From eec95cfe1791345b329469fad1771c860dff94c3 Mon Sep 17 00:00:00 2001 From: Felipe Zimmerle Date: Thu, 11 Oct 2018 10:00:54 -0300 Subject: [PATCH] First version of the inline highlight calculation --- .../blocked_request.conf | 2 +- .../blocked_request_engine_on.conf | 2 +- .../reading_logs_via_rule_message/match.conf | 2 +- .../no_match.conf | 2 +- .../reading_logs_via_rule_message.h | 44 +++++++++- .../simple_request.cc | 2 +- headers/modsecurity/modsecurity.h | 2 +- headers/modsecurity/rule_message.h | 37 +++++++++ headers/modsecurity/transaction.h | 1 + src/rule_message.cc | 81 ++++++++++++++++++- src/transaction.cc | 39 +++++++++ 11 files changed, 205 insertions(+), 9 deletions(-) diff --git a/examples/reading_logs_via_rule_message/blocked_request.conf b/examples/reading_logs_via_rule_message/blocked_request.conf index 596b5640..2c2c3a40 100644 --- a/examples/reading_logs_via_rule_message/blocked_request.conf +++ b/examples/reading_logs_via_rule_message/blocked_request.conf @@ -1,3 +1,3 @@ -SecRule ARGS:param1 "test" "id:1,deny,phase:2,chain,msg:'test'" +SecRule ARGS:param1 "test" "id:1,deny,phase:2,t:lowercase,chain,msg:'test'" SecRule ARGS:param1 "test" "log" diff --git a/examples/reading_logs_via_rule_message/blocked_request_engine_on.conf b/examples/reading_logs_via_rule_message/blocked_request_engine_on.conf index af376c89..bc4cf9f4 100644 --- a/examples/reading_logs_via_rule_message/blocked_request_engine_on.conf +++ b/examples/reading_logs_via_rule_message/blocked_request_engine_on.conf @@ -1,2 +1,2 @@ SecRuleEngine On -SecRule ARGS:param1 "test" "id:1,deny" +SecRule ARGS:param1 "test" "id:1,deny,t:lowercase" diff --git a/examples/reading_logs_via_rule_message/match.conf b/examples/reading_logs_via_rule_message/match.conf index 471c484a..fc8d1004 100644 --- a/examples/reading_logs_via_rule_message/match.conf +++ b/examples/reading_logs_via_rule_message/match.conf @@ -1 +1 @@ -SecRule ARGS:param1 "test" "id:1,deny,msg:'this',msg:'is',msg:'a',msg:'test'" +SecRule ARGS:param1 "test" "id:1,deny,msg:'this',t:replaceNulls,msg:'is',msg:'a',msg:'test',t:lowercase,t:trim" diff --git a/examples/reading_logs_via_rule_message/no_match.conf b/examples/reading_logs_via_rule_message/no_match.conf index 51f239fb..db7588a1 100644 --- a/examples/reading_logs_via_rule_message/no_match.conf +++ b/examples/reading_logs_via_rule_message/no_match.conf @@ -1 +1 @@ -SecRule ARGS:param1 "WHEEE" "id:1,phase:2,deny,msg:'this',msg:'is',msg:'a',msg:'test'" +SecRule ARGS:param1 "WHEEE" "id:1,phase:2,deny,msg:'this',msg:'is',msg:'a',msg:'test',t:lower" diff --git a/examples/reading_logs_via_rule_message/reading_logs_via_rule_message.h b/examples/reading_logs_via_rule_message/reading_logs_via_rule_message.h index 52ce11ed..13d1c47e 100644 --- a/examples/reading_logs_via_rule_message/reading_logs_via_rule_message.h +++ b/examples/reading_logs_via_rule_message/reading_logs_via_rule_message.h @@ -163,7 +163,6 @@ class ReadingLogsViaRuleMessage { pthread_join(threads[i], &status); std::cout << "Main: completed thread id :" << i << std::endl; } - delete rules; delete modsec; pthread_exit(NULL); @@ -172,6 +171,38 @@ end: return -1; } + + static std::string highlightToText( + const modsecurity::RuleMessageHighlight &h) { + std::cout << " * ModSecurity variable to be highlighted" << std::endl; + + for (const auto &i : h.m_variable) { + std::cout << " - From: " << std::to_string(i.m_startingAt); + std::cout << " to: " << std::to_string(i.m_startingAt + i.m_size); + std::cout << std::endl; + } + std::cout << std::endl; + + std::cout << " * Variable's values "; + std::cout << "(may include transformations)" << std::endl; + for (const auto &i : h.m_value) { + std::cout << " - " << i.first << ": " << i.second << std::endl; + } + std::cout << std::endl; + + std::cout << " * Operators match to be highlight inside "; + std::cout << "the variables (after transformations)" << std::endl; + + for (const auto &i : h.m_op) { + std::cout << " - From: " << i.m_area.m_startingAt; + std::cout << " to: " << std::to_string(i.m_area.m_startingAt \ + + i.m_area.m_size); + std::cout << " [Value: " << i.m_value << "]" << std::endl; + } + std::cout << std::endl; + return ""; + } + static void logCb(void *data, const void *ruleMessagev) { if (ruleMessagev == NULL) { std::cout << "I've got a call but the message was null ;("; @@ -196,6 +227,17 @@ end: std::cout << modsecurity::RuleMessage::log(ruleMessage); std::cout << std::endl; } + std::cout << std::endl; + std::cout << "Verbose details on the match highlight" << std::endl; + std::cout << " Highlight reference string: "; + std::cout << ruleMessage->m_reference << std::endl; + std::cout << std::endl; + std::cout << "Details:" << std::endl; + modsecurity::RuleMessageHighlight h = + modsecurity::RuleMessage::computeHighlight(ruleMessage, + ruleMessage->m_buf); + highlightToText(h); + std::cout << std::endl; } protected: diff --git a/examples/reading_logs_via_rule_message/simple_request.cc b/examples/reading_logs_via_rule_message/simple_request.cc index 0487abc7..3024faf8 100644 --- a/examples/reading_logs_via_rule_message/simple_request.cc +++ b/examples/reading_logs_via_rule_message/simple_request.cc @@ -32,7 +32,7 @@ int main(int argc, char **argv) { *(argv++); std::string rules(*argv); ReadingLogsViaRuleMessage rlvrm(request_header, request_uri, request_body, - response_headers, response_body, ip, rules); + "", response_body, ip, rules); rlvrm.process(); diff --git a/headers/modsecurity/modsecurity.h b/headers/modsecurity/modsecurity.h index 8fa9e593..5ae31033 100644 --- a/headers/modsecurity/modsecurity.h +++ b/headers/modsecurity/modsecurity.h @@ -301,12 +301,12 @@ class ModSecurity { collection::Collection *m_ip_collection; collection::Collection *m_session_collection; collection::Collection *m_user_collection; + int m_logProperties; private: std::string m_connector; std::string m_whoami; ModSecLogCb m_logCb; - int m_logProperties; }; diff --git a/headers/modsecurity/rule_message.h b/headers/modsecurity/rule_message.h index 2362a607..8a8c60c6 100644 --- a/headers/modsecurity/rule_message.h +++ b/headers/modsecurity/rule_message.h @@ -24,6 +24,11 @@ #ifndef HEADERS_MODSECURITY_RULE_MESSAGE_H_ #define HEADERS_MODSECURITY_RULE_MESSAGE_H_ +#ifdef __cplusplus +#include +#endif + +#include "modsecurity/modsecurity.h" #include "modsecurity/transaction.h" #include "modsecurity/rule.h" @@ -32,6 +37,31 @@ namespace modsecurity { +class RuleMessageHighlightArea { + public: + RuleMessageHighlightArea() + : m_startingAt(0), + m_size(0) { } + size_t m_startingAt; + size_t m_size; +}; + + +class RuleMessageHighlightOperator { + public: + RuleMessageHighlightOperator() + : m_value("") { } + RuleMessageHighlightArea m_area; + std::string m_value; +}; + + +class RuleMessageHighlight { + public: + std::list m_variable; + std::list> m_value; + std::list m_op; +}; class RuleMessage { @@ -88,10 +118,14 @@ class RuleMessage { return RuleMessage::log(rm, 0); } + static RuleMessageHighlight computeHighlight(const RuleMessage *rm, + const std::string buf); + static std::string _details(const RuleMessage *rm); static std::string _errorLogTail(const RuleMessage *rm); int m_accuracy; + std::string m_buf; std::string m_clientIpAddress; std::string m_data; std::string m_id; @@ -100,6 +134,7 @@ class RuleMessage { int m_maturity; std::string m_message; bool m_noAuditLog; + std::string m_opValue; int m_phase; std::string m_reference; std::string m_rev; @@ -111,9 +146,11 @@ class RuleMessage { std::string m_serverIpAddress; int m_severity; std::string m_uriNoQueryStringDecoded; + std::string m_varValue; std::string m_ver; std::list m_tags; + RuleMessageHighlight m_highlight; }; diff --git a/headers/modsecurity/transaction.h b/headers/modsecurity/transaction.h index cd57c052..5d00c1cf 100644 --- a/headers/modsecurity/transaction.h +++ b/headers/modsecurity/transaction.h @@ -343,6 +343,7 @@ class Transaction : public TransactionAnchoredVariables { int getRuleEngineState(); std::string toJSON(int parts); + std::string toBuf(); std::string toOldAuditLogFormat(int parts, const std::string &trailer); std::string toOldAuditLogFormatIndex(const std::string &filename, double size, const std::string &md5); diff --git a/src/rule_message.cc b/src/rule_message.cc index aab92180..8dfaede2 100644 --- a/src/rule_message.cc +++ b/src/rule_message.cc @@ -20,10 +20,12 @@ #include "modsecurity/modsecurity.h" #include "modsecurity/transaction.h" #include "src/utils/string.h" +#include "src/utils/regex.h" +#include "modsecurity/actions/action.h" +#include "src/actions/transformations/transformation.h" namespace modsecurity { - std::string RuleMessage::_details(const RuleMessage *rm) { std::string msg; @@ -61,7 +63,6 @@ std::string RuleMessage::_errorLogTail(const RuleMessage *rm) { return msg; } - std::string RuleMessage::log(const RuleMessage *rm, int props, int code) { std::string msg(""); @@ -93,4 +94,80 @@ std::string RuleMessage::log(const RuleMessage *rm, int props, int code) { } +RuleMessageHighlight RuleMessage::computeHighlight(const RuleMessage *rm, + const std::string buf) { + RuleMessageHighlight ret; + Utils::Regex variables("v([0-9]+),([0-9]+)"); + Utils::Regex operators("o([0-9]+),([0-9]+)"); + Utils::Regex transformations("t:(?:(?!t:).)+"); + + std::string ref(rm->m_reference); + std::list vars = variables.searchAll(ref); + std::list ops = operators.searchAll(ref); + std::list trans = transformations.searchAll(ref); + + std::string varValue; + + while (vars.size() > 0) { + std::string value; + RuleMessageHighlightArea a; + vars.pop_back(); + std::string startingAt = vars.back().match; + vars.pop_back(); + std::string size = vars.back().match; + vars.pop_back(); + a.m_startingAt = std::stoi(startingAt); + a.m_size = std::stoi(size); + ret.m_variable.push_back(a); + + if ((stoi(startingAt) + stoi(size)) > buf.size()) { + return ret; + } + + value = std::string(buf, stoi(startingAt), stoi(size)); + if (varValue.size() > 0) { + varValue.append(" " + value); + } else { + varValue.append(value); + } + } + + ret.m_value.push_back(std::make_pair("original value", varValue)); + while (trans.size() > 0) { + modsecurity::actions::transformations::Transformation *t; + std::string varValueRes; + std::string transformation = trans.back().match.c_str(); + t = actions::transformations::Transformation::instantiate( + transformation); + + varValueRes = t->evaluate(varValue, NULL); + varValue.assign(varValueRes); + ret.m_value.push_back(std::make_pair(transformation, varValue)); + trans.pop_back(); + delete t; + } + + while (ops.size() > 0) { + RuleMessageHighlightOperator o; + ops.pop_back(); + std::string startingAt = ops.back().match; + ops.pop_back(); + std::string size = ops.back().match; + ops.pop_back(); + + if ((stoi(startingAt) + stoi(size)) > buf.size()) { + return ret; + } + + o.m_area.m_startingAt = std::stoi(startingAt); + o.m_area.m_size = std::stoi(size); + o.m_value.assign(std::string(varValue, o.m_area.m_startingAt, + o.m_area.m_size)); + ret.m_op.push_back(o); + } + + return ret; +} + + } // namespace modsecurity diff --git a/src/transaction.cc b/src/transaction.cc index 09777ce2..fbf3e7ef 100644 --- a/src/transaction.cc +++ b/src/transaction.cc @@ -1584,6 +1584,45 @@ std::string Transaction::toOldAuditLogFormat(int parts, } +std::string Transaction::toBuf() { + std::string a; + + a.append(*m_variableRequestMethod.evaluate()); + a.append(" "); + a.append(m_uri); + a.append(" HTTP/"); + a.append(m_httpVersion); + a.append("\n"); + std::vector l; + m_variableRequestHeaders.resolve(&l); + for (auto h : l) { + size_t pos = strlen("REQUEST_HEADERS:"); + a.append((h->m_key.c_str() + pos)); + a.append(": "); + a.append((h->m_value.c_str())); + } + + a.append("\n\n"); + if (this->m_requestBody.str().length() > 0) { + a.append(this->m_requestBody.str().c_str()); + a.append("\n\n"); + } +#if 0 + l.clear(); + m_variableResponseHeaders.resolve(&l); + for (auto h : l) { + size_t pos = strlen("RESPONSE_HEADERS:"); + a.append((h->m_key->c_str() + pos)); + a.append(": "); + a.append((h->m_value->c_str())); + } + a.append("\n\n"); + a.append(this->m_responseBody.str().c_str()); +#endif + return a; +} + + std::string Transaction::toJSON(int parts) { #ifdef WITH_YAJL const unsigned char *buf;