diff --git a/headers/modsecurity/anchored_variable.h b/headers/modsecurity/anchored_variable.h index b9af800e..202e0caf 100644 --- a/headers/modsecurity/anchored_variable.h +++ b/headers/modsecurity/anchored_variable.h @@ -42,7 +42,7 @@ class Transaction; class AnchoredVariable { public: - AnchoredVariable(Transaction* t, std::__cxx11::string name); + AnchoredVariable(Transaction* t, std::string name); ~AnchoredVariable(); void unset(); diff --git a/headers/modsecurity/rule.h b/headers/modsecurity/rule.h index 9373284f..c4c53269 100644 --- a/headers/modsecurity/rule.h +++ b/headers/modsecurity/rule.h @@ -49,7 +49,7 @@ class Rule { std::vector *_actions, std::string fileName, int lineNumber); - explicit Rule(std::__cxx11::string marker); + explicit Rule(std::string marker); ~Rule(); bool evaluate(Transaction *transaction); diff --git a/headers/modsecurity/rule_message.h b/headers/modsecurity/rule_message.h index 7518b9ba..6d6c5485 100644 --- a/headers/modsecurity/rule_message.h +++ b/headers/modsecurity/rule_message.h @@ -68,7 +68,6 @@ class RuleMessage { int m_maturity; int m_accuracy; std::string m_reference; - std::string m_referenceOp; std::list m_tags; std::list m_server_logs; diff --git a/src/anchored_set_variable.cc b/src/anchored_set_variable.cc index 924d0018..e938aad6 100644 --- a/src/anchored_set_variable.cc +++ b/src/anchored_set_variable.cc @@ -51,12 +51,17 @@ void AnchoredSetVariable::unset() { void AnchoredSetVariable::set(const std::string &key, const std::string &value, size_t offset) { + std::unique_ptr origin(new VariableOrigin()); std::string *v = new std::string(value); std::string *k = new std::string(m_name + ":" + key); - collection::Variable *var = new collection::Variable(k, v); + + origin->m_offset = offset; + origin->m_length = value.size(); + var->m_dynamic_value = true; var->m_dynamic = false; + var->m_orign.push_back(std::move(origin)); emplace(key, var); } diff --git a/src/audit_log/writer/parallel.cc b/src/audit_log/writer/parallel.cc index a1d177c3..3fa6d6fd 100644 --- a/src/audit_log/writer/parallel.cc +++ b/src/audit_log/writer/parallel.cc @@ -21,6 +21,8 @@ #include #include #include +#include +#include #include #include @@ -100,7 +102,6 @@ bool Parallel::init(std::string *error) { bool Parallel::write(Transaction *transaction, int parts, std::string *error) { - FILE *fp; int fd; std::string log = transaction->toJSON(parts); std::string fileName = logFilePath(&transaction->m_timeStamp, @@ -139,9 +140,13 @@ bool Parallel::write(Transaction *transaction, int parts, std::string *error) { + strerror(errno)); return false; } - fp = fdopen(fd, "w"); - fwrite(log.c_str(), log.length(), 1, fp); - fclose(fp); + close(fd); + + std::ofstream myfile; + std::string a(fileName.c_str()); + myfile.open (a); + myfile << log; + myfile.close(); if (m_audit->m_path1.empty() == false && m_audit->m_path2.empty() == false) { diff --git a/src/macro_expansion.h b/src/macro_expansion.h index 23ba22fc..f256929f 100644 --- a/src/macro_expansion.h +++ b/src/macro_expansion.h @@ -13,6 +13,7 @@ * */ + #include #include #include diff --git a/src/operators/pm.cc b/src/operators/pm.cc index a37dc513..4ef75477 100644 --- a/src/operators/pm.cc +++ b/src/operators/pm.cc @@ -90,8 +90,9 @@ bool Pm::evaluate(Transaction *transaction, Rule *rule, bool capture = rule && rule->getActionsByName("capture").size() > 0; if (rc > 0 && transaction) { - logOffset(ruleMessage, rc, input.size()); - transaction->m_matched.push_back(std::string(match)); + std::string match_(match); + logOffset(ruleMessage, rc - match_.size() + 1, match_.size()); + transaction->m_matched.push_back(match_); } if (capture && transaction && rc) { diff --git a/src/rule.cc b/src/rule.cc index 03f78825..6bb0a0ba 100644 --- a/src/rule.cc +++ b/src/rule.cc @@ -505,6 +505,12 @@ std::vector> Rule::getFinalVars( new std::string(*v->m_value))); var->m_dynamic_value = true; var->m_dynamic_key = true; + for (auto &i : v->m_orign) { + std::unique_ptr origin(new VariableOrigin()); + origin->m_offset = i->m_offset; + origin->m_length = i->m_length; + var->m_orign.push_back(std::move(origin)); + } if (v->m_dynamic) { delete v; diff --git a/src/transaction.cc b/src/transaction.cc index 8462750f..f9180415 100644 --- a/src/transaction.cc +++ b/src/transaction.cc @@ -288,13 +288,14 @@ bool Transaction::addArgument(const std::string& orig, const std::string& key, debug(4, "Adding request argument (" + orig + "): name \"" + \ key + "\", value \"" + value + "\""); - m_variableArgs.set(key, value, m_variableOffset); + offset = offset + key.size() + 1; + m_variableArgs.set(key, value, offset); if (orig == "GET") { - m_variableArgsGet.set(key, value, m_variableOffset); + m_variableArgsGet.set(key, value, offset); m_variableArgGetNames.append(key, offset, true); } else if (orig == "POST") { - m_variableArgsPost.set(key, value, m_variableOffset); + m_variableArgsPost.set(key, value, offset); m_variableArgPostNames.append(key, offset, true); } m_variableArgsNames.append(key, offset, true); @@ -379,7 +380,7 @@ int Transaction::processURI(const char *uri, const char *method, path_info.length() - (offset + 1)); m_variableRequestBasename.set(basename, m_variableOffset); } - m_variableRequestMethod.set(method, m_variableOffset); + m_variableRequestMethod.set(method, 0); m_variableRequestProtocol.set("HTTP/" + std::string(http_version), m_variableOffset); @@ -414,6 +415,8 @@ int Transaction::processURI(const char *uri, const char *method, extractArguments("GET", m_variableQueryString.m_value, m_variableQueryString.m_offset); } + + m_variableOffset = m_variableOffset + 1; return true; } @@ -471,7 +474,9 @@ int Transaction::addRequestHeader(const std::string& key, const std::string& value) { m_variableRequestHeadersNames.append(key, 0, true); + m_variableOffset = m_variableOffset + key.size() + 2; m_variableRequestHeaders.set(key, value, m_variableOffset); + m_variableOffset = m_variableOffset + value.size() + 1; std::string keyl = utils::string::tolower(key); @@ -1427,6 +1432,7 @@ std::string Transaction::toJSON(int parts) { const unsigned char *buf; size_t len; yajl_gen g; + std::string log; std::string ts = utils::string::ascTime(&m_timeStamp).c_str(); std::string uniqueId = UniqueId::uniqueId(); @@ -1561,6 +1567,7 @@ std::string Transaction::toJSON(int parts) { strlen("details")); yajl_gen_map_open(g); LOGFY_ADD("match", a.m_match.c_str()); + LOGFY_ADD("reference", a.m_reference.c_str()); LOGFY_ADD("ruleId", std::to_string(a.m_ruleId).c_str()); LOGFY_ADD("file", a.m_ruleFile.c_str()); LOGFY_ADD("lineNumber", std::to_string(a.m_ruleLine).c_str()); @@ -1597,7 +1604,7 @@ std::string Transaction::toJSON(int parts) { yajl_gen_get_buf(g, &buf, &len); - std::string log(reinterpret_cast(buf), len); + log.assign(reinterpret_cast(buf), len); yajl_gen_free(g);