (dynamic_cast<actions::Block *>(a)) {
m_actionsRuntimePos.push_back(std::unique_ptr<ActionWithExecution>(dynamic_cast<ActionWithExecution *>(a)));
m_containsStaticBlockAction = true;
} else if (dynamic_cast<actions::XmlNS *>(a)) {
m_XmlNSs.push_back(std::unique_ptr<actions::XmlNS>(dynamic_cast<actions::XmlNS *>(a)));
} else if (dynamic_cast<ActionDisruptive *>(a) != NULL) {
m_disruptiveAction = std::unique_ptr<ActionDisruptive>(dynamic_cast<ActionDisruptive *>(a));
} else {
m_actionsRuntimePos.push_back(std::unique_ptr<ActionWithExecution >(dynamic_cast<ActionWithExecution *>(a)));
if (std::dynamic_pointer_cast<actions::Block>(a)) {
m_defaultActions.setBlock(true);
return;
}
if (std::dynamic_pointer_cast<ActionDisruptive>(a)) {
m_defaultActions.setDisruptiveAction(std::dynamic_pointer_cast<ActionDisruptive>(a));
return;
}
std::shared_ptr<ActionWithExecution> bp = std::dynamic_pointer_cast<ActionWithExecution>(a);
if (!bp) {
return;
}
m_defaultActions.addGenericMatchAction(bp);
}
RuleWithActions::~RuleWithActions() { }
bool RuleWithActions::evaluate(Transaction *transaction) const {
/* Matched vars needs to be clear at every new rule execution */
transaction->m_matched.clear();
@ -199,97 +280,80 @@ bool RuleWithActions::evaluate(Transaction *transaction) const {
void RuleWithActions::executeActionsIndependentOfChainedRuleResult(Transaction *trans) const {
for (actions::SetVar *a : getSetVarsActionsPtr()) {
ms_dbg_a(trans, 4, "Running [independent] (non-disruptive) " \
"action: " + *a->getName());
a->execute(trans);
}
/* setVar */
auto f = [](Transaction *t, const std::shared_ptr<actions::SetVar> &var) {
ms_dbg_a(t, 4, "Running [independent] (non-disruptive) action: " + *var->getName());
var->execute(t);
};
for (auto &a : m_defaultActions.getSetVars()) { f(trans, a); }
for (auto &a : getSetVars()) { f(trans, a); }
}
void RuleWithActions::executeActionsAfterFullMatch(Transaction *trans) const {
bool disruptiveAlreadyExecuted = false;
for (actions::Tag *a : getTagsActionPtr()) {
ms_dbg_a(trans, 4, "Running (non-disruptive) action: " \
+ a->getTagName(trans));
a->execute(trans);
}
/* tags */
auto f = [](Transaction *t, const std::shared_ptr<actions::Tag> &tag) {
ms_dbg_a(t, 4, "Running (non-disruptive) action: " + tag->getTagName(t));
tag->execute(t);
};
for (auto &a : m_defaultActions.getTags()) { f(trans, a); }
for (auto &a : getTags()) { f(trans, a); }
/**
*
* FIXME: SecRuleUpdateActionBy should be runtime
*
*/
auto range = trans->m_rules->m_exceptions.m_action_pos_update_target_by_id.equal_range(m_ruleId);
for (auto it = range.first; it != range.second; ++it) {
ActionWithExecution *a = dynamic_cast<ActionWithExecution*>(it->second.get());
if (dynamic_cast<ActionDisruptive *>(a)) {
trans->messageGetLast()->setRule(this);
}
executeAction(trans, a, false);
if (dynamic_cast<ActionDisruptive *>(a)) {
disruptiveAlreadyExecuted = true;
}
ms_dbg_a(trans, 9, "Running action placed by updateTargetById: " + *a->getName());
a->execute(trans);
}
if (m_logData) {
m_logData->execute(trans);
} else if (m_defaultActionLogData) {
m_defaultActionLogData->execute(trans);
/* generic actions */
auto fg = [](Transaction *t, const std::shared_ptr<ActionWithExecution> &a) {
ms_dbg_a(t, 9, "Running action: " + *a->getName());
a->execute(t);
};
for (auto &a : m_defaultActions.getGenericMatchActions()) { fg(trans, a); }
for (auto &a : getGenericMatchActions()) { fg(trans, a); }
if (m_actionLogData) {
m_actionLogData->execute(trans);
}
if (m_msg) {
m_msg->execute(trans);
} else if (m_defaultActionMsg) {
m_defaultActionMsg->execute(trans);
if (m_actionMsg) {
m_actionMsg->execute(trans);
}
for (auto &a : getMatchActionsPtr()) {
if (!dynamic_cast<ActionDisruptive *>(a)
&& !(disruptiveAlreadyExecuted
&& dynamic_cast<actions::Block *>(a))) {
executeAction(trans, a, false);
/* disruptive actions */
if (disruptiveAlreadyExecuted) {
return;
}
auto fd = [](Transaction *t, const std::shared_ptr<ActionDisruptive> &a) {
if (t->getRuleEngineState() == RulesSet::EnabledRuleEngine) {
ms_dbg_a(t, 4, "Running (disruptive) action: " + *a->getName() + ".");
const ActionWithExecution *ae = dynamic_cast<const ActionWithExecution *>(a.get());
ae->execute(t);
return;
}
ms_dbg_a(t, 4, "Not running disruptive action: " \
+ *a->getName() + ". SecRuleEngine is not On.");
};
if (hasDisruptiveAction()) {
trans->messageGetLast()->setRule(this);
fd(trans, getDisruptiveAction());
} else if ((hasBlock() || m_defaultActions.hasBlock()) && m_defaultActions.hasDisruptiveAction()) {
trans->messageGetLast()->setRule(this);
fd(trans, m_defaultActions.getDisruptiveAction());
}
if (!disruptiveAlreadyExecuted && m_disruptiveAction != nullptr) {
executeAction(trans,
m_disruptiveAction.get(), false);
} else if (!disruptiveAlreadyExecuted && hasBlockAction()
&& m_defaultActionDisruptiveAction != nullptr) {
executeAction(trans,
m_defaultActionDisruptiveAction.get(), false);
}
}
void RuleWithActions::executeAction(Transaction *trans,
ActionWithExecution *a, bool defaultContext) {
ms_dbg_a(trans, 9, "Running action: " + *a->getName());
a->execute(trans);
}
void RuleWithActions::executeAction(Transaction *trans,
ActionDisruptive *a, bool defaultContext) const {
if (defaultContext && !hasBlockAction()) {
ms_dbg_a(trans, 4, "Ignoring action: " + *a->getName() + \
" (rule does not cotains block)");
return;
}
if (trans->getRuleEngineState() == RulesSet::EnabledRuleEngine) {
ms_dbg_a(trans, 4, "Running (disruptive) action: " + \
*a->getName() + ".");
ActionWithExecution *ae = dynamic_cast<ActionWithExecution *>(a);
ae->execute(trans);
return;
}
ms_dbg_a(trans, 4, "Not running disruptive action: " \
+ *a->getName() + ". SecRuleEngine is not On.");
}
@ -303,26 +367,17 @@ void RuleWithActions::executeTransformations(
ssin.assign(in.c_str(), in.size());
results.push_back(TransformationResult(&ssin));
std::string path("");
std::shared_ptr<std::string> value =
std::shared_ptr<std::string>(new std::string(in));
for (Transformation *action : getTransformationPtr()) {
if (dynamic_cast<actions::transformations::None *>(action)) {
//FIXME: none should be pre-computed.
for (auto &action : m_defaultActions.getTransformations()) {
if (dynamic_cast<actions::transformations::None *>(action.get())) {
none++;
}
}
for (Transformation *t : getTransformationPtr()) {
if (none == 0) {
executeTransformation(trans, &results, t);
}
if (dynamic_cast<actions::transformations::None *>(t)) {
none--;
for (auto &action : getTransformations()) {
if (dynamic_cast<actions::transformations::None *>(action.get())) {
none++;
}
}
// FIXME: It can't be something different from transformation. Sort this
// on rules compile time.
auto range = trans->m_rules->m_exceptions.m_action_transformation_update_target_by_id.equal_range(m_ruleId);
@ -333,6 +388,24 @@ void RuleWithActions::executeTransformations(
}
}
for (auto &t : m_defaultActions.getTransformations()) {
if (none == 0) {
executeTransformation(trans, &results, t.get());
}
if (dynamic_cast<actions::transformations::None *>(t.get())) {
none--;
}
}
for (auto &t : getTransformations()) {
if (none == 0) {
executeTransformation(trans, &results, t.get());
}
if (dynamic_cast<actions::transformations::None *>(t.get())) {
none--;
}
}
for (auto it = range.first; it != range.second; ++it) {
Transformation *t = it->second.get();
if (none == 0) {
@ -381,9 +454,14 @@ void RuleWithActions::executeTransformation(
}
bool RuleWithActions::containsTag(const std::string& name, Transaction *t) const {
for (auto &tag : getTagsAction()) {
if (tag != NULL && tag->getTagName(t) == name) {
bool RuleWithActions::containsTag(const std::string& name, const Transaction *t) const noexcept {
for (auto &tag : m_defaultActions.getTags()) {
if (tag != nullptr && tag->getTagName(t) == name) {
return true;
}
}
for (auto &tag : getTags()) {
if (tag != nullptr && tag->getTagName(t) == name) {
return true;
}
}
@ -391,13 +469,18 @@ bool RuleWithActions::containsTag(const std::string& name, Transaction *t) const
}
bool RuleWithActions::containsMsg(const std::string& name, Transaction *t) const {
return m_msg && m_msg->getEvaluatedRunTimeString(t) == name;
bool RuleWithActions::containsMsg(const std::string& name, const Transaction *t) const noexcept {
return m_actionMsg && m_actionMsg->getEvaluatedRunTimeString(t) == name;
}
std::string RuleWithActions::getLogData(const Transaction *t) const { return m_logData->getEvaluatedRunTimeString(t); }
std::string RuleWithActions::getMessage(const Transaction *t) const { return m_msg->getEvaluatedRunTimeString(t); }
std::string RuleWithActions::getLogData(const Transaction *t) const noexcept {
return m_actionLogData->getEvaluatedRunTimeString(t);
}
std::string RuleWithActions::getMessage(const Transaction *t) const noexcept {
return m_actionMsg->getEvaluatedRunTimeString(t);
}
} // namespace modsecurity

664
src/rule_with_actions.h
View File

@ -25,19 +25,32 @@
#ifndef SRC_RULE_WITH_ACTIONS_H_
#define SRC_RULE_WITH_ACTIONS_H_
#include "modsecurity/transaction.h"
#include "modsecurity/modsecurity.h"
#include "modsecurity/variable_value.h"
#include "modsecurity/rule.h"
#include "modsecurity/actions/action.h"
#include "modsecurity/modsecurity.h"
#include "modsecurity/rule.h"
#include "modsecurity/rule_message.h"
#include "modsecurity/rules_set.h"
#include "modsecurity/transaction.h"
#include "modsecurity/variable_value.h"
#include "src/actions/action_allowed_in_sec_default_action.h"
#include "src/actions/action_type_rule_metadata.h"
#include "src/actions/action_with_execution.h"
#include "src/actions/action_with_run_time_string.h"
#include "src/actions/disruptive/disruptive_action.h"
#include "src/actions/transformations/transformation.h"
#include "src/actions/xmlns.h"
#include "src/rule_with_actions.h"
#include "src/rule_with_actions_properties.h"
#include "src/utils/string.h"
#include "src/transformation_result.h"
#ifdef __cplusplus
namespace modsecurity {
using XmlNSs = std::vector<std::shared_ptr<actions::XmlNS> >;
using XmlNSsPtr = std::vector<actions::XmlNS *>;
namespace actions {
class Action;
@ -45,200 +58,42 @@ class Severity;
class LogData;
class Msg;
class Rev;
class SetVar;
class Tag;
class XmlNS;
namespace transformations {
class Transformation;
}
}
using Transformation = actions::transformations::Transformation;
using Transformations = std::vector<std::shared_ptr<Transformation> >;
using TransformationsPtr = std::vector<Transformation *>;
using Actions = std::vector<actions::Action *>;
using ActionWithExecution = actions::ActionWithExecution;
using ActionTypeRuleMetaData = actions::ActionTypeRuleMetaData;
using ActionDisruptive = actions::disruptive::ActionDisruptive;
using MatchActions = std::vector<std::shared_ptr<ActionWithExecution > >;
using MatchActionsPtr = std::vector<ActionWithExecution *>;
using Tags = std::vector<std::shared_ptr<actions::Tag> >;
using TagsPtr = std::vector<actions::Tag *>;
using SetVars = std::vector<std::shared_ptr<actions::SetVar> >;
using SetVarsPtr = std::vector<actions::SetVar *>;
using XmlNSs = std::vector<std::shared_ptr<actions::XmlNS> >;
using XmlNSsPtr = std::vector<actions::XmlNS *>;
class TransformationResult {
class RuleWithActions : public Rule, public RuleWithActionsProperties {
public:
explicit TransformationResult(
ModSecString &after,
const std::string *transformation = nullptr)
: m_after(after),
m_transformation(transformation) { };
explicit TransformationResult(
ModSecString *after)
: m_after(*after),
m_transformation(nullptr) { };
using Action = actions::Action;
using Actions = std::vector<std::shared_ptr<Action>>;
using ActionTypeRuleMetaData = actions::ActionTypeRuleMetaData;
TransformationResult(const TransformationResult &t2)
: m_after(t2.m_after),
m_transformation(t2.m_transformation) { };
ModSecString *getAfter() {
return &m_after;
}
const std::string *getTransformationName() const {
return m_transformation;
}
private:
ModSecString m_after;
const std::string *m_transformation;
};
using TransformationsResults = std::list<TransformationResult>;
class RuleWithActions : public Rule {
public:
int SEVERITY_NOT_SET = 10;
int ACCURACY_NOT_SET = 10;
int MATURITY_NOT_SET = 10;
const unsigned int SEVERITY_NOT_SET = 10;
const unsigned int ACCURACY_NOT_SET = 10;
const unsigned int MATURITY_NOT_SET = 10;
RuleWithActions(
Actions *a,
Transformations *t,
std::unique_ptr<std::string> fileName,
int lineNumber);
~RuleWithActions();
RuleWithActions(const RuleWithActions &r)
: Rule(r),
m_ruleId(r.m_ruleId),
m_chainedRuleChild(r.m_chainedRuleChild),
m_chainedRuleParent(r.m_chainedRuleParent),
m_disruptiveAction(r.m_disruptiveAction),
m_logData(r.m_logData),
m_msg(r.m_msg),
m_actionsRuntimePos(r.m_actionsRuntimePos),
m_actionsSetVar(r.m_actionsSetVar),
m_actionsTag(r.m_actionsTag),
m_XmlNSs(r.m_XmlNSs),
m_defaultActionDisruptiveAction(r.m_defaultActionDisruptiveAction),
m_defaultActionLogData(r.m_defaultActionLogData),
m_defaultActionMsg(r.m_defaultActionMsg),
m_defaultActionActionsRuntimePos(r.m_defaultActionActionsRuntimePos),
m_defaultActionActionsSetVar(r.m_defaultActionActionsSetVar),
m_defaultActionActionsTag(r.m_defaultActionActionsTag),
m_transformations(r.m_transformations),
m_defaultTransformations(r.m_defaultTransformations),
m_severity(r.m_severity),
m_revision(r.m_revision),
m_version(r.m_version),
m_accuracy(r.m_accuracy),
m_maturity(r.m_maturity),
m_containsCaptureAction(r.m_containsCaptureAction),
m_containsLogAction(r.m_containsLogAction),
m_containsNoLogAction(r.m_containsNoLogAction),
m_containsAuditLogAction(r.m_containsAuditLogAction),
m_containsNoAuditLogAction(r.m_containsNoAuditLogAction),
m_containsMultiMatchAction(r.m_containsMultiMatchAction),
m_containsStaticBlockAction(r.m_containsStaticBlockAction),
m_defaultSeverity(r.m_defaultSeverity),
m_defaultRevision(r.m_defaultRevision),
m_defaultVersion(r.m_defaultVersion),
m_defaultAccuracy(r.m_defaultAccuracy),
m_defaultMaturity(r.m_defaultMaturity),
m_defaultContainsCaptureAction(r.m_defaultContainsCaptureAction),
m_defaultContainsLogAction(r.m_defaultContainsLogAction),
m_defaultContainsNoLogAction(r.m_defaultContainsNoLogAction),
m_defaultContainsAuditLogAction(r.m_defaultContainsAuditLogAction),
m_defaultContainsNoAuditLogAction(r.m_defaultContainsNoAuditLogAction),
m_defaultContainsMultiMatchAction(r.m_defaultContainsMultiMatchAction),
m_defaultContainsStaticBlockAction(r.m_defaultContainsStaticBlockAction),
m_isChained(r.m_isChained) {
// TODO: Verify if it is necessary to process any other copy.
};
RuleWithActions &operator=(const RuleWithActions& r) {
Rule::operator = (r);
m_ruleId = r.m_ruleId;
m_chainedRuleChild = r.m_chainedRuleChild;
m_chainedRuleParent = r.m_chainedRuleParent;
m_disruptiveAction = r.m_disruptiveAction;
m_logData = r.m_logData;
m_msg = r.m_msg;
m_actionsRuntimePos = r.m_actionsRuntimePos;
m_actionsSetVar = r.m_actionsSetVar;
m_actionsTag = r.m_actionsTag;
m_XmlNSs = r.m_XmlNSs;
m_defaultActionDisruptiveAction = r.m_defaultActionDisruptiveAction;
m_defaultActionLogData = r.m_defaultActionLogData;
m_defaultActionMsg = r.m_defaultActionMsg;
m_defaultActionActionsRuntimePos = r.m_defaultActionActionsRuntimePos;
m_defaultActionActionsSetVar = r.m_defaultActionActionsSetVar;
m_defaultActionActionsTag = r.m_defaultActionActionsTag;
m_transformations = r.m_transformations;
m_defaultTransformations = r.m_defaultTransformations;
m_severity = r.m_severity;
m_revision = r.m_revision;
m_version = r.m_version;
m_accuracy = r.m_accuracy;
m_maturity = r.m_maturity;
m_containsCaptureAction = r.m_containsCaptureAction;
m_containsLogAction = r.m_containsLogAction;
m_containsNoLogAction = r.m_containsNoLogAction;
m_containsAuditLogAction = r.m_containsAuditLogAction;
m_containsNoAuditLogAction = r.m_containsNoAuditLogAction;
m_containsMultiMatchAction = r.m_containsMultiMatchAction;
m_containsStaticBlockAction = r.m_containsStaticBlockAction;
m_defaultSeverity = r.m_defaultSeverity;
m_defaultRevision = r.m_defaultRevision;
m_defaultVersion = r.m_defaultVersion;
m_defaultAccuracy = r.m_defaultAccuracy;
m_defaultMaturity = r.m_defaultMaturity;
m_defaultContainsCaptureAction = r.m_defaultContainsCaptureAction;
m_defaultContainsLogAction = r.m_defaultContainsLogAction;
m_defaultContainsNoLogAction = r.m_defaultContainsNoLogAction;
m_defaultContainsAuditLogAction = r.m_defaultContainsAuditLogAction;
m_defaultContainsNoAuditLogAction = r.m_defaultContainsNoAuditLogAction;
m_defaultContainsMultiMatchAction = r.m_defaultContainsMultiMatchAction;
m_defaultContainsStaticBlockAction = r.m_defaultContainsStaticBlockAction;
m_isChained = r.m_isChained;
return *this;
// TODO: Verify if it is necessary to process any other copy.
}
RuleWithActions(const RuleWithActions &r);
RuleWithActions &operator=(const RuleWithActions& r);
virtual bool evaluate(Transaction *transaction) const override;
void executeActionsIndependentOfChainedRuleResult(
Transaction *trasn) const;
Transaction *trasaction) const;
void executeActionsAfterFullMatch(
Transaction *trasn) const;
static void executeAction(Transaction *trans,
ActionWithExecution *a,
bool context);
void executeAction(Transaction *trans,
ActionDisruptive *a,
bool context) const;
Transaction *transaction) const;
// FIXME: Pass a callback for the transformation execution.
static void executeTransformation(
Transaction *transaction,
TransformationsResults *ret,
@ -255,253 +110,187 @@ class RuleWithActions : public Rule {
const std::string &value,
TransformationsResults &results) const;
void addAction(actions::Action *a);
void addTransformation(std::shared_ptr<actions::transformations::Transformation> t) {
m_transformations.push_back(t);
}
void addDefaultAction(std::shared_ptr<actions::Action>);
void addDefaultTransformation(std::shared_ptr<actions::transformations::Transformation> t) {
m_defaultTransformations.push_back(t);
}
std::vector<actions::Action *> getActionsByName(const std::string& name,
Transaction *t);
bool containsTag(const std::string& name, Transaction *t) const;
bool containsMsg(const std::string& name, Transaction *t) const;
/* */
bool containsTag(const std::string& name, const Transaction *t) const noexcept;
bool containsMsg(const std::string& name, const Transaction *t) const noexcept;
/* default Actions */
void clearDefaultActions() {
m_defaultSeverity = SEVERITY_NOT_SET;
m_defaultRevision = "";
m_defaultVersion = "";
m_defaultAccuracy = ACCURACY_NOT_SET;
m_defaultMaturity = MATURITY_NOT_SET;
m_defaultContainsCaptureAction = false;
m_defaultContainsLogAction = false;
m_defaultContainsNoLogAction = false;
m_defaultContainsMultiMatchAction = false;
m_defaultContainsStaticBlockAction = false;
m_defaultActionLogData = nullptr;
m_defaultActionMsg = nullptr;
m_defaultActionActionsSetVar.clear();
m_defaultActionActionsTag.clear();
m_defaultActionActionsRuntimePos.clear();
m_defaultActionDisruptiveAction = nullptr;
m_defaultActionActionsRuntimePos.clear();
m_defaultTransformations.clear();
m_defaultActions.clear();
}
void addDefaultAction(std::shared_ptr<actions::Action> a);
void addDefaulTransformation(std::shared_ptr<Transformation> t) {
m_defaultActions.addTransformation(t);
}
Transformations getTransformation() const {
Transformations dst;
for (auto &a : m_defaultTransformations) {
dst.push_back(a);
}
for (auto &a : m_transformations) {
dst.push_back(a);
}
return dst;
/* rule id */
// FIXME: not ever rule has an id. e.g. chained rule. */
inline const RuleId getId() const noexcept { return m_ruleId; }
void setId(int id) noexcept {
m_ruleId = id;
}
TransformationsPtr getTransformationPtr() const {
TransformationsPtr dst;
for (auto &a : m_defaultTransformations) {
dst.push_back(a.get());
}
for (auto &a : m_transformations) {
dst.push_back(a.get());
}
return dst;
/* capture */
inline void setHasCapture(bool b) noexcept {
m_containsCapture = b;
}
inline bool hasCapture() const noexcept {
return m_containsCapture;
}
SetVars getSetVarsActions() const {
SetVars dst;
for (auto &a : m_defaultActionActionsSetVar) {
dst.push_back(a);
}
for (auto &a : m_actionsSetVar) {
dst.push_back(a);
}
return dst;
/* accuracy */
inline const int getAccuracy() const noexcept {
return m_accuracy;
}
inline void setAccuracy(unsigned int accuracy) noexcept {
m_accuracy = accuracy;
}
inline bool hasAccuracy() const noexcept {
return m_accuracy != ACCURACY_NOT_SET;
}
SetVarsPtr getSetVarsActionsPtr() const {
SetVarsPtr dst;
for (auto &a : m_defaultActionActionsSetVar) {
dst.push_back(a.get());
}
for (auto &a : m_actionsSetVar) {
dst.push_back(a.get());
}
return dst;
/* severity */
inline int getSeverity() const noexcept {
return m_severity;
}
inline void setSeverity(unsigned int severity) noexcept {
m_severity = severity;
}
inline bool hasSeverity() const noexcept {
return m_severity != SEVERITY_NOT_SET;
}
MatchActionsPtr getMatchActionsPtr() const {
MatchActionsPtr dst;
for (auto &a : m_defaultActionActionsRuntimePos) {
dst.push_back(a.get());
}
for (auto &a : m_actionsRuntimePos) {
dst.push_back(a.get());
}
return dst;
/* revision */
inline const std::string getRevision() const noexcept {
return m_revision;
};
inline void setRevision(const std::string &revision) noexcept {
m_revision.assign(revision);
}
inline bool hasRevision() const noexcept {
return m_revision != "";
}
MatchActions getMatchActions() const {
MatchActions dst;
for (auto &a : m_defaultActionActionsRuntimePos) {
dst.push_back(a);
}
for (auto &a : m_actionsRuntimePos) {
dst.push_back(a);
}
return dst;
/* version */
inline const std::string getVersion() const noexcept {
return m_version;
};
inline void setVersion(const std::string &version) noexcept {
m_version.assign(version);
}
inline bool hasVersion() const noexcept {
return m_version != "";
}
/* maturity */
inline const int getMaturity() const noexcept {
return m_maturity;
}
inline void setMaturity(unsigned int maturity) noexcept {
m_maturity = maturity;
}
inline bool hasMaturity() const noexcept {
return m_maturity != MATURITY_NOT_SET;
}
/* logData */
inline std::shared_ptr<actions::LogData> getLogDataAction() const noexcept {
return m_actionLogData;
}
std::string getLogData(const Transaction *t) const noexcept;
inline void setLogDataAction(const std::shared_ptr<actions::LogData> &data) noexcept {
m_actionLogData = data;
}
inline bool hasLogDataAction() const noexcept {
return m_actionLogData != nullptr;
}
/* message */
inline std::shared_ptr<actions::Msg> getMessageAction() const noexcept {
return m_actionMsg;
}
std::string getMessage(const Transaction *t) const noexcept;
inline void setMessageAction(const std::shared_ptr<actions::Msg> &msg) noexcept {
m_actionMsg = msg;
}
inline bool hasMessageAction() const noexcept {
return m_actionMsg != nullptr;
}
/* multimatch */
inline bool processMultiMatch() const noexcept {
return hasMultiMatch() || m_defaultActions.hasMultiMatch();
}
/* isDisruptive */
inline bool isDisruptive() const {
return hasDisruptiveAction() || ((m_defaultActions.hasBlock() || hasBlock()) && m_defaultActions.hasBlock());
}
/* logging */
inline bool isItToBeLogged() const noexcept {
if (hasNoLog()) {
return false;
}
if (m_defaultActions.hasNoLog() && !hasNoLog()) {
return false;
}
if (!hasDisruptiveAction() && !(hasBlock() || m_defaultActions.hasBlock())) {
return false;
}
if (!m_defaultActions.hasDisruptiveAction() && !hasDisruptiveAction()) {
return false;
}
return true;
}
inline bool isItToBeAuditLogged() const noexcept {
if (hasAuditLog()) {
return true;
}
if (m_defaultActions.hasAuditLog() && !hasNoAuditLog()) {
return true;
}
if (isItToBeLogged()) {
return true;
}
return false;
}
/* chained rule */
/* FIXME: The chained rule needs to have its own class. */
void setChainedNext(std::unique_ptr<RuleWithActions> r) {
m_chainedRuleChild = std::move(r);
}
inline RuleWithActions *getChainedNext() const {
return m_chainedRuleChild.get();
}
void setChainedParent(RuleWithActions *r) {
m_chainedRuleParent = r;
}
inline RuleWithActions *getChainedParent() {
return m_chainedRuleParent;
}
inline bool hasChainAction() const { return m_isChained == true; }
inline void setHasChainAction(bool b) { m_isChained = b; }
inline bool hasChainedParent() const { return m_chainedRuleParent != nullptr; }
inline bool hasChainedChild() const { return m_chainedRuleChild.get() != nullptr; }
inline void setHasCaptureAction(bool b) { m_containsCaptureAction = b; }
inline bool hasCaptureAction() const { return m_containsCaptureAction || m_defaultContainsCaptureAction; }
inline bool hasDisruptiveAction() const { return m_disruptiveAction != nullptr || m_defaultActionDisruptiveAction != nullptr; }
inline void setDisruptiveAction(const std::shared_ptr<ActionDisruptive> &a) { m_disruptiveAction = a; }
inline std::shared_ptr<ActionDisruptive> getDisruptiveAction() const { return m_disruptiveAction; }
inline bool hasBlockAction() const { return m_containsStaticBlockAction || m_defaultContainsStaticBlockAction; }
inline void setHasBlockAction(bool b) { m_containsStaticBlockAction = b; }
inline void setHasMultimatchAction(bool b) { m_containsMultiMatchAction = b; }
inline bool hasMultimatchAction() const { return m_containsMultiMatchAction || m_defaultContainsMultiMatchAction; }
inline bool hasAuditLogAction() const { return m_containsAuditLogAction == true; }
inline void setHasAuditLogAction(bool b) { m_containsAuditLogAction = b; }
inline bool hasNoAuditLogAction() const { return m_containsNoAuditLogAction == true; }
inline void setHasNoAuditLogAction(bool b) { m_containsNoAuditLogAction = b; }
inline bool hasLogAction() const { return m_containsLogAction == true; }
inline void setHasLogAction(bool b) { m_containsLogAction = b; }
inline bool hasNoLogAction() const { return m_containsNoLogAction == true; }
inline void setHasNoLogAction(bool b) { m_containsNoLogAction = b; }
inline bool isItToBeLogged() const noexcept {
if (m_containsNoLogAction) {
return false;
}
if (m_defaultContainsNoLogAction && !m_containsLogAction) {
return false;
}
return true;
}
inline bool isItToBeAuditLogged() const noexcept {
if (!isItToBeLogged() && !m_containsAuditLogAction
&& !m_defaultContainsAuditLogAction) {
return false;
}
if (m_containsNoAuditLogAction) {
return false;
}
if (m_defaultContainsNoLogAction && !m_containsAuditLogAction) {
return false;
}
return true;
}
inline bool hasLogDataAction() const { return m_logData != nullptr || m_defaultActionLogData != nullptr; }
inline std::shared_ptr<actions::LogData> getLogDataAction() const { return m_logData; }
std::string getLogData(const Transaction *t) const;
inline void setLogDataAction(const std::shared_ptr<actions::LogData> &data) { m_logData = data; }
inline bool hasMessageAction() const { return m_msg != nullptr || m_defaultActionMsg != nullptr; }
inline std::shared_ptr<actions::Msg> getMessageAction() const { return m_msg; }
inline void setMessageAction(const std::shared_ptr<actions::Msg> &msg) { m_msg = msg; }
std::string getMessage(const Transaction *t) const;
inline bool hasSeverityAction() const { return m_severity != SEVERITY_NOT_SET || m_defaultSeverity != SEVERITY_NOT_SET; }
inline int getSeverity() const { return (m_severity != SEVERITY_NOT_SET)?m_severity:m_defaultSeverity; }
inline void setDefaultActionSeverity(unsigned int severity) { m_defaultSeverity = severity; }
inline void setSeverity(unsigned int severity) { m_severity = severity; }
inline bool hasRevisionAction() const { return m_revision != ""; }
inline const std::string getRevision() const { return m_revision; };
inline void setRevision(const std::string &revision) { m_revision.assign(revision); }
inline bool hasVersionAction() const { return m_version != ""; }
inline const std::string getVersion() const { return m_version; };
inline void setVersion(const std::string &version) { m_version.assign(version); }
inline bool hasAccuracyAction() const { return m_accuracy != ACCURACY_NOT_SET || m_defaultAccuracy != ACCURACY_NOT_SET; }
inline const int getAccuracy() const { return m_accuracy; }
inline void setAccuracy(unsigned int accuracy) { m_accuracy = accuracy; }
inline bool hasMaturityAction() const { return m_maturity != MATURITY_NOT_SET || m_defaultMaturity != MATURITY_NOT_SET; }
inline const int getMaturity() const { return m_maturity; }
inline void setDefaultActionMaturity(unsigned int maturity) { m_defaultMaturity = maturity; }
inline void setMaturity(unsigned int maturity) { m_maturity = maturity; }
inline bool hasTagAction() const { return m_actionsTag.size() > 0; }
inline void setTags(Tags tags) {
for (auto tag : tags) {
m_actionsTag.push_back(tag);
}
}
inline void cleanTags() {
m_actionsTag.clear();
}
Tags getTagsAction() const {
Tags dst;
for (auto &a : m_defaultActionActionsTag) {
dst.push_back(a);
}
for (auto &a : m_actionsTag) {
dst.push_back(a);
}
return dst;
}
TagsPtr getTagsActionPtr() const {
TagsPtr dst;
for (auto &a : m_defaultActionActionsTag) {
dst.push_back(a.get());
}
for (auto &a : m_actionsTag) {
dst.push_back(a.get());
}
return dst;
}
inline RuleId getId() const { return m_ruleId; }
void setId(int id) {
m_ruleId = id;
}
void setChainedNext(std::unique_ptr<RuleWithActions> r) {
m_chainedRuleChild = std::move(r);
}
inline RuleWithActions *getChainedNext() const {
return m_chainedRuleChild.get();
}
void setChainedParent(RuleWithActions *r) {
m_chainedRuleParent = r;
}
inline RuleWithActions *getChainedParent() {
return m_chainedRuleParent;
}
XmlNSs getXmlNSs() const {
XmlNSs dst;
@ -530,37 +319,24 @@ class RuleWithActions : public Rule {
}
private:
void inline copyActionsWithRunTimeStrings(const RuleWithActions &o);
RuleId m_ruleId;
std::shared_ptr<RuleWithActions> m_chainedRuleChild;
RuleWithActions *m_chainedRuleParent;
/* actions */
std::shared_ptr<ActionDisruptive> m_disruptiveAction;
std::shared_ptr<actions::LogData> m_logData;
std::shared_ptr<actions::Msg> m_msg;
MatchActions m_actionsRuntimePos;
SetVars m_actionsSetVar;
Tags m_actionsTag;
/* xmlns */
XmlNSs m_XmlNSs;
/* actions || SecDefaultAction */
std::shared_ptr<ActionDisruptive> m_defaultActionDisruptiveAction;
std::shared_ptr<actions::LogData> m_defaultActionLogData;
std::shared_ptr<actions::Msg> m_defaultActionMsg;
MatchActions m_defaultActionActionsRuntimePos;
SetVars m_defaultActionActionsSetVar;
Tags m_defaultActionActionsTag;
/* actions > transformations */
Transformations m_transformations;
/* actions > transformations || SecDefaultAction */
Transformations m_defaultTransformations;
/* || */
/**
* 1-9 where 9 is very strong and 1 has many false positives
*/
unsigned int m_accuracy:4;
/**
* 1-9 where 9 is extensively tested and 1 is a brand new experimental rule
*/
unsigned int m_maturity:4;
/**
* 0 - EMERGENCY: is generated from correlation of anomaly
* scoring data where there is an inbound
@ -581,44 +357,16 @@ class RuleWithActions : public Rule {
* 6 - INFO
* 7 - DEBUG
**/
unsigned int m_severity:3;
unsigned int m_severity:4;
bool m_containsCapture:1;
bool m_isChained:1;
std::string m_revision;
std::string m_version;
std::shared_ptr<actions::Msg> m_actionMsg;
std::shared_ptr<actions::LogData> m_actionLogData;
/**
* 1-9 where 9 is very strong and 1 has many false positives
*/
unsigned int m_accuracy:3;
/**
* 1-9 where 9 is extensively tested and 1 is a brand new experimental rule
*/
unsigned int m_maturity:3;
bool m_containsCaptureAction:1;
bool m_containsLogAction:1;
bool m_containsNoLogAction:1;
bool m_containsAuditLogAction:1;
bool m_containsNoAuditLogAction:1;
bool m_containsMultiMatchAction:1;
bool m_containsStaticBlockAction:1;
/* || SecDefaultAction */
unsigned int m_defaultSeverity:3;
std::string m_defaultRevision;
std::string m_defaultVersion;
unsigned int m_defaultAccuracy:3;
unsigned int m_defaultMaturity:3;
bool m_defaultContainsCaptureAction:1;
bool m_defaultContainsLogAction:1;
bool m_defaultContainsNoLogAction:1;
bool m_defaultContainsAuditLogAction:1;
bool m_defaultContainsNoAuditLogAction:1;
bool m_defaultContainsMultiMatchAction:1;
bool m_defaultContainsStaticBlockAction:1;
bool m_isChained:1;
/* SecDefaultAction */
RuleWithActionsProperties m_defaultActions;
};
} // namespace modsecurity

150
src/rule_with_actions_properties.cc Normal file
View File

@ -0,0 +1,150 @@
/*
* ModSecurity, http://www.modsecurity.org/
* Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
*
* You may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* If any of the files related to licensing are missing or if you have any
* other questions related to licensing please contact Trustwave Holdings, Inc.
* directly using the email address security@modsecurity.org.
*
*/
#include "modsecurity/rule.h"
#include <stdio.h>
#include <algorithm>
#include <cstring>
#include <iostream>
#include <list>
#include <memory>
#include <string>
#include <utility>
#include "src/actions/set_var.h"
#include "src/actions/tag.h"
#include "src/actions/transformations/transformation.h"
namespace modsecurity {
RuleWithActionsProperties::RuleWithActionsProperties(Transformations *transformations) :
m_hasAuditLog(false),
m_hasBlock(false),
m_hasLog(false),
m_hasMultiMatch(false),
m_hasNoAuditLog(false),
m_hasNoLog(false),
m_executeIfMatchActions(),
m_setVars(),
m_disruptiveAction(nullptr),
m_tags(),
m_transformations(transformations != nullptr ? *transformations : Transformations())
{ }
RuleWithActionsProperties::RuleWithActionsProperties(const RuleWithActionsProperties &o) :
m_hasAuditLog(o.m_hasAuditLog),
m_hasBlock(o.m_hasBlock),
m_hasLog(o.m_hasLog),
m_hasMultiMatch(o.m_hasMultiMatch),
m_hasNoAuditLog(o.m_hasNoAuditLog),
m_hasNoLog(o.m_hasNoAuditLog),
m_executeIfMatchActions(),
m_setVars(),
m_disruptiveAction(o.m_disruptiveAction),
m_tags(),
m_transformations(o.m_transformations)
{
copyActionsWithRunTimeStrings(o);
}
RuleWithActionsProperties &RuleWithActionsProperties::operator=(const RuleWithActionsProperties &o) {
m_hasAuditLog = o.m_hasAuditLog;
m_hasBlock = o.m_hasBlock;
m_hasLog = o.m_hasLog;
m_hasMultiMatch = o.m_hasMultiMatch;
m_hasNoAuditLog = o.m_hasNoAuditLog;
m_hasNoLog = o.m_hasNoAuditLog;
m_disruptiveAction = o.m_disruptiveAction;
m_transformations = o.m_transformations;
copyActionsWithRunTimeStrings(o);
return *this;
}
void inline RuleWithActionsProperties::copyActionsWithRunTimeStrings(const RuleWithActionsProperties &o) {
for (auto &i : o.m_executeIfMatchActions) {
actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(i.get());
if (!arts) {
m_executeIfMatchActions.push_back(i);
continue;
}
std::shared_ptr<actions::ActionWithExecution> z(dynamic_cast<actions::ActionWithExecution *>(arts->clone()));
actions::ActionWithRunTimeString *aa = dynamic_cast<actions::ActionWithRunTimeString *>(z.get());
aa->populate(nullptr);
m_executeIfMatchActions.push_back(z);
}
for (auto &i : o.m_setVars) {
actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(i.get());
if (!arts) {
m_setVars.push_back(i);
continue;
}
std::shared_ptr<actions::SetVar> z(dynamic_cast<actions::SetVar *>(arts->clone()));
actions::ActionWithRunTimeString *aa = dynamic_cast<actions::ActionWithRunTimeString *>(z.get());
aa->populate(nullptr);
m_setVars.push_back(z);
}
for (auto &i : o.m_tags) {
actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(i.get());
if (!arts) {
m_tags.push_back(i);
continue;
}
std::shared_ptr<actions::Tag> z(dynamic_cast<actions::Tag *>(arts->clone()));
actions::Tag *aa = dynamic_cast<actions::Tag *>(z.get());
aa->populate(nullptr);
m_tags.push_back(z);
}
}
void RuleWithActionsProperties::populate(const RuleWithActions *r) const {
/**
*
* ActionWithRunTimeString needs to be aware of the Rule that it
* belongs to. It is necessary to resolve some variables
* (e.g. Rule); Clone and associate are mandatory.
*
*/
for (auto &i : m_executeIfMatchActions) {
actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(i.get());
if (arts != nullptr) {
arts->populate(r);
}
}
for (auto &i : m_setVars) {
actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(i.get());
if (arts != nullptr) {
arts->populate(r);
}
}
for (auto &i : m_tags) {
actions::ActionWithRunTimeString *arts = dynamic_cast<actions::ActionWithRunTimeString *>(i.get());
if (arts != nullptr) {
arts->populate(r);
}
}
}
} // namespace modsecurity

213
src/rule_with_actions_properties.h Normal file
View File

@ -0,0 +1,213 @@
/*
* ModSecurity, http://www.modsecurity.org/
* Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
*
* You may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* If any of the files related to licensing are missing or if you have any
* other questions related to licensing please contact Trustwave Holdings, Inc.
* directly using the email address security@modsecurity.org.
*
*/
#ifndef SRC_RULE_WITH_ACTIONS_PROPERTIES_H_
#define SRC_RULE_WITH_ACTIONS_PROPERTIES_H_
#include "modsecurity/modsecurity.h"
#include "src/actions/action_with_execution.h"
#include "src/actions/disruptive/disruptive_action.h"
namespace modsecurity {
namespace actions {
class SetVar;
class Tag;
namespace transformations {
class Transformation;
}
}
class RuleWithActionsProperties {
/**
* Properties that can be part of the SecDefaultActions.
*
*/
public:
using ActionWithExecution = actions::ActionWithExecution;
using ActionDisruptive = actions::disruptive::ActionDisruptive;
using MatchActions = std::vector<std::shared_ptr<ActionWithExecution>>;
using SetVar = actions::SetVar;
using SetVars = std::vector<std::shared_ptr<SetVar>>;
using Tag = actions::Tag;
using Tags = std::vector<std::shared_ptr<Tag>>;
using Transformation = actions::transformations::Transformation;
using Transformations = std::vector<std::shared_ptr<Transformation>>;
explicit RuleWithActionsProperties(Transformations *transformations = nullptr);
~RuleWithActionsProperties() {
/* all the allocated resources are shared pointers. */
}
RuleWithActionsProperties(const RuleWithActionsProperties &o);
RuleWithActionsProperties &operator=(const RuleWithActionsProperties &o);
RuleWithActionsProperties(RuleWithActionsProperties &&o) = delete;
void clear() {
m_hasLog = false;
m_hasNoLog = false;
m_hasBlock = false;
m_setVars.clear();
m_tags.clear();
m_disruptiveAction = nullptr;
m_executeIfMatchActions.clear();
m_transformations.clear();
};
void populate(const RuleWithActions *r) const;
/* auditLog */
bool hasAuditLog() const noexcept {
return m_hasAuditLog;
}
void setAuditLog(bool b) {
m_hasAuditLog = b;
}
/* log */
bool hasLog() const noexcept {
return m_hasLog;
}
void setLog(bool b) {
m_hasLog = b;
}
/* MultiMatch */
bool hasMultiMatch() const noexcept {
return m_hasMultiMatch;
}
void setMultiMatch(bool b) {
m_hasMultiMatch = b;
}
/* noAuditLog */
bool hasNoAuditLog() const noexcept {
return m_hasNoAuditLog;
}
void setNoAuditLog(bool b) {
m_hasNoAuditLog = b;
}
/* noLog */
bool hasNoLog() const noexcept {
return m_hasNoLog;
}
void setNoLog(bool b) {
m_hasNoLog = b;
}
/* block */
bool hasBlock() const noexcept {
return m_hasBlock;
}
void setBlock(bool b) {
m_hasBlock = b;
}
/* transformations */
const Transformations &getTransformations() const noexcept {
return m_transformations;
}
void addTransformation(std::shared_ptr<Transformation> t) {
m_transformations.push_back(t);
}
/* tags */
const Tags &getTags() const noexcept {
return m_tags;
}
void setTags(Tags tags) noexcept {
m_tags.insert(m_tags.end(), tags.begin(), tags.end());
}
void addTag(std::shared_ptr<Tag> t) {
m_tags.push_back(t);
}
bool hasTags() const noexcept {
return !m_tags.empty();
}
void clearTags() noexcept {
m_tags.clear();
}
/* vars */
const SetVars &getSetVars() const noexcept {
return m_setVars;
}
void addSetVar(std::shared_ptr<SetVar> t) {
m_setVars.push_back(t);
}
/* other match actions */
const MatchActions &getGenericMatchActions() const noexcept {
return m_executeIfMatchActions;
}
void addGenericMatchAction(std::shared_ptr<ActionWithExecution> a) {
m_executeIfMatchActions.push_back(a);
}
/* disruptive action */
const std::shared_ptr<ActionDisruptive> &getDisruptiveAction() const noexcept {
return m_disruptiveAction;
}
inline void setDisruptiveAction(std::shared_ptr<ActionDisruptive> d) noexcept {
m_disruptiveAction = d;
}
inline bool hasDisruptiveAction() const noexcept {
return m_disruptiveAction != nullptr;
}
private:
void inline copyActionsWithRunTimeStrings(const RuleWithActionsProperties &o);
/**
* FIXME: log, noLog, AuditLog and noAuditLog are save to compute whenver log
* is necessary or not. This can be pre-computed while the actions are
* encountered amoung the rule action list.
*
*/
bool m_hasAuditLog:1;
bool m_hasBlock:1;
bool m_hasLog:1;
bool m_hasMultiMatch:1;
bool m_hasNoAuditLog:1;
bool m_hasNoLog:1;
MatchActions m_executeIfMatchActions;
SetVars m_setVars;
std::shared_ptr<ActionDisruptive> m_disruptiveAction;
Tags m_tags;
Transformations m_transformations;
};
} // namespace modsecurity
#endif // SRC_RULE_WITH_ACTIONS_PROPERTIES_H_

7
src/rule_with_operator.cc
View File

@ -56,7 +56,7 @@ using actions::transformations::None;
RuleWithOperator::RuleWithOperator(Operator *op,
variables::Variables *_variables,
std::vector<Action *> *actions,
Actions *actions,
Transformations *transformations,
std::unique_ptr<std::string> fileName,
int lineNumber)
@ -217,7 +217,6 @@ bool RuleWithOperator::evaluate(Transaction *trans) const {
bool globalRet = false;
variables::Variables *variables = m_variables.get();
bool recursiveGlobalRet;
bool containsBlock = hasBlockAction();
std::string eparam;
variables::Variables vars;
vars.reserve(4);
@ -303,7 +302,7 @@ bool RuleWithOperator::evaluate(Transaction *trans) const {
executeTransformations(trans, value, transformationsResults);
auto iter = transformationsResults.begin();
if (!hasMultimatchAction()) {
if (!processMultiMatch()) {
iter = transformationsResults.end();
std::advance(iter, -1);
}
@ -381,7 +380,7 @@ end_exec:
/* last rule in the chain. */
trans->logMatchLastRuleOnTheChain(this);
if (hasSeverityAction()) {
if (hasSeverity()) {
ms_dbg_a(trans, 9, "This rule severity is: " + \
std::to_string(getSeverity()) + " current transaction is: " + \
std::to_string(trans->m_highestSeverityAction));

2
src/rule_with_operator.h
View File

@ -43,7 +43,7 @@ class RuleWithOperator : public RuleWithActions {
public:
RuleWithOperator(operators::Operator *op,
variables::Variables *variables,
std::vector<actions::Action *> *actions,
Actions *actions,
Transformations *transformations,
std::unique_ptr<std::string> fileName,
int lineNumber);

4
src/rules_set.cc
View File

@ -62,11 +62,11 @@ namespace modsecurity {
RuleWithActions *nr = dynamic_cast<RuleWithActions *>(m_rules[i].get());
nr->clearDefaultActions();
for (auto a : m_defaultActions) {
for (auto &a : m_defaultActions) {
nr->addDefaultAction(a);
}
for (auto a : m_defaultTransformations) {
nr->addDefaultTransformation(a);
nr->addDefaulTransformation(a);
}

14
src/run_time_string.h
View File

@ -75,7 +75,7 @@ class RunTimeString {
}
void populate(RuleWithActions *rule) noexcept {
void populate(const RuleWithActions *rule) noexcept {
for (auto &a : m_elements) {
a->populate(rule);
}
@ -108,7 +108,6 @@ class RunTimeString {
rv = dynamic_cast<RuleVariable *>(nrv);
rv->populate(nullptr);
m_variable = std::unique_ptr<Variable>(nrv);
/* m_variable = nullptr; */
} else {
m_variable = other.m_variable;
}
@ -119,7 +118,9 @@ class RunTimeString {
void appendValueTo(const Transaction *transaction, std::string &v) const noexcept {
if (m_variable && transaction) {
VariableValues l;
m_variable->evaluate(transaction, &l);
if (!l.empty()) {
v.append(l[0]->getValue());
}
@ -130,19 +131,20 @@ class RunTimeString {
}
void populate(RuleWithActions *rule) noexcept {
void populate(const RuleWithActions *rule) noexcept {
if (!m_variable) {
return;
}
RuleVariable *vrule = dynamic_cast<RuleVariable *>(m_variable.get());
if (vrule != nullptr) {
vrule->populate(rule);
if (!vrule) {
return;
}
vrule->populate(rule);
}
private:
std::string m_string;
const std::string m_string;
/*
*
* FIXME: In the current state m_variable should be a unique_ptr. There

7
src/transaction.cc
View File

@ -72,14 +72,11 @@ void TransactionRuleMessageManagement::logMatchLastRuleOnTheChain(const RuleWith
rm->setRule(rule);
if (rule->hasDisruptiveAction() && rule->isItToBeLogged() &&
(m_transaction->getRuleEngineState() == RulesSet::DetectionOnlyRuleEngine)) {
if (rule->isItToBeLogged() &&
(m_transaction->getRuleEngineState() == RulesSet::EnabledRuleEngine)) {
/* error */
// The error goes over the disruptive massage. We don't need it here.
//m_transaction->serverLog(rm);
} else if (rule->hasBlockAction() && rule->isItToBeLogged()) {
/* Log as warning. */
m_transaction->serverLog(rm);
} else if (rule->isItToBeLogged()) {
/* Log as warning. */
m_transaction->serverLog(rm);

68
src/transformation_result.h Normal file
View File

@ -0,0 +1,68 @@
/*
* ModSecurity, http://www.modsecurity.org/
* Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
*
* You may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* If any of the files related to licensing are missing or if you have any
* other questions related to licensing please contact Trustwave Holdings, Inc.
* directly using the email address security@modsecurity.org.
*
*/
#include "modsecurity/modsecurity.h"
#include "modsecurity/rule.h"
#include "modsecurity/rule_message.h"
#include "modsecurity/rules_set.h"
#ifndef SRC_TRANSFORMATION_RESULT_H_
#define SRC_TRANSFORMATION_RESULT_H_
namespace modsecurity {
class TransformationResult {
public:
explicit TransformationResult(
ModSecString &after,
const std::string *transformation = nullptr)
: m_after(after),
m_transformation(transformation) { };
explicit TransformationResult(
ModSecString *after)
: m_after(*after),
m_transformation(nullptr) { };
TransformationResult(const TransformationResult &t2)
: m_after(t2.m_after),
m_transformation(t2.m_transformation) { };
ModSecString *getAfter() {
return &m_after;
}
const std::string *getTransformationName() const {
return m_transformation;
}
private:
ModSecString m_after;
const std::string *m_transformation;
};
using TransformationsResults = std::list<TransformationResult>;
} // namespace modsecurity
#endif // SRC_TRANSFORMATION_RESULT_H_

4
src/variables/rule.h
View File

@ -71,7 +71,7 @@ class Rule_DictElement : public RuleVariable, public VariableDictElement {
const RuleWithActions *rule,
VariableValues *l) {
if (rule->hasRevisionAction()) {
if (rule->hasRevision()) {
auto var = std::make_shared<VariableValue>(&m_rule, &m_rule_rev, std::unique_ptr<std::string>(new std::string(rule->getRevision())));
VariableOrigin origin;
origin.m_offset = 0;
@ -87,7 +87,7 @@ class Rule_DictElement : public RuleVariable, public VariableDictElement {
const RuleWithActions *rule,
VariableValues *l) {
if (rule->hasSeverityAction()) {
if (rule->hasSeverity()) {
auto var = std::make_shared<VariableValue>(&m_rule, &m_rule_severity, std::unique_ptr<std::string>(new std::string(std::to_string(rule->getSeverity()))));
VariableOrigin origin;
origin.m_offset = 0;

2
src/variables/rule_variable.h
View File

@ -20,11 +20,11 @@
#ifndef SRC_VARIABLES_RULE_VARIABLE_H_
#define SRC_VARIABLES_RULE_VARIABLE_H_
#include "src/rule_with_actions.h"
namespace modsecurity {
class RuleWithActions;
class Transaction;
namespace variables {

2
src/variables/variable_with_runtime_string.h
View File

@ -40,7 +40,7 @@ class VariableWithRunTimeString : public Variable {
return *this;
}
virtual void populate(RuleWithActions *rule) {
virtual void populate(const RuleWithActions *rule) {
if (m_string) {
m_string->populate(rule);
}

8
test/test-cases/regression/config-secdefaultaction.json
View File

@ -277,7 +277,13 @@
},
"rules":[
"SecRuleEngine On",
"SecAuditEngine On",
"SecAuditEngine RelevantOnly",
"SecAuditLogParts ABCFHZ",
"SecAuditLog /tmp/test/modsec_audit_auditlog_1.log",
"SecAuditLogDirMode 0766",
"SecAuditLogFileMode 0666",
"SecAuditLogType Serial",
"SecAuditLogRelevantStatus \"^(?:3|4(?!04))\"",
"SecDefaultAction \"phase:2,log,auditlog,status:302,redirect:'http://www.google.com'\"",
"SecRule REQUEST_HEADERS \"@contains PHPSESSID\" \"phase:2,id:1,block\"",
"SecRule TX \"@contains to_test\" \"id:2,t:lowercase,t:none,block\""

5
test/test-cases/regression/issue-1528.json
View File

@ -27,12 +27,13 @@
},
"expected": {
"debug_log": "Rule returned 1",
"error_log": "Matched \"Operator `Rx' with parameter `\\^attack\\$'"
"error_log": "Matched \"Operator `Rx' with parameter `\\^attack\\$'",
"http_code": 403
},
"rules": [
"SecRuleEngine On",
"SecAction \"id:1, setvar:tx.bad_value=attack\"",
"SecRule ARGS:param \"@rx ^%{tx.bad_value}$\" \"id:2,log\""
"SecRule ARGS:param \"@rx ^%{tx.bad_value}$\" \"id:2,log,deny\""
]
}
]

4
test/test-cases/regression/issue-1844.json
View File

@ -85,10 +85,12 @@
]
},
"expected":{
"error_log":"line \"55\""
"error_log":"line \"55\"",
"http_code": 403
},
"rules":[
"SecRuleEngine On",
"SecDefaultAction \"phase:2,deny\"",
"SecRule WEBAPPID \"@contains test2\" \"id:1,phase:3,pass,t:trim\"",
"Include test-cases/data/big-file.conf"
]