mirror of
https://github.com/owasp-modsecurity/ModSecurity.git
synced 2025-08-14 05:45:59 +03:00
Reduce the workload on VariableValue
Last compute at the last minute, if needed.
This commit is contained in:
parent
8fa4fc67af
commit
820396f784
@ -78,19 +78,15 @@ class AnchoredSetVariable : public std::unordered_multimap<std::string,
|
|||||||
|
|
||||||
void unset();
|
void unset();
|
||||||
|
|
||||||
void set(const std::string &key, const std::string &value,
|
void set(const std::string &key, const std::string &value, size_t offset) {
|
||||||
size_t offset);
|
set(key, value, offset, value.size());
|
||||||
|
}
|
||||||
void set(const std::string &key, const bpstd::string_view &value,
|
|
||||||
size_t offset);
|
|
||||||
|
|
||||||
void set(const std::string &key, const char *value,
|
|
||||||
size_t offset);
|
|
||||||
|
|
||||||
void set(const std::string &key, const std::string &value,
|
void set(const std::string &key, const std::string &value,
|
||||||
size_t offset, size_t len);
|
size_t offset, size_t len);
|
||||||
|
|
||||||
void setCopy(std::string key, std::string value, size_t offset);
|
void set(const std::string &key, const bpstd::string_view &value,
|
||||||
|
size_t offset);
|
||||||
|
|
||||||
void resolve(VariableValues *l);
|
void resolve(VariableValues *l);
|
||||||
void resolve(VariableValues *l,
|
void resolve(VariableValues *l,
|
||||||
|
@ -626,18 +626,7 @@ class Transaction : public TransactionAnchoredVariables, public TransactionSecMa
|
|||||||
|
|
||||||
int m_secRuleEngine;
|
int m_secRuleEngine;
|
||||||
|
|
||||||
std::string m_variableDuration;
|
|
||||||
std::map<std::string, std::string> m_variableEnvs;
|
|
||||||
std::string m_variableHighestSeverityAction;
|
|
||||||
std::string m_variableRemoteUser;
|
std::string m_variableRemoteUser;
|
||||||
std::string m_variableTime;
|
|
||||||
std::string m_variableTimeDay;
|
|
||||||
std::string m_variableTimeEpoch;
|
|
||||||
std::string m_variableTimeHour;
|
|
||||||
std::string m_variableTimeMin;
|
|
||||||
std::string m_variableTimeSec;
|
|
||||||
std::string m_variableTimeWDay;
|
|
||||||
std::string m_variableTimeYear;
|
|
||||||
|
|
||||||
std::vector<std::shared_ptr<RequestBodyProcessor::MultipartPartTmpFile>> m_multipartPartTmpFiles;
|
std::vector<std::shared_ptr<RequestBodyProcessor::MultipartPartTmpFile>> m_multipartPartTmpFiles;
|
||||||
|
|
||||||
|
@ -20,9 +20,13 @@
|
|||||||
#include <memory>
|
#include <memory>
|
||||||
#include <list>
|
#include <list>
|
||||||
#include <utility>
|
#include <utility>
|
||||||
|
#include <vector>
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
#include "modsecurity/variable_origin.h"
|
#include "modsecurity/variable_origin.h"
|
||||||
|
#ifdef __cplusplus
|
||||||
|
#include "modsecurity/string_view.hpp"
|
||||||
|
#endif
|
||||||
|
|
||||||
#ifndef HEADERS_MODSECURITY_VARIABLE_VALUE_H_
|
#ifndef HEADERS_MODSECURITY_VARIABLE_VALUE_H_
|
||||||
#define HEADERS_MODSECURITY_VARIABLE_VALUE_H_
|
#define HEADERS_MODSECURITY_VARIABLE_VALUE_H_
|
||||||
@ -38,70 +42,208 @@ class VariableValue;
|
|||||||
using VariableValues = std::vector<std::shared_ptr<const VariableValue>>;
|
using VariableValues = std::vector<std::shared_ptr<const VariableValue>>;
|
||||||
using Origins = std::vector<VariableOrigin>;
|
using Origins = std::vector<VariableOrigin>;
|
||||||
|
|
||||||
|
|
||||||
class Collection;
|
class Collection;
|
||||||
class VariableValue {
|
class VariableValue {
|
||||||
public:
|
public:
|
||||||
|
/**
|
||||||
|
*
|
||||||
|
*
|
||||||
|
* Use cases for VariableValue creation:
|
||||||
|
*
|
||||||
|
* AnchoredSet - Use case A (eg. ARGS). - Collection + Key
|
||||||
|
* Anchored - Use case B (eg. REQUEST_URI). - Key
|
||||||
|
* Custom - Use case C (eg. WEBAPP_ID). - Key
|
||||||
|
* CustomSet
|
||||||
|
* Fixed - Use case D (eg. TX). - Collection + Key
|
||||||
|
* Dynamic - Use case E (eg. ENV). - Collection + Key
|
||||||
|
*
|
||||||
|
*
|
||||||
|
* | Key | Collec. | Key + Collec. | Value | Full Name
|
||||||
|
* A | & | & | * | & | *
|
||||||
|
* B | x | & | * | & | &
|
||||||
|
* C | x | & | * | & | &
|
||||||
|
* D | & | & | * | & | *
|
||||||
|
* E | & | & | * | * | *
|
||||||
|
*
|
||||||
|
*
|
||||||
|
*
|
||||||
|
* Currently big picture of getName and getKey:
|
||||||
|
*
|
||||||
|
* getName()
|
||||||
|
* - Lua Engine - RuleWithOperator - Transaction
|
||||||
|
* - UpdateMatchedVar - logging (audit)
|
||||||
|
* - ExecuteOperatorAt
|
||||||
|
* - ResolveMatchMsg
|
||||||
|
* - RulesExceptions (key and value)
|
||||||
|
*
|
||||||
|
*
|
||||||
|
* getKey()
|
||||||
|
* - Transaction - Variable
|
||||||
|
* - LogGen - Contains
|
||||||
|
* - Regexp
|
||||||
|
*
|
||||||
|
*
|
||||||
|
* Performance strategy: Delay the name resolution till is really necessary.
|
||||||
|
*
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
|
||||||
explicit VariableValue(const std::string *key,
|
|
||||||
|
/**
|
||||||
|
*
|
||||||
|
* Use case C + VariableModificatorCount
|
||||||
|
*
|
||||||
|
*
|
||||||
|
**/
|
||||||
|
explicit VariableValue(const std::string *collection,
|
||||||
const std::string *value = nullptr)
|
const std::string *value = nullptr)
|
||||||
: m_collection(""),
|
: m_origin(),
|
||||||
m_key(*key),
|
m_value(),
|
||||||
m_keyWithCollection(*key),
|
m_valueHolder(new std::string(value != nullptr?*value:"")), // FIXME: do we really need a copy here?
|
||||||
m_value(value != nullptr?*value:"")
|
m_key(nullptr),
|
||||||
{ }
|
m_keyHolder(nullptr),
|
||||||
|
m_collection(collection)
|
||||||
|
{
|
||||||
|
m_value = m_valueHolder.get();
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
/* Use case D.1. - ARGS */
|
||||||
|
VariableValue(const std::string *collection,
|
||||||
|
std::unique_ptr<std::string> key,
|
||||||
|
std::unique_ptr<std::string> value)
|
||||||
|
: m_origin(),
|
||||||
|
m_value(nullptr),
|
||||||
|
m_valueHolder(std::move(value)),
|
||||||
|
m_key(nullptr),
|
||||||
|
m_keyHolder(std::move(key)),
|
||||||
|
m_collection(collection)
|
||||||
|
{
|
||||||
|
m_value = m_valueHolder.get();
|
||||||
|
m_key = m_keyHolder.get();
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
/* Use case D.2. - RULE */
|
||||||
|
VariableValue(const std::string *collection,
|
||||||
|
const std::string *key,
|
||||||
|
std::unique_ptr<std::string> value)
|
||||||
|
: m_origin(),
|
||||||
|
m_value(nullptr),
|
||||||
|
m_valueHolder(std::move(value)),
|
||||||
|
m_key(key),
|
||||||
|
m_keyHolder(nullptr),
|
||||||
|
m_collection(collection)
|
||||||
|
{
|
||||||
|
m_value = m_valueHolder.get();
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
/* Use case D.3. - TX */
|
||||||
VariableValue(const std::string *collection,
|
VariableValue(const std::string *collection,
|
||||||
const std::string *key,
|
const std::string *key,
|
||||||
const std::string *value)
|
const std::string *value)
|
||||||
: m_collection(*collection),
|
: m_origin(),
|
||||||
m_key(*key),
|
m_value(value),
|
||||||
m_keyWithCollection(*collection + ":" + *key),
|
m_valueHolder(nullptr),
|
||||||
m_value(*value)
|
m_key(key),
|
||||||
{ }
|
m_keyHolder(nullptr),
|
||||||
|
m_collection(collection)
|
||||||
|
{ };
|
||||||
|
|
||||||
|
|
||||||
|
// FIXME: It maybe the case for VariableValue to use string_view for everything.
|
||||||
|
/* Use case D.4. - MATCHED_VARS */
|
||||||
|
VariableValue(const std::string *collection,
|
||||||
|
const std::string *key,
|
||||||
|
const bpstd::string_view *value)
|
||||||
|
: m_origin(),
|
||||||
|
m_value(),
|
||||||
|
m_valueHolder(std::unique_ptr<std::string>(new std::string(value->c_str()))),
|
||||||
|
m_key(key),
|
||||||
|
m_keyHolder(nullptr),
|
||||||
|
m_collection(collection)
|
||||||
|
{
|
||||||
|
m_value = m_valueHolder.get();
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
/* Use case E.1. - Env */
|
||||||
|
VariableValue(std::unique_ptr<std::string> value,
|
||||||
|
std::unique_ptr<std::string> key,
|
||||||
|
std::shared_ptr<std::string> collection)
|
||||||
|
: m_origin(),
|
||||||
|
m_value(nullptr),
|
||||||
|
m_valueHolder(std::move(value)),
|
||||||
|
m_key(nullptr),
|
||||||
|
m_keyHolder(std::move(key)),
|
||||||
|
m_collection(collection.get())
|
||||||
|
{
|
||||||
|
m_value = m_valueHolder.get();
|
||||||
|
m_key = m_keyHolder.get();
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
/* Use case E.2. - DURATION */
|
||||||
|
VariableValue(std::unique_ptr<std::string> value,
|
||||||
|
const std::string *collection)
|
||||||
|
: m_origin(),
|
||||||
|
m_value(nullptr),
|
||||||
|
m_valueHolder(std::move(value)),
|
||||||
|
m_key(nullptr),
|
||||||
|
m_keyHolder(nullptr),
|
||||||
|
m_collection(collection)
|
||||||
|
{
|
||||||
|
m_value = m_valueHolder.get();
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
VariableValue(const VariableValue &o) = delete;
|
VariableValue(const VariableValue &o) = delete;
|
||||||
|
VariableValue operator=(const VariableValue &o) = delete;
|
||||||
const std::string& getName() const noexcept {
|
|
||||||
return m_keyWithCollection;
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
const std::string& getValue() const noexcept {
|
const std::string& getValue() const noexcept {
|
||||||
return m_value;
|
return *m_value;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
const std::string& getKey() const noexcept {
|
||||||
|
return *m_key;
|
||||||
const std::string& getKey() const {
|
|
||||||
return m_key;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
const std::string& getCollection() const {
|
|
||||||
return m_collection;
|
inline const std::string getName() const noexcept {
|
||||||
|
if (m_key == nullptr || m_key->empty()) {
|
||||||
|
return *m_collection;
|
||||||
|
}
|
||||||
|
return *m_collection + ":" + *m_key;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
void setValue(const std::string &value) {
|
void setValue(const std::string &value) {
|
||||||
m_value = value;
|
m_value = &value;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
void addOrigin(VariableOrigin origin) {
|
void addOrigin(VariableOrigin origin) {
|
||||||
m_orign.push_back(std::move(origin));
|
m_origin.push_back(std::move(origin));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
const Origins& getOrigin() const {
|
const Origins& getOrigin() const {
|
||||||
return m_orign;
|
return m_origin;
|
||||||
}
|
}
|
||||||
|
|
||||||
private:
|
private:
|
||||||
Origins m_orign;
|
Origins m_origin;
|
||||||
std::string m_collection;
|
|
||||||
std::string m_key;
|
const std::string *m_value;
|
||||||
std::string m_keyWithCollection;
|
std::unique_ptr<std::string> m_valueHolder;
|
||||||
std::string m_value;
|
|
||||||
|
const std::string *m_key;
|
||||||
|
std::unique_ptr<std::string> m_keyHolder;
|
||||||
|
|
||||||
|
const std::string *m_collection;
|
||||||
};
|
};
|
||||||
|
|
||||||
} // namespace modsecurity
|
} // namespace modsecurity
|
||||||
|
@ -41,9 +41,12 @@ void AnchoredSetVariable::unset() {
|
|||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
// FIXME: It may not be necessary to copy the content of
|
||||||
void AnchoredSetVariable::set(const std::string &key,
|
void AnchoredSetVariable::set(const std::string &key,
|
||||||
const std::string &value, size_t offset, size_t len) {
|
const std::string &value, size_t offset, size_t len) {
|
||||||
auto var = std::make_shared<VariableValue>(&m_name, &key, &value);
|
auto var = std::make_shared<VariableValue>(&m_name,
|
||||||
|
std::unique_ptr<std::string>(new std::string(key)),
|
||||||
|
std::unique_ptr<std::string>(new std::string(value)));
|
||||||
|
|
||||||
VariableOrigin origin;
|
VariableOrigin origin;
|
||||||
origin.m_offset = offset;
|
origin.m_offset = offset;
|
||||||
@ -55,41 +58,13 @@ void AnchoredSetVariable::set(const std::string &key,
|
|||||||
|
|
||||||
|
|
||||||
void AnchoredSetVariable::set(const std::string &key,
|
void AnchoredSetVariable::set(const std::string &key,
|
||||||
const std::string &value, size_t offset) {
|
const bpstd::string_view &value, size_t offset) {
|
||||||
auto var = std::make_shared<VariableValue>(&m_name, &key, &value);
|
auto var = std::make_shared<VariableValue>(&m_name, &key, &value);
|
||||||
|
|
||||||
VariableOrigin origin;
|
VariableOrigin origin;
|
||||||
origin.m_offset = offset;
|
origin.m_offset = offset;
|
||||||
origin.m_length = value.size();
|
origin.m_length = value.size();
|
||||||
|
|
||||||
var->addOrigin(std::move(origin));
|
|
||||||
emplace(key, std::move(var));
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
void AnchoredSetVariable::set(const std::string &key,
|
|
||||||
const bpstd::string_view &value, size_t offset) {
|
|
||||||
std::string v(value.c_str());
|
|
||||||
auto var = std::make_shared<VariableValue>(&m_name, &key, &v);
|
|
||||||
|
|
||||||
VariableOrigin origin;
|
|
||||||
origin.m_offset = offset;
|
|
||||||
origin.m_length = value.size();
|
|
||||||
|
|
||||||
var->addOrigin(std::move(origin));
|
|
||||||
emplace(key, var);
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
void AnchoredSetVariable::set(const std::string &key,
|
|
||||||
const char *value, size_t offset) {
|
|
||||||
std::string v(value);
|
|
||||||
auto var = std::make_shared<VariableValue>(&m_name, &key, &v);
|
|
||||||
|
|
||||||
VariableOrigin origin;
|
|
||||||
origin.m_offset = offset;
|
|
||||||
origin.m_length = strlen(value);
|
|
||||||
|
|
||||||
var->addOrigin(std::move(origin));
|
var->addOrigin(std::move(origin));
|
||||||
emplace(key, var);
|
emplace(key, var);
|
||||||
}
|
}
|
||||||
|
@ -34,7 +34,8 @@ AnchoredVariable::AnchoredVariable(Transaction *t,
|
|||||||
m_offset(0),
|
m_offset(0),
|
||||||
m_name(name),
|
m_name(name),
|
||||||
m_value(""),
|
m_value(""),
|
||||||
m_var(std::make_shared<VariableValue>(&name)) {
|
m_var() {
|
||||||
|
m_var = std::make_shared<VariableValue>(&m_name);
|
||||||
}
|
}
|
||||||
|
|
||||||
void AnchoredVariable::unset() {
|
void AnchoredVariable::unset() {
|
||||||
|
@ -113,7 +113,8 @@ void InMemoryPerProcess::resolveMultiMatches(const std::string& var,
|
|||||||
if (ke.toOmit(var)) {
|
if (ke.toOmit(var)) {
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
l->insert(l->begin(), std::make_shared<VariableValue>(&m_name, &var, &it->second));
|
l->insert(l->begin(), std::make_shared<VariableValue>(&m_name, &it->first, &it->second));
|
||||||
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -81,13 +81,15 @@ RuleWithOperator::~RuleWithOperator() {
|
|||||||
void RuleWithOperator::updateMatchedVars(Transaction *trans,
|
void RuleWithOperator::updateMatchedVars(Transaction *trans,
|
||||||
const VariableValue *v,
|
const VariableValue *v,
|
||||||
const bpstd::string_view &value) {
|
const bpstd::string_view &value) {
|
||||||
const std::string &key = v->getName();
|
// FIXME: Memory leak.
|
||||||
|
const std::string *key = new std::string(v->getName());
|
||||||
|
|
||||||
ms_dbg_a(trans, 9, "Matched vars updated.");
|
ms_dbg_a(trans, 9, "Matched vars updated.");
|
||||||
trans->m_variableMatchedVar.set(value, trans->m_variableOffset);
|
trans->m_variableMatchedVar.set(value, trans->m_variableOffset);
|
||||||
trans->m_variableMatchedVarName.set(key, trans->m_variableOffset);
|
trans->m_variableMatchedVarName.set(*key, trans->m_variableOffset);
|
||||||
|
|
||||||
trans->m_variableMatchedVars.set(key, value, trans->m_variableOffset);
|
trans->m_variableMatchedVars.set(*key, value, trans->m_variableOffset);
|
||||||
trans->m_variableMatchedVarsNames.set(key, key, trans->m_variableOffset);
|
trans->m_variableMatchedVarsNames.set(*key, *key, trans->m_variableOffset);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
@ -186,18 +186,7 @@ Transaction::Transaction(ModSecurity *ms, RulesSet *rules, void *logCbData)
|
|||||||
m_json(NULL),
|
m_json(NULL),
|
||||||
#endif
|
#endif
|
||||||
m_secRuleEngine(RulesSetProperties::PropertyNotSetRuleEngine),
|
m_secRuleEngine(RulesSetProperties::PropertyNotSetRuleEngine),
|
||||||
m_variableDuration(""),
|
|
||||||
m_variableEnvs(),
|
|
||||||
m_variableHighestSeverityAction(""),
|
|
||||||
m_variableRemoteUser(""),
|
m_variableRemoteUser(""),
|
||||||
m_variableTime(""),
|
|
||||||
m_variableTimeDay(""),
|
|
||||||
m_variableTimeEpoch(""),
|
|
||||||
m_variableTimeHour(""),
|
|
||||||
m_variableTimeMin(""),
|
|
||||||
m_variableTimeSec(""),
|
|
||||||
m_variableTimeWDay(""),
|
|
||||||
m_variableTimeYear(""),
|
|
||||||
m_logCbData(logCbData),
|
m_logCbData(logCbData),
|
||||||
TransactionAnchoredVariables(this),
|
TransactionAnchoredVariables(this),
|
||||||
TransactionRuleMessageManagement(this) {
|
TransactionRuleMessageManagement(this) {
|
||||||
@ -263,18 +252,7 @@ Transaction::Transaction(ModSecurity *ms, RulesSet *rules, char *id, void *logCb
|
|||||||
m_json(NULL),
|
m_json(NULL),
|
||||||
#endif
|
#endif
|
||||||
m_secRuleEngine(RulesSetProperties::PropertyNotSetRuleEngine),
|
m_secRuleEngine(RulesSetProperties::PropertyNotSetRuleEngine),
|
||||||
m_variableDuration(""),
|
|
||||||
m_variableEnvs(),
|
|
||||||
m_variableHighestSeverityAction(""),
|
|
||||||
m_variableRemoteUser(""),
|
m_variableRemoteUser(""),
|
||||||
m_variableTime(""),
|
|
||||||
m_variableTimeDay(""),
|
|
||||||
m_variableTimeEpoch(""),
|
|
||||||
m_variableTimeHour(""),
|
|
||||||
m_variableTimeMin(""),
|
|
||||||
m_variableTimeSec(""),
|
|
||||||
m_variableTimeWDay(""),
|
|
||||||
m_variableTimeYear(""),
|
|
||||||
m_logCbData(logCbData),
|
m_logCbData(logCbData),
|
||||||
TransactionAnchoredVariables(this),
|
TransactionAnchoredVariables(this),
|
||||||
TransactionRuleMessageManagement(this) {
|
TransactionRuleMessageManagement(this) {
|
||||||
|
@ -31,9 +31,9 @@ void Duration::evaluate(Transaction *transaction,
|
|||||||
VariableValues *l) {
|
VariableValues *l) {
|
||||||
double e = utils::cpu_seconds() - transaction->m_creationTimeStamp;
|
double e = utils::cpu_seconds() - transaction->m_creationTimeStamp;
|
||||||
|
|
||||||
transaction->m_variableDuration.assign(std::to_string(e));
|
l->push_back(std::make_shared<VariableValue>(
|
||||||
|
std::unique_ptr<std::string>(new std::string(std::to_string(e))),
|
||||||
l->push_back(std::make_shared<VariableValue>(&m_retName, &transaction->m_variableDuration));
|
&m_retName));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
@ -32,28 +32,30 @@ extern char **environ;
|
|||||||
namespace modsecurity {
|
namespace modsecurity {
|
||||||
namespace variables {
|
namespace variables {
|
||||||
|
|
||||||
void Env::evaluate(Transaction *transaction,
|
void Env::evaluate(Transaction *transaction, VariableValues *l) {
|
||||||
VariableValues *l) {
|
bool checkForKey = getVariableKey()->length() > 0;
|
||||||
|
|
||||||
for (char **current = environ; *current; current++) {
|
for (char **current = environ; *current; current++) {
|
||||||
std::string env = std::string(*current);
|
std::string env = std::string(*current);
|
||||||
size_t pos = env.find_first_of("=");
|
size_t pos = env.find_first_of("=");
|
||||||
if (pos == std::string::npos) {
|
if (pos == std::string::npos) {
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
std::string key = std::string(env, 0, pos);
|
std::unique_ptr<std::string> key(new std::string(env, 0, pos));
|
||||||
std::string value = std::string(env, pos+1, env.length() - (pos + 1));
|
std::unique_ptr<std::string> value(new std::string(env, pos+1, env.length() - (pos + 1)));
|
||||||
std::pair<std::string, std::string> a(key, value);
|
|
||||||
transaction->m_variableEnvs.insert(a);
|
|
||||||
}
|
|
||||||
|
|
||||||
for (auto& x : transaction->m_variableEnvs) {
|
if (checkForKey && *key != *getVariableKey()) {
|
||||||
if (x.first != *getVariableKey() && getVariableKey()->length() > 0) {
|
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
if (!m_keyExclusion.toOmit(x.first)) {
|
if (m_keyExclusion.toOmit(*key)) {
|
||||||
l->emplace_back(std::make_shared<VariableValue>(getVariableKeyWithCollection().get(),
|
continue;
|
||||||
&x.first, &x.second));
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
l->emplace_back(std::make_shared<VariableValue>(
|
||||||
|
std::move(value),
|
||||||
|
std::move(key),
|
||||||
|
getVariableKeyWithCollection()
|
||||||
|
));
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -30,11 +30,10 @@ namespace variables {
|
|||||||
|
|
||||||
class Env : public Variable {
|
class Env : public Variable {
|
||||||
public:
|
public:
|
||||||
explicit Env(const std::string &_name)
|
explicit Env(const std::string &name)
|
||||||
: Variable(_name) { }
|
: Variable(name) { }
|
||||||
|
|
||||||
void evaluate(Transaction *transaction,
|
void evaluate(Transaction *transaction, VariableValues *l) override;
|
||||||
VariableValues *l) override;
|
|
||||||
};
|
};
|
||||||
|
|
||||||
} // namespace variables
|
} // namespace variables
|
||||||
|
@ -28,9 +28,9 @@ namespace variables {
|
|||||||
|
|
||||||
void HighestSeverity::evaluate(Transaction *transaction,
|
void HighestSeverity::evaluate(Transaction *transaction,
|
||||||
VariableValues *l) {
|
VariableValues *l) {
|
||||||
transaction->m_variableHighestSeverityAction.assign(
|
l->push_back(std::make_shared<VariableValue>(
|
||||||
std::to_string(transaction->m_highestSeverityAction));
|
std::unique_ptr<std::string>(new std::string(std::to_string(transaction->m_highestSeverityAction))),
|
||||||
l->push_back(std::make_shared<VariableValue>(getVariableKeyWithCollection().get(), &transaction->m_variableHighestSeverityAction));
|
getVariableKeyWithCollection().get()));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
@ -63,7 +63,7 @@ void RemoteUser::evaluate(Transaction *transaction,
|
|||||||
}
|
}
|
||||||
transaction->m_variableRemoteUser.assign(std::string(base64, 0, pos));
|
transaction->m_variableRemoteUser.assign(std::string(base64, 0, pos));
|
||||||
|
|
||||||
auto var = std::make_shared<VariableValue>(&l2[0]->getName(), &transaction->m_variableRemoteUser);
|
auto var = std::make_shared<VariableValue>(&m_retName, &transaction->m_variableRemoteUser);
|
||||||
|
|
||||||
for (auto &i : l2[0]->getOrigin()) {
|
for (auto &i : l2[0]->getOrigin()) {
|
||||||
var->addOrigin(i);
|
var->addOrigin(i);
|
||||||
|
@ -57,8 +57,7 @@ class Rule_DictElement : public RuleVariable, public VariableDictElement {
|
|||||||
static void id(Transaction *t,
|
static void id(Transaction *t,
|
||||||
const RuleWithActions *rule,
|
const RuleWithActions *rule,
|
||||||
VariableValues *l) {
|
VariableValues *l) {
|
||||||
std::string a = std::to_string(rule->getId());
|
auto var = std::make_shared<VariableValue>(&m_rule, &m_rule_id, std::unique_ptr<std::string>(new std::string(std::to_string(rule->getId()))));
|
||||||
auto var = std::make_shared<VariableValue>(&m_rule, &m_rule_id, &a);
|
|
||||||
VariableOrigin origin;
|
VariableOrigin origin;
|
||||||
origin.m_offset = 0;
|
origin.m_offset = 0;
|
||||||
origin.m_length = 0;
|
origin.m_length = 0;
|
||||||
@ -73,8 +72,7 @@ class Rule_DictElement : public RuleVariable, public VariableDictElement {
|
|||||||
VariableValues *l) {
|
VariableValues *l) {
|
||||||
|
|
||||||
if (rule->hasRevisionAction()) {
|
if (rule->hasRevisionAction()) {
|
||||||
std::string a(rule->getRevision());
|
auto var = std::make_shared<VariableValue>(&m_rule, &m_rule_rev, std::unique_ptr<std::string>(new std::string(rule->getRevision())));
|
||||||
auto var = std::make_shared<VariableValue>(&m_rule, &m_rule_rev, &a);
|
|
||||||
VariableOrigin origin;
|
VariableOrigin origin;
|
||||||
origin.m_offset = 0;
|
origin.m_offset = 0;
|
||||||
origin.m_length = 0;
|
origin.m_length = 0;
|
||||||
@ -90,8 +88,7 @@ class Rule_DictElement : public RuleVariable, public VariableDictElement {
|
|||||||
VariableValues *l) {
|
VariableValues *l) {
|
||||||
|
|
||||||
if (rule->hasSeverityAction()) {
|
if (rule->hasSeverityAction()) {
|
||||||
std::string a(std::to_string(rule->getSeverity()));
|
auto var = std::make_shared<VariableValue>(&m_rule, &m_rule_severity, std::unique_ptr<std::string>(new std::string(std::to_string(rule->getSeverity()))));
|
||||||
auto var = std::make_shared<VariableValue>(&m_rule, &m_rule_severity, &a);
|
|
||||||
VariableOrigin origin;
|
VariableOrigin origin;
|
||||||
origin.m_offset = 0;
|
origin.m_offset = 0;
|
||||||
origin.m_length = 0;
|
origin.m_length = 0;
|
||||||
@ -106,8 +103,7 @@ class Rule_DictElement : public RuleVariable, public VariableDictElement {
|
|||||||
VariableValues *l) {
|
VariableValues *l) {
|
||||||
|
|
||||||
if (rule->hasLogDataAction()) {
|
if (rule->hasLogDataAction()) {
|
||||||
std::string a(rule->getLogData(t));
|
auto var = std::make_shared<VariableValue>(&m_rule, &m_rule_logdata, std::unique_ptr<std::string>(new std::string(rule->getLogData(t))));
|
||||||
auto var = std::make_shared<VariableValue>(&m_rule, &m_rule_logdata, &a);
|
|
||||||
VariableOrigin origin;
|
VariableOrigin origin;
|
||||||
origin.m_offset = 0;
|
origin.m_offset = 0;
|
||||||
origin.m_length = 0;
|
origin.m_length = 0;
|
||||||
@ -121,8 +117,7 @@ class Rule_DictElement : public RuleVariable, public VariableDictElement {
|
|||||||
VariableValues *l) {
|
VariableValues *l) {
|
||||||
|
|
||||||
if (rule->hasMessageAction()) {
|
if (rule->hasMessageAction()) {
|
||||||
std::string a(rule->getMessage(t));
|
auto var = std::make_shared<VariableValue>(&m_rule, &m_rule_msg, std::unique_ptr<std::string>(new std::string(rule->getMessage(t))));
|
||||||
auto var = std::make_shared<VariableValue>(&m_rule, &m_rule_msg, &a);
|
|
||||||
VariableOrigin origin;
|
VariableOrigin origin;
|
||||||
origin.m_offset = 0;
|
origin.m_offset = 0;
|
||||||
origin.m_length = 0;
|
origin.m_length = 0;
|
||||||
|
@ -46,8 +46,9 @@ void Time::evaluate(Transaction *transaction,
|
|||||||
localtime_r(&timer, &timeinfo);
|
localtime_r(&timer, &timeinfo);
|
||||||
strftime(tstr, 200, "%H:%M:%S", &timeinfo);
|
strftime(tstr, 200, "%H:%M:%S", &timeinfo);
|
||||||
|
|
||||||
transaction->m_variableTime.assign(tstr);
|
l->push_back(std::make_shared<VariableValue>(
|
||||||
l->push_back(std::make_shared<VariableValue>(&m_retName, &transaction->m_variableTime));
|
std::unique_ptr<std::string>(new std::string(tstr)),
|
||||||
|
&m_retName));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
@ -45,9 +45,9 @@ void TimeDay::evaluate(Transaction *transaction,
|
|||||||
localtime_r(&timer, &timeinfo);
|
localtime_r(&timer, &timeinfo);
|
||||||
strftime(tstr, 200, "%d", &timeinfo);
|
strftime(tstr, 200, "%d", &timeinfo);
|
||||||
|
|
||||||
transaction->m_variableTimeDay.assign(tstr);
|
l->push_back(std::make_shared<VariableValue>(
|
||||||
|
std::unique_ptr<std::string>(new std::string(tstr)),
|
||||||
l->push_back(std::make_shared<VariableValue>(&m_retName, &transaction->m_variableTimeDay));
|
&m_retName));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
@ -35,9 +35,10 @@ namespace variables {
|
|||||||
|
|
||||||
void TimeEpoch::evaluate(Transaction *transaction,
|
void TimeEpoch::evaluate(Transaction *transaction,
|
||||||
VariableValues *l) {
|
VariableValues *l) {
|
||||||
transaction->m_variableTimeEpoch.assign(
|
|
||||||
std::to_string(std::time(nullptr)));
|
l->push_back(std::make_shared<VariableValue>(
|
||||||
l->push_back(std::make_shared<VariableValue>(&m_retName, &transaction->m_variableTimeEpoch));
|
std::unique_ptr<std::string>(new std::string(std::to_string(std::time(nullptr)))),
|
||||||
|
&m_retName));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
@ -45,9 +45,9 @@ void TimeHour::evaluate(Transaction *transaction,
|
|||||||
localtime_r(&timer, &timeinfo);
|
localtime_r(&timer, &timeinfo);
|
||||||
strftime(tstr, 200, "%H", &timeinfo);
|
strftime(tstr, 200, "%H", &timeinfo);
|
||||||
|
|
||||||
transaction->m_variableTimeHour.assign(tstr);
|
l->push_back(std::make_shared<VariableValue>(
|
||||||
|
std::unique_ptr<std::string>(new std::string(tstr)),
|
||||||
l->push_back(std::make_shared<VariableValue>(&m_retName, &transaction->m_variableTimeHour));
|
&m_retName));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
@ -45,9 +45,9 @@ void TimeMin::evaluate(Transaction *transaction,
|
|||||||
localtime_r(&timer, &timeinfo);
|
localtime_r(&timer, &timeinfo);
|
||||||
strftime(tstr, 200, "%M", &timeinfo);
|
strftime(tstr, 200, "%M", &timeinfo);
|
||||||
|
|
||||||
transaction->m_variableTimeMin.assign(tstr);
|
l->push_back(std::make_shared<VariableValue>(
|
||||||
|
std::unique_ptr<std::string>(new std::string(tstr)),
|
||||||
l->push_back(std::make_shared<VariableValue>(&m_retName, &transaction->m_variableTimeMin));
|
&m_retName));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
@ -44,12 +44,12 @@ void TimeMon::evaluate(Transaction *transaction,
|
|||||||
|
|
||||||
localtime_r(&timer, &timeinfo);
|
localtime_r(&timer, &timeinfo);
|
||||||
strftime(tstr, 200, "%m", &timeinfo);
|
strftime(tstr, 200, "%m", &timeinfo);
|
||||||
int a = atoi(tstr);
|
//int a = atoi(tstr);
|
||||||
a--;
|
//a--;
|
||||||
|
|
||||||
transaction->m_variableTimeMin.assign(std::to_string(a));
|
l->push_back(std::make_shared<VariableValue>(
|
||||||
|
std::unique_ptr<std::string>(new std::string(tstr)),
|
||||||
l->push_back(std::make_shared<VariableValue>(&m_retName, &transaction->m_variableTimeMin));
|
&m_retName));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
@ -45,9 +45,9 @@ void TimeSec::evaluate(Transaction *transaction,
|
|||||||
localtime_r(&timer, &timeinfo);
|
localtime_r(&timer, &timeinfo);
|
||||||
strftime(tstr, 200, "%S", &timeinfo);
|
strftime(tstr, 200, "%S", &timeinfo);
|
||||||
|
|
||||||
transaction->m_variableTimeSec.assign(tstr);
|
l->push_back(std::make_shared<VariableValue>(
|
||||||
|
std::unique_ptr<std::string>(new std::string(tstr)),
|
||||||
l->push_back(std::make_shared<VariableValue>(&m_retName, &transaction->m_variableTimeSec));
|
&m_retName));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
@ -45,9 +45,9 @@ void TimeWDay::evaluate(Transaction *transaction,
|
|||||||
localtime_r(&timer, &timeinfo);
|
localtime_r(&timer, &timeinfo);
|
||||||
strftime(tstr, 200, "%u", &timeinfo);
|
strftime(tstr, 200, "%u", &timeinfo);
|
||||||
|
|
||||||
transaction->m_variableTimeWDay.assign(tstr);
|
l->push_back(std::make_shared<VariableValue>(
|
||||||
|
std::unique_ptr<std::string>(new std::string(tstr)),
|
||||||
l->push_back(std::make_shared<VariableValue>(&m_retName, &transaction->m_variableTimeWDay));
|
&m_retName));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
@ -45,9 +45,9 @@ void TimeYear::evaluate(Transaction *transaction,
|
|||||||
localtime_r(&timer, &timeinfo);
|
localtime_r(&timer, &timeinfo);
|
||||||
strftime(tstr, 200, "%Y", &timeinfo);
|
strftime(tstr, 200, "%Y", &timeinfo);
|
||||||
|
|
||||||
transaction->m_variableTimeYear.assign(tstr);
|
l->push_back(std::make_shared<VariableValue>(
|
||||||
|
std::unique_ptr<std::string>(new std::string(tstr)),
|
||||||
l->push_back(std::make_shared<VariableValue>(&m_retName, &transaction->m_variableTimeYear));
|
&m_retName));
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
@ -772,8 +772,9 @@ class VariableModificatorCount : public Variable {
|
|||||||
m_base->evaluate(t, &reslIn);
|
m_base->evaluate(t, &reslIn);
|
||||||
auto count = reslIn.size();
|
auto count = reslIn.size();
|
||||||
|
|
||||||
std::string res(std::to_string(count));
|
l->push_back(std::make_shared<VariableValue>(
|
||||||
l->push_back(std::make_shared<VariableValue>(getVariableKeyWithCollection().get(), &res));
|
std::unique_ptr<std::string>(new std::string(std::to_string(count))),
|
||||||
|
getVariableKeyWithCollection().get()));
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
Loading…
x
Reference in New Issue
Block a user