github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-14 05:45:59 +03:00
Code Issues Packages Projects Releases Wiki Activity

Adds support to SecRuleRemoveByMsg

Browse Source
This commit is contained in:
Felipe Zimmerle 2017-08-16 23:42:13 -03:00
parent 562c2b2f5a
commit d7eab6b7a3
10 changed files with 5220 additions and 5109 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
headers/modsecurity/rule.h
View File

@ -76,6 +76,7 @@ class Rule {
std::vector<std::string> getActionNames();
std::vector<actions::Action *> getActionsByName(const std::string& name);
bool containsTag(const std::string& name, Transaction *t);
bool containsMsg(const std::string& name, Transaction *t);
bool containsDisruptiveAction();
int refCountDecreaseAndCheck() {

3
headers/modsecurity/rules_exceptions.h
View File

@ -50,6 +50,8 @@ class RulesExceptions {
bool contains(int a);
bool merge(RulesExceptions& from);
bool loadRemoveRuleByMsg(const std::string &msg, std::string *error);
bool loadUpdateTargetByTag(const std::string &tag,
std::unique_ptr<std::vector<std::unique_ptr<Variables::Variable> > > var,
std::string *error);
@ -60,6 +62,7 @@ class RulesExceptions {
std::unordered_multimap<std::string, std::unique_ptr<Variables::Variable>> m_variable_update_target_by_tag;
std::unordered_multimap<double, std::unique_ptr<Variables::Variable>> m_variable_update_target_by_id;
std::list<std::string> m_remove_rule_by_msg;
private:
std::list<std::pair<int, int> > m_ranges;

3234
src/parser/seclang-parser.cc
View File

File diff suppressed because it is too large Load Diff

924
src/parser/seclang-parser.hh
View File

File diff suppressed because it is too large Load Diff

14
src/parser/seclang-parser.yy
View File

@ -567,6 +567,7 @@ using modsecurity::operators::Operator;
CONFIG_SEC_HTTP_BLKEY "CONFIG_SEC_HTTP_BLKEY"
CONFIG_SEC_REMOTE_RULES_FAIL_ACTION "CONFIG_SEC_REMOTE_RULES_FAIL_ACTION"
CONFIG_SEC_RULE_REMOVE_BY_ID "CONFIG_SEC_RULE_REMOVE_BY_ID"
CONFIG_SEC_RULE_REMOVE_BY_MSG "CONFIG_SEC_RULE_REMOVE_BY_MSG"
CONFIG_SEC_RULE_UPDATE_TARGET_BY_TAG "CONFIG_SEC_RULE_UPDATE_TARGET_BY_TAG"
CONFIG_SEC_RULE_UPDATE_TARGET_BY_ID "CONFIG_SEC_RULE_UPDATE_TARGET_BY_ID"
CONFIG_UPDLOAD_KEEP_FILES "CONFIG_UPDLOAD_KEEP_FILES"
@ -1212,6 +1213,19 @@ expression:
YYERROR;
}
}
| CONFIG_SEC_RULE_REMOVE_BY_MSG
{
std::string error;
if (driver.m_exceptions.loadRemoveRuleByMsg($1, &error) == false) {
std::stringstream ss;
ss << "SecRuleRemoveByMsg: failed to load:";
ss << $1;
ss << ". ";
ss << error;
driver.error(@0, ss.str());
YYERROR;
}
}
| CONFIG_SEC_RULE_UPDATE_TARGET_BY_TAG variables
{
std::string error;

6118
src/parser/seclang-scanner.cc
View File

File diff suppressed because it is too large Load Diff

3
src/parser/seclang-scanner.ll
View File

@ -294,6 +294,7 @@ CONFIG_SEC_HTTP_BLKEY (?i:SecHttpBlKey)
CONFIG_SEC_REMOTE_RULES (?i:SecRemoteRules)
CONFIG_SEC_REMOTE_RULES_FAIL_ACTION (?i:SecRemoteRulesFailAction)
CONFIG_SEC_REMOVE_RULES_BY_ID (?i:SecRuleRemoveById)
CONFIG_SEC_REMOVE_RULES_BY_MSG (?i:SecRuleRemoveByMsg)
CONFIG_SEC_UPDATE_TARGET_BY_TAG (?i:SecRuleUpdateTargetByTag)
CONFIG_SEC_UPDATE_TARGET_BY_ID (?i:SecRuleUpdateTargetById)
CONFIG_UPDLOAD_KEEP_FILES (?i:SecUploadKeepFiles)
@ -611,6 +612,8 @@ EQUALS_MINUS (?i:=\-)
{CONFIG_DIR_SEC_MARKER}[ \t]+{NEW_LINE_FREE_TEXT} { return p::make_CONFIG_DIR_SEC_MARKER(strchr(yytext, ' ') + 1, *driver.loc.back()); }
{CONFIG_DIR_UNICODE_MAP_FILE}[ ]{FREE_TEXT_NEW_LINE} { return p::make_CONFIG_DIR_UNICODE_MAP_FILE(strchr(yytext, ' ') + 1, *driver.loc.back()); }
{CONFIG_SEC_REMOVE_RULES_BY_ID}[ ]+{FREE_TEXT_NEW_LINE} { return p::make_CONFIG_SEC_RULE_REMOVE_BY_ID(parserSanitizer(strchr(yytext, ' ') + 1), *driver.loc.back()); }
{CONFIG_SEC_REMOVE_RULES_BY_MSG}[ \t]+{FREE_TEXT_NEW_LINE} { return p::make_CONFIG_SEC_RULE_REMOVE_BY_MSG(parserSanitizer(strchr(yytext, ' ') + 1), *driver.loc.back()); }
{CONFIG_SEC_REMOVE_RULES_BY_MSG}[ \t]+["]{FREE_TEXT_NEW_LINE}["] { return p::make_CONFIG_SEC_RULE_REMOVE_BY_MSG(parserSanitizer(strchr(yytext, ' ') + 1), *driver.loc.back()); }
{CONFIG_SEC_UPDATE_TARGET_BY_TAG}[ ]+["]{FREE_TEXT_NEW_LINE}["] { state_variable_from = 1; BEGIN(TRANSACTION_TO_VARIABLE); return p::make_CONFIG_SEC_RULE_UPDATE_TARGET_BY_TAG(parserSanitizer(strchr(yytext, ' ') + 1), *driver.loc.back()); }
{CONFIG_SEC_UPDATE_TARGET_BY_TAG}[ ]+{FREE_TEXT_SPACE_COMMA_QUOTE} { state_variable_from = 1; BEGIN(TRANSACTION_TO_VARIABLE); return p::make_CONFIG_SEC_RULE_UPDATE_TARGET_BY_TAG(parserSanitizer(strchr(yytext, ' ') + 1), *driver.loc.back()); }
{CONFIG_SEC_UPDATE_TARGET_BY_ID}[ ]+["]{FREE_TEXT_NEW_LINE}["] { state_variable_from = 1; BEGIN(TRANSACTION_TO_VARIABLE); return p::make_CONFIG_SEC_RULE_UPDATE_TARGET_BY_ID(parserSanitizer(strchr(yytext, ' ') + 1), *driver.loc.back()); }

11
src/rule.cc
View File

@ -850,4 +850,15 @@ bool Rule::containsTag(const std::string& name, Transaction *t) {
}
bool Rule::containsMsg(const std::string& name, Transaction *t) {
for (auto &z : this->m_actionsRuntimePos) {
actions::Msg *msg = dynamic_cast<actions::Msg *> (z);
if (msg != NULL && msg->data(t) == name) {
return true;
}
}
return false;
}
} // namespace modsecurity

7
src/rules.cc
View File

@ -208,6 +208,13 @@ int Rules::evaluate(int phase, Transaction *transaction) {
} else if (m_exceptions.contains(rule->m_ruleId)) {
debug(9, "Skipped rule id '" + std::to_string(rule->m_ruleId) \
+ "'. Removed by an SecRuleRemove directive.");
} else if (m_exceptions.m_remove_rule_by_msg.empty() == false) {
for (auto &z : m_exceptions.m_remove_rule_by_msg) {
if (rule->containsMsg(z, transaction) == true) {
debug(9, "Skipped rule id '" + std::to_string(rule->m_ruleId) \
+ "'. Removed by a SecRuleRemoveByMsg directive.");
}
}
} else {
rule->evaluate(transaction, NULL);
if (transaction->m_it.disruptive == true) {

14
src/rules_exceptions.cc
View File

@ -31,6 +31,14 @@ RulesExceptions::~RulesExceptions() {
}
bool RulesExceptions::loadRemoveRuleByMsg(const std::string &msg,
std::string *error) {
m_remove_rule_by_msg.push_back(msg);
return true;
}
bool RulesExceptions::loadUpdateTargetByTag(const std::string &tag,
std::unique_ptr<std::vector<std::unique_ptr<Variables::Variable> > > var,
std::string *error) {
@ -42,6 +50,7 @@ bool RulesExceptions::loadUpdateTargetByTag(const std::string &tag,
return true;
}
bool RulesExceptions::loadUpdateTargetById(double id,
std::unique_ptr<std::vector<std::unique_ptr<Variables::Variable> > > var,
std::string *error) {
@ -53,6 +62,7 @@ bool RulesExceptions::loadUpdateTargetById(double id,
return true;
}
bool RulesExceptions::load(const std::string &a, std::string *error) {
bool added = false;
std::vector<std::string> toRemove = utils::string::ssplit(a, ' ');
@ -161,6 +171,10 @@ bool RulesExceptions::merge(RulesExceptions& from) {
m_variable_update_target_by_id.emplace(std::pair<double, std::unique_ptr<Variables::Variable>>(p.first, std::move(p.second)));
}
for (auto &p : from.m_remove_rule_by_msg) {
m_remove_rule_by_msg.push_back(p);
}
return true;
}