From cb9524ffd7b35fb293ef0d562d8205645f80398c Mon Sep 17 00:00:00 2001
From: Felipe Zimmerle <fcosta@trustwave.com>
Date: Tue, 29 Sep 2015 13:14:36 -0700
Subject: [PATCH] Adds support to collection in the parser

---
 src/parser/seclang-parser.yy  | 7 +++++++
 src/parser/seclang-scanner.ll | 8 +++++---
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/src/parser/seclang-parser.yy b/src/parser/seclang-parser.yy
index cf781d33..ef7ef4ec 100644
--- a/src/parser/seclang-parser.yy
+++ b/src/parser/seclang-parser.yy
@@ -227,6 +227,7 @@ using ModSecurity::Variables::Variable;
 %token <std::string> ACTION_SEVERITY
 %token <std::string> ACTION_SETVAR
 %token <std::string> ACTION_EXPIREVAR
+%token <std::string> ACTION_INITCOL
 %token <std::string> ACTION_MSG
 %token <std::string> ACTION_TAG
 %token <std::string> ACTION_REV
@@ -240,6 +241,7 @@ using ModSecurity::Variables::Variable;
 %token <std::string> ACTION_CTL_BDY_XML
 %token <std::string> ACTION_CTL_RULE_ENGINE
 %token <std::string> ACTION_CTL_FORCE_REQ_BODY_VAR
+%token <std::string> CONFIG_SEC_COLLECTION_TIMEOUT
 
 %type <std::vector<Action *> *> actions
 %type <std::vector<Variable *> *> variables
@@ -537,6 +539,7 @@ expression:
     | CONGIG_DIR_SEC_COOKIE_FORMAT
     | CONGIG_DIR_SEC_STATUS_ENGINE
     | CONFIG_DIR_UNICODE_MAP_FILE
+    | CONFIG_SEC_COLLECTION_TIMEOUT
       {
       }
     ;
@@ -696,6 +699,10 @@ act:
             YYERROR;
         }
       }
+    | ACTION_INITCOL
+      {
+        $$ = Action::instantiate($1);
+      }
     | TRANSFORMATION
       {
         $$ = Transformation::instantiate($1);
diff --git a/src/parser/seclang-scanner.ll b/src/parser/seclang-scanner.ll
index cc095675..1f2d8343 100755
--- a/src/parser/seclang-scanner.ll
+++ b/src/parser/seclang-scanner.ll
@@ -23,7 +23,8 @@ using ModSecurity::split;
 %}
 %option noyywrap nounput batch debug noinput
 
-ACTION          (?i:accuracy|allow|append|block|capture|chain|deny|deprecatevar|drop|exec|expirevar|id:[0-9]+|id:'[0-9]+'|initcol|log|multiMatch|noauditlog|nolog|pass|pause|prepend|proxy|sanitiseArg|sanitiseMatched|sanitiseMatchedBytes|sanitiseRequestHeader|sanitiseResponseHeader|setuid|setrsc|setsid|setenv|skip|status:[0-9]+|xmlns)
+ACTION          (?i:accuracy|allow|append|block|capture|chain|deny|deprecatevar|drop|exec|expirevar|id:[0-9]+|id:'[0-9]+'|log|multiMatch|noauditlog|nolog|pass|pause|prepend|proxy|sanitiseArg|sanitiseMatched|sanitiseMatchedBytes|sanitiseRequestHeader|sanitiseResponseHeader|setuid|setrsc|setsid|setenv|skip|status:[0-9]+|xmlns)
+ACTION_INITCOL  (?i:initcol)
 
 ACTION_ACCURACY (?i:accuracy)
 ACTION_REDIRECT (?i:redirect)
@@ -85,6 +86,7 @@ CONFIG_DIR_AUDIT_LOG     (?i:SecAuditLog)
 CONFIG_DIR_AUDIT_STS     (?i:SecAuditLogRelevantStatus)
 CONFIG_DIR_AUDIT_TPE     (?i:SecAuditLogType)
 
+CONFIG_SEC_COLLECTION_TIMEOUT (?i:SecCollectionTimeout)
 
 CONFIG_DIR_DEBUG_LOG (?i:SecDebugLog)
 CONFIG_DIR_DEBUG_LVL (?i:SecDebugLogLevel)
@@ -318,7 +320,7 @@ CONFIG_DIR_UNICODE_MAP_FILE (?i:SecUnicodeMapFile)
 {ACTION_ACCURACY}:{FREE_TEXT_QUOTE}      { return yy::seclang_parser::make_ACTION_ACCURACY(strchr(yytext, ':') + 1, *driver.loc.back()); }
 {ACTION_CTL_BDY_XML}              { return yy::seclang_parser::make_ACTION_CTL_BDY_XML(yytext, *driver.loc.back()); }
 {ACTION_CTL_BDY_JSON}             { return yy::seclang_parser::make_ACTION_CTL_BDY_JSON(yytext, *driver.loc.back()); }
-
+{ACTION_INITCOL}:{FREE_TEXT_QUOTE}={FREE_TEXT_SPACE_COMMA} { return yy::seclang_parser::make_ACTION_INITCOL(yytext, *driver.loc.back()); }
 
 ["]                             { return yy::seclang_parser::make_QUOTATION_MARK(yytext, *driver.loc.back()); }
 [,]                             { return yy::seclang_parser::make_COMMA(*driver.loc.back()); }
@@ -430,7 +432,7 @@ CONFIG_DIR_UNICODE_MAP_FILE (?i:SecUnicodeMapFile)
 }
 
 {CONFIG_SEC_REMOTE_RULES_FAIL_ACTION}  { return yy::seclang_parser::make_CONFIG_SEC_REMOTE_RULES_FAIL_ACTION(yytext, *driver.loc.back()); }
-
+{CONFIG_SEC_COLLECTION_TIMEOUT}[ ]{CONFIG_VALUE_NUMBER}  { return yy::seclang_parser::make_CONFIG_SEC_COLLECTION_TIMEOUT(strchr(yytext, ' ') + 1, *driver.loc.back()); }
 
 %%