Adds capture action to verifySSN

This commit is contained in:
Felipe Zimmerle
2018-03-09 09:42:05 -03:00
parent 60b2469097
commit 77a885da5f
4 changed files with 61 additions and 3 deletions

View File

@@ -108,7 +108,7 @@ invalid:
}
bool VerifySSN::evaluate(Transaction *transaction, Rule *rule,
bool VerifySSN::evaluate(Transaction *t, Rule *rule,
const std::string& input, std::shared_ptr<RuleMessage> ruleMessage) {
std::list<SMatch> matches;
bool is_ssn = false;
@@ -120,11 +120,20 @@ bool VerifySSN::evaluate(Transaction *transaction, Rule *rule,
for (i = 0; i < input.size() - 1 && is_ssn == false; i++) {
matches = m_re->searchAll(input.substr(i, input.size()));
for (const auto & i : matches) {
is_ssn = verify(i.match.c_str(), i.match.size());
logOffset(ruleMessage, i.m_offset, i.m_length);
if (is_ssn) {
logOffset(ruleMessage, i.m_offset, i.m_length);
if (rule && t
&& rule->getActionsByName("capture").size() > 0) {
t->m_collections.m_tx_collection->storeOrUpdateFirst(
"0", std::string(i.match));
#ifndef NO_LOGS
t->debug(7, "Added VerifySSN match TX.0: " + \
std::string(i.match));
#endif
}
goto out;
}
}