Adds references to the collection variables

headers/modsecurity/anchored_variable.h

@@ -42,7 +42,7 @@ class Transaction;
 
 class AnchoredVariable {
  public:
-    AnchoredVariable(Transaction* t, std::__cxx11::string name);
+    AnchoredVariable(Transaction* t, std::string name);
     ~AnchoredVariable();
 
     void unset();

headers/modsecurity/rule.h

@@ -49,7 +49,7 @@ class Rule {
             std::vector<actions::Action *> *_actions,
             std::string fileName,
             int lineNumber);
-    explicit Rule(std::__cxx11::string marker);
+    explicit Rule(std::string marker);
     ~Rule();
 
     bool evaluate(Transaction *transaction);

headers/modsecurity/rule_message.h

@@ -68,7 +68,6 @@ class RuleMessage {
     int m_maturity;
     int m_accuracy;
     std::string m_reference;
-    std::string m_referenceOp;
 
     std::list<std::string> m_tags;
     std::list<std::string> m_server_logs;

src/anchored_set_variable.cc

@@ -51,12 +51,17 @@ void AnchoredSetVariable::unset() {
 
 void AnchoredSetVariable::set(const std::string &key,
     const std::string &value, size_t offset) {
+    std::unique_ptr<VariableOrigin> origin(new VariableOrigin());
     std::string *v = new std::string(value);
     std::string *k = new std::string(m_name + ":" + key);
-
     collection::Variable *var = new collection::Variable(k, v);
+
+    origin->m_offset = offset;
+    origin->m_length = value.size();
+
     var->m_dynamic_value = true;
     var->m_dynamic = false;
+    var->m_orign.push_back(std::move(origin));
     emplace(key, var);
 }
 

src/audit_log/writer/parallel.cc

@@ -21,6 +21,8 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
+#include <unistd.h>
+#include <stdlib.h>
 
 #include <fstream>
 #include <mutex>
@@ -100,7 +102,6 @@ bool Parallel::init(std::string *error) {
 
 
 bool Parallel::write(Transaction *transaction, int parts, std::string *error) {
-    FILE *fp;
     int fd;
     std::string log = transaction->toJSON(parts);
     std::string fileName = logFilePath(&transaction->m_timeStamp,
@@ -139,9 +140,13 @@ bool Parallel::write(Transaction *transaction, int parts, std::string *error) {
             + strerror(errno));
         return false;
     }
-    fp = fdopen(fd, "w");
+    close(fd);
-    fwrite(log.c_str(), log.length(), 1, fp);
+
-    fclose(fp);
+    std::ofstream myfile;
+    std::string a(fileName.c_str());
+    myfile.open (a);
+    myfile << log;
+    myfile.close();
 
     if (m_audit->m_path1.empty() == false
         && m_audit->m_path2.empty() == false) {

src/macro_expansion.h

@@ -13,6 +13,7 @@
  *
  */
 
+
 #include <ctime>
 #include <iostream>
 #include <string>

src/operators/pm.cc

@@ -90,8 +90,9 @@ bool Pm::evaluate(Transaction *transaction, Rule *rule,
     bool capture = rule && rule->getActionsByName("capture").size() > 0;
 
     if (rc > 0 && transaction) {
-        logOffset(ruleMessage, rc, input.size());
+        std::string match_(match);
-        transaction->m_matched.push_back(std::string(match));
+        logOffset(ruleMessage, rc - match_.size() + 1, match_.size());
+        transaction->m_matched.push_back(match_);
     }
 
     if (capture && transaction && rc) {

src/rule.cc

@@ -505,6 +505,12 @@ std::vector<std::unique_ptr<collection::Variable>> Rule::getFinalVars(
                 new std::string(*v->m_value)));
             var->m_dynamic_value = true;
             var->m_dynamic_key = true;
+            for (auto &i : v->m_orign) {
+                std::unique_ptr<VariableOrigin> origin(new VariableOrigin());
+                origin->m_offset = i->m_offset;
+                origin->m_length = i->m_length;
+                var->m_orign.push_back(std::move(origin));
+            }
 
             if (v->m_dynamic) {
                 delete v;

src/transaction.cc

@@ -288,13 +288,14 @@ bool Transaction::addArgument(const std::string& orig, const std::string& key,
     debug(4, "Adding request argument (" + orig + "): name \"" + \
                 key + "\", value \"" + value + "\"");
 
-    m_variableArgs.set(key, value, m_variableOffset);
+    offset = offset + key.size() + 1;
+    m_variableArgs.set(key, value, offset);
 
     if (orig == "GET") {
-        m_variableArgsGet.set(key, value, m_variableOffset);
+        m_variableArgsGet.set(key, value, offset);
         m_variableArgGetNames.append(key, offset, true);
     } else if (orig == "POST") {
-        m_variableArgsPost.set(key, value, m_variableOffset);
+        m_variableArgsPost.set(key, value, offset);
         m_variableArgPostNames.append(key, offset, true);
     }
     m_variableArgsNames.append(key, offset, true);
@@ -379,7 +380,7 @@ int Transaction::processURI(const char *uri, const char *method,
             path_info.length() - (offset + 1));
         m_variableRequestBasename.set(basename, m_variableOffset);
     }
-    m_variableRequestMethod.set(method, m_variableOffset);
+    m_variableRequestMethod.set(method, 0);
     m_variableRequestProtocol.set("HTTP/" + std::string(http_version),
         m_variableOffset);
 
@@ -414,6 +415,8 @@ int Transaction::processURI(const char *uri, const char *method,
         extractArguments("GET", m_variableQueryString.m_value,
             m_variableQueryString.m_offset);
     }
+
+    m_variableOffset = m_variableOffset + 1;
     return true;
 }
 
@@ -471,7 +474,9 @@ int Transaction::addRequestHeader(const std::string& key,
     const std::string& value) {
     m_variableRequestHeadersNames.append(key, 0, true);
 
+    m_variableOffset = m_variableOffset + key.size() + 2;
     m_variableRequestHeaders.set(key, value, m_variableOffset);
+    m_variableOffset = m_variableOffset + value.size() + 1;
 
 
     std::string keyl = utils::string::tolower(key);
@@ -1427,6 +1432,7 @@ std::string Transaction::toJSON(int parts) {
     const unsigned char *buf;
     size_t len;
     yajl_gen g;
+    std::string log;
     std::string ts = utils::string::ascTime(&m_timeStamp).c_str();
     std::string uniqueId = UniqueId::uniqueId();
 
@@ -1561,6 +1567,7 @@ std::string Transaction::toJSON(int parts) {
                 strlen("details"));
             yajl_gen_map_open(g);
             LOGFY_ADD("match", a.m_match.c_str());
+            LOGFY_ADD("reference", a.m_reference.c_str());
             LOGFY_ADD("ruleId", std::to_string(a.m_ruleId).c_str());
             LOGFY_ADD("file", a.m_ruleFile.c_str());
             LOGFY_ADD("lineNumber", std::to_string(a.m_ruleLine).c_str());
@@ -1597,7 +1604,7 @@ std::string Transaction::toJSON(int parts) {
 
     yajl_gen_get_buf(g, &buf, &len);
 
-    std::string log(reinterpret_cast<const char*>(buf), len);
+    log.assign(reinterpret_cast<const char*>(buf), len);
 
     yajl_gen_free(g);