From ad8182e2a8364de97ae0f377f52f45b957dedab4 Mon Sep 17 00:00:00 2001
From: Felipe Zimmerle <fcosta@trustwave.com>
Date: Tue, 27 Jun 2017 23:55:47 -0300
Subject: [PATCH] Adds support to the verify ssn operator

---
 src/operators/verify_ssn.cc | 111 ++++++++++++++++++++++++++++++++++--
 src/operators/verify_ssn.h  |  39 ++++++++++++-
 2 files changed, 142 insertions(+), 8 deletions(-)

diff --git a/src/operators/verify_ssn.cc b/src/operators/verify_ssn.cc
index 22f92d11..68993633 100644
--- a/src/operators/verify_ssn.cc
+++ b/src/operators/verify_ssn.cc
@@ -22,13 +22,114 @@
 namespace modsecurity {
 namespace operators {
 
+int VerifySSN::convert_to_int(const char c)
+{
+    int n;
+    if ((c>='0') && (c<='9'))
+        n = c - '0';
+    else if ((c>='A') && (c<='F'))
+        n = c - 'A' + 10;
+    else if ((c>='a') && (c<='f'))
+        n = c - 'a' + 10;
+    else
+        n = 0;
+    return n;
+}
+
+bool VerifySSN::verify(const char *ssnumber, int len) {
+    int i;
+    int num[9];
+    int digits = 0;
+    int area, serial, grp;
+    int sequencial = 0;
+    int repetitions = 0;
+    std::string str_area;
+    std::string str_grp;
+    std::string str_serial;
+
+    for (i = 0; i < len; i++) {
+        if (isdigit(ssnumber[i])) {
+            if (digits < 9)
+                num[digits] = convert_to_int(ssnumber[i]);
+            digits++;
+        }
+    }
+
+    /* Not a valid number */
+    if (digits != 9)
+        goto invalid;
+
+    for (i=0; i < 8; i++)   {
+        if (num[i] == (num[i+1]-1))
+            sequencial++;
+
+        if (num[i] == num[i+1])
+            repetitions++;
+    }
+
+    /* We are blocking when all numbers were sequencial or repeated */
+    if (sequencial == 8)
+        goto invalid;
+
+    if (repetitions == 8)
+        goto invalid;
+
+    str_area.append(std::to_string(num[0]) + std::to_string(num[1]) +
+        std::to_string(num[2]));
+
+    str_grp.append(std::to_string(num[3]) + std::to_string(num[4]));
+
+    str_serial.append(std::to_string(num[5]) + std::to_string(num[6])
+        + std::to_string(num[7]) + std::to_string(num[8]));
+
+    if (str_area.size() == 0 || str_grp.size() == 0
+        || str_serial.size() == 0) {
+        goto invalid;
+    }
+
+    area = atoi(str_area.c_str());
+    grp = atoi(str_grp.c_str());
+    serial = atoi(str_serial.c_str());
+
+    /* Cannot has seroed fields */
+    if (area == 0 || serial == 0 || grp == 0)
+        goto invalid;
+
+    /* More tests */
+    if (area >= 740 || area == 666)
+        goto invalid;
 
-bool VerifySSN::evaluate(Transaction *transaction, const std::string &str) {
-    /**
-     * @todo Implement the operator VerifySSN.
-     *       Reference: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#verifySSN
-     */
     return true;
+
+invalid:
+    return false;
+}
+
+
+bool VerifySSN::evaluate(Transaction *transaction, Rule *rule,
+    const std::string& input, std::shared_ptr<RuleMessage> ruleMessage) {
+    std::list<SMatch> matches;
+    bool is_ssn = false;
+    int i;
+
+    if (m_param.empty()) {
+        return false;
+    }
+
+    for (i = 0; i < input.size() - 1 && is_ssn == false; i++) {
+        matches = m_re->searchAll(input.substr(i, input.size()));
+
+        for (const auto & i : matches) {
+            is_ssn = verify(i.match.c_str(), i.match.size());
+            logOffset(ruleMessage, i.m_offset, i.m_length);
+            if (is_ssn) {
+                goto out;
+            }
+        }
+    }
+
+out:
+    return is_ssn;
 }
 
 
diff --git a/src/operators/verify_ssn.h b/src/operators/verify_ssn.h
index c8f5b510..eac7cb37 100644
--- a/src/operators/verify_ssn.h
+++ b/src/operators/verify_ssn.h
@@ -19,19 +19,52 @@
 #include <string>
 
 #include "src/operators/operator.h"
+#include "src/utils/regex.h"
 
 
 namespace modsecurity {
+using Utils::SMatch;
+using Utils::regex_search;
+using Utils::Regex;
+
 namespace operators {
 
 class VerifySSN : public Operator {
  public:
     /** @ingroup ModSecurity_Operator */
     VerifySSN(std::string o, std::string p, bool n)
-        : Operator(o, p, n) { }
+        : Operator(o, p, n) {
+        m_re = new Regex(p);
+    }
+    VerifySSN(std::string name, std::string param)
+        : Operator(name, param) {
+        m_re = new Regex(param);
+    }
     explicit VerifySSN(std::string param)
-        : Operator("VerifySSN", param) { }
-    bool evaluate(Transaction *transaction, const std::string  &str) override;
+        : Operator("VerifySSN", param) {
+        m_re = new Regex(param);
+    }
+
+    ~VerifySSN() {
+        delete m_re;
+    }
+    bool evaluate(Transaction *transaction, Rule *rule,
+        const std::string &input) override {
+        return evaluate(transaction, NULL, input, NULL);
+    }
+    bool evaluate(Transaction *transaction,
+        const std::string &input) override {
+        return evaluate(transaction, NULL, input);
+    }
+    bool evaluate(Transaction *transaction, Rule *rule,
+        const std::string& input,
+        std::shared_ptr<RuleMessage> ruleMessage) override;
+
+    int convert_to_int(const char c);
+    bool verify(const char *ssnumber, int len);
+
+ private:
+    Regex *m_re;
 };
 
 }  // namespace operators