Extends the direct access model to other collections

src/variables/args.h

@@ -0,0 +1,82 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include <iostream>
+#include <string>
+#include <vector>
+#include <list>
+#include <utility>
+
+#ifndef SRC_VARIABLES_ARGS_H_
+#define SRC_VARIABLES_ARGS_H_
+
+#include "src/variables/variable.h"
+
+namespace modsecurity {
+
+class Transaction;
+namespace Variables {
+
+class Args_DictElement : public Variable {
+ public:
+    Args_DictElement(std::string dictElement)
+        : Variable("ARGS" + std::string(":") + std::string(dictElement)),
+        m_dictElement(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableArgs.resolve(m_dictElement, l);
+    }
+
+    std::string m_dictElement;
+};
+
+
+class Args_NoDictElement : public Variable {
+ public:
+    Args_NoDictElement()
+        : Variable("ARGS") { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableArgs.resolve(l);
+    }
+};
+
+
+class Args_DictElementRegexp : public Variable {
+ public:
+    Args_DictElementRegexp(std::string dictElement)
+        : Variable("ARGS:regex(" + dictElement + ")"),
+        m_r(dictElement) {
+    }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_variableArgs.resolveRegularExpression(&m_r, l);
+    }
+
+    Utils::Regex m_r;
+};
+
+
+}  // namespace Variables
+}  // namespace modsecurity
+
+#endif  // SRC_VARIABLES_ARGS_H_
+

src/variables/args_combined_size.h

@@ -34,7 +34,8 @@ class ArgsCombinedSize : public Variable {
     ArgsCombinedSize()
         : Variable("ARGS_COMBINED_SIZE") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableARGScombinedSize.evaluate(l);
     }

src/variables/args_get.h

@@ -0,0 +1,81 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include <iostream>
+#include <string>
+#include <vector>
+#include <list>
+#include <utility>
+
+#ifndef SRC_VARIABLES_ARGS_GET_H_
+#define SRC_VARIABLES_ARGS_GET_H_
+
+#include "src/variables/variable.h"
+
+namespace modsecurity {
+
+class Transaction;
+namespace Variables {
+
+class ArgsGet_DictElement : public Variable {
+ public:
+    ArgsGet_DictElement(std::string dictElement)
+        : Variable("ARGS_GET" + std::string(":") + std::string(dictElement)),
+        m_dictElement(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableArgsGet.resolve(m_dictElement, l);
+    }
+
+    std::string m_dictElement;
+};
+
+
+class ArgsGet_NoDictElement : public Variable {
+ public:
+    ArgsGet_NoDictElement()
+        : Variable("ARGS_GET") { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableArgsGet.resolve(l);
+    }
+};
+
+
+class ArgsGet_DictElementRegexp : public Variable {
+ public:
+    ArgsGet_DictElementRegexp(std::string dictElement)
+        : Variable("ARGS_GET"),
+        m_r(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_variableArgsGet.resolveRegularExpression(&m_r, l);
+    }
+
+    Utils::Regex m_r;
+};
+
+
+}  // namespace Variables
+}  // namespace modsecurity
+
+#endif  // SRC_VARIABLES_ARGS_GET_H_
+

src/variables/args_get_names.h

@@ -34,7 +34,8 @@ class ArgsGetNames : public Variable {
     ArgsGetNames()
         : Variable("ARGS_GET_NAMES") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableArgGetNames.evaluate(l);
     }

src/variables/args_names.h

@@ -34,7 +34,8 @@ class ArgsNames : public Variable {
     ArgsNames()
         : Variable("ARGS_NAMES") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableArgsNames.evaluate(l);
     }

src/variables/args_post.h

@@ -0,0 +1,81 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include <iostream>
+#include <string>
+#include <vector>
+#include <list>
+#include <utility>
+
+#ifndef SRC_VARIABLES_ARGS_POST_H_
+#define SRC_VARIABLES_ARGS_POST_H_
+
+#include "src/variables/variable.h"
+
+namespace modsecurity {
+
+class Transaction;
+namespace Variables {
+
+class ArgsPost_DictElement : public Variable {
+ public:
+    ArgsPost_DictElement(std::string dictElement)
+        : Variable("ARGS_POST" + std::string(":") + std::string(dictElement)),
+        m_dictElement(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableArgsPost.resolve(m_dictElement, l);
+    }
+
+    std::string m_dictElement;
+};
+
+
+class ArgsPost_NoDictElement : public Variable {
+ public:
+    ArgsPost_NoDictElement()
+        : Variable("ARGS_POST") { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableArgsPost.resolve(l);
+    }
+};
+
+
+class ArgsPost_DictElementRegexp : public Variable {
+ public:
+    ArgsPost_DictElementRegexp(std::string dictElement)
+        : Variable("ARGS_POST"),
+        m_r(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_variableArgsPost.resolveRegularExpression(&m_r, l);
+    }
+
+    Utils::Regex m_r;
+};
+
+
+}  // namespace Variables
+}  // namespace modsecurity
+
+#endif  // SRC_VARIABLES_ARGS_POST_H_
+

src/variables/args_post_names.h

@@ -34,7 +34,8 @@ class ArgsPostNames : public Variable {
     ArgsPostNames()
         : Variable("ARGS_POST_NAMES") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableArgPostNames.evaluate(l);
     }

src/variables/auth_type.h

@@ -34,7 +34,8 @@ class AuthType : public Variable {
     AuthType()
         : Variable("AUTH_TYPE") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableAuthType.evaluate(l);
     }

src/variables/duration.cc

@@ -27,8 +27,9 @@
 namespace modsecurity {
 namespace Variables {
 
-void Duration::evaluateInternal(Transaction *transaction,
-        std::vector<const collection::Variable *> *l) {
+void Duration::evaluate(Transaction *transaction,
+    Rule *rule,
+    std::vector<const collection::Variable *> *l) {
     double e = utils::cpu_seconds() - transaction->m_creationTimeStamp;
 
     transaction->m_variableDuration.assign(std::to_string(e));

src/variables/duration.h

@@ -34,7 +34,8 @@ class Duration : public Variable {
         : Variable(_name),
         m_retName("DURATION") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) override;
     std::string m_retName;
 };

src/variables/env.cc

@@ -32,7 +32,8 @@ extern char **environ;
 namespace modsecurity {
 namespace Variables {
 
-void Env::evaluateInternal(Transaction *transaction,
+void Env::evaluate(Transaction *transaction,
+    Rule *rule,
     std::vector<const collection::Variable *> *l) {
     for (char **current = environ; *current; current++) {
         std::string env = std::string(*current);

src/variables/env.h

@@ -33,7 +33,8 @@ class Env : public Variable {
     explicit Env(std::string _name)
         : Variable(_name) { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) override;
 };
 

src/variables/files.h

@@ -0,0 +1,83 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include <iostream>
+#include <string>
+#include <vector>
+#include <list>
+#include <utility>
+
+#ifndef SRC_VARIABLES_FILES_H_
+#define SRC_VARIABLES_FILES_H_
+
+#include "src/variables/variable.h"
+
+namespace modsecurity {
+
+class Transaction;
+namespace Variables {
+
+class Files_DictElement : public Variable {
+ public:
+    Files_DictElement(std::string dictElement)
+        : Variable("FILES" + std::string(":") +
+            std::string(dictElement)),
+        m_dictElement(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableFiles.resolve(m_dictElement, l);
+    }
+
+    std::string m_dictElement;
+};
+
+
+class Files_NoDictElement : public Variable {
+ public:
+    Files_NoDictElement()
+        : Variable("FILES") { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableFiles.resolve(l);
+    }
+};
+
+
+class Files_DictElementRegexp : public Variable {
+ public:
+    Files_DictElementRegexp(std::string dictElement)
+        : Variable("FILES"),
+        m_r(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_variableFiles.resolveRegularExpression(
+            &m_r, l);
+    }
+
+    Utils::Regex m_r;
+};
+
+
+}  // namespace Variables
+}  // namespace modsecurity
+
+#endif  // SRC_VARIABLES_FILES_H_
+

src/variables/files_combined_size.h

@@ -34,7 +34,8 @@ class FilesCombinedSize : public Variable {
     FilesCombinedSize()
         : Variable("FILES_COMBINED_SIZE") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableFilesCombinedSize.evaluate(l);
     }

src/variables/files_names.h

@@ -0,0 +1,84 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include <iostream>
+#include <string>
+#include <vector>
+#include <list>
+#include <utility>
+
+#ifndef SRC_VARIABLES_FILES_NAMES_H_
+#define SRC_VARIABLES_FILES_NAMES_H_
+
+#include "src/variables/variable.h"
+
+namespace modsecurity {
+
+class Transaction;
+namespace Variables {
+
+class FilesNames_DictElement : public Variable {
+ public:
+    FilesNames_DictElement(std::string dictElement)
+        : Variable("FILES_NAMES" + std::string(":") +
+            std::string(dictElement)),
+        m_dictElement(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableFilesNames.resolve(m_dictElement, l);
+    }
+
+    std::string m_dictElement;
+};
+
+
+class FilesNames_NoDictElement : public Variable {
+ public:
+    FilesNames_NoDictElement()
+        : Variable("FILES_NAMES") { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableFilesNames.resolve(l);
+    }
+};
+
+
+class FilesNames_DictElementRegexp : public Variable {
+ public:
+    FilesNames_DictElementRegexp(std::string dictElement)
+        : Variable("FILES_NAMES"), 
+        m_r(dictElement) { }
+
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_variableFilesNames.resolveRegularExpression(
+            &m_r, l);
+    }
+
+    Utils::Regex m_r;
+};
+
+
+}  // namespace Variables
+}  // namespace modsecurity
+
+#endif  // SRC_VARIABLES_FILES_NAMES_H_
+

src/variables/files_sizes.h

@@ -0,0 +1,83 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include <iostream>
+#include <string>
+#include <vector>
+#include <list>
+#include <utility>
+
+#ifndef SRC_VARIABLES_FILES_SIZES_H_
+#define SRC_VARIABLES_FILES_SIZES_H_
+
+#include "src/variables/variable.h"
+
+namespace modsecurity {
+
+class Transaction;
+namespace Variables {
+
+class FilesSizes_DictElement : public Variable {
+ public:
+    FilesSizes_DictElement(std::string dictElement)
+        : Variable("FILES_SIZES" + std::string(":") +
+            std::string(dictElement)),
+        m_dictElement(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableFilesSizes.resolve(m_dictElement, l);
+    }
+
+    std::string m_dictElement;
+};
+
+
+class FilesSizes_NoDictElement : public Variable {
+ public:
+    FilesSizes_NoDictElement()
+        : Variable("FILES_SIZES") { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableFilesSizes.resolve(l);
+    }
+};
+
+
+class FilesSizes_DictElementRegexp : public Variable {
+ public:
+    FilesSizes_DictElementRegexp(std::string dictElement)
+        : Variable("FILES_SIZES"),
+        m_r(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_variableFilesSizes.resolveRegularExpression(
+            &m_r, l);
+    }
+
+    Utils::Regex m_r;
+};
+
+
+}  // namespace Variables
+}  // namespace modsecurity
+
+#endif  // SRC_VARIABLES_FILES_SIZES_H_
+

src/variables/files_tmp_content.h

@@ -0,0 +1,83 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include <iostream>
+#include <string>
+#include <vector>
+#include <list>
+#include <utility>
+
+#ifndef SRC_VARIABLES_FILES_TMP_CONTENT_H_
+#define SRC_VARIABLES_FILES_TMP_CONTENT_H_
+
+#include "src/variables/variable.h"
+
+namespace modsecurity {
+
+class Transaction;
+namespace Variables {
+
+class FilesTmpContent_DictElement : public Variable {
+ public:
+    FilesTmpContent_DictElement(std::string dictElement)
+        : Variable("FILES_TMP_CONTENT" + std::string(":") +
+            std::string(dictElement)),
+        m_dictElement(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableFilesTmpContent.resolve(m_dictElement, l);
+    }
+
+    std::string m_dictElement;
+};
+
+
+class FilesTmpContent_NoDictElement : public Variable {
+ public:
+    FilesTmpContent_NoDictElement()
+        : Variable("FILES_TMP_CONTENT") { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableFilesTmpContent.resolve(l);
+    }
+};
+
+
+class FilesTmpContent_DictElementRegexp : public Variable {
+ public:
+    FilesTmpContent_DictElementRegexp(std::string dictElement)
+        : Variable("FILES_TMP_CONTENT"),
+        m_r(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_variableFilesTmpContent.resolveRegularExpression(
+            &m_r, l);
+    }
+
+    Utils::Regex m_r;
+};
+
+
+}  // namespace Variables
+}  // namespace modsecurity
+
+#endif  // SRC_VARIABLES_FILES_TMP_CONTENT_H_
+

src/variables/files_tmp_names.h

@@ -28,18 +28,53 @@ namespace modsecurity {
 
 class Transaction;
 namespace Variables {
-
-class FilesTmpNames : public Variable {
+class FilesTmpNames_DictElement : public Variable {
  public:
-    FilesTmpNames()
+    FilesTmpNames_DictElement(std::string dictElement)
+        : Variable("FILES_TMPNAMES" + std::string(":") +
+            std::string(dictElement)),
+        m_dictElement(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableFilesTmpNames.resolve(m_dictElement, l);
+    }
+
+    std::string m_dictElement;
+};
+
+
+class FilesTmpNames_NoDictElement : public Variable {
+ public:
+    FilesTmpNames_NoDictElement()
         : Variable("FILES_TMPNAMES") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
-        transaction->m_variableFilesTmpNames.evaluate(l);
+        transaction->m_variableFilesTmpNames.resolve(l);
     }
 };
 
+
+class FilesTmpNames_DictElementRegexp : public Variable {
+ public:
+    FilesTmpNames_DictElementRegexp(std::string dictElement)
+        : Variable("FILES_TMPNAMES"),
+        m_r(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_variableFilesTmpNames.resolveRegularExpression(
+            &m_r, l);
+    }
+
+    Utils::Regex m_r;
+};
+
+
 }  // namespace Variables
 }  // namespace modsecurity
 

src/variables/full_request.h

@@ -34,7 +34,8 @@ class FullRequest : public Variable {
     FullRequest()
         : Variable("FULL_REQUEST") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableFullRequest.evaluate(l);
     }

src/variables/full_request_length.h

@@ -34,7 +34,8 @@ class FullRequestLength : public Variable {
     FullRequestLength()
         : Variable("FULL_REQUEST_LENGTH") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableFullRequestLength.evaluate(l);
     }

src/variables/geo.h

@@ -0,0 +1,83 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include <iostream>
+#include <string>
+#include <vector>
+#include <list>
+#include <utility>
+
+#ifndef SRC_VARIABLES_GEO_H_
+#define SRC_VARIABLES_GEO_H_
+
+#include "src/variables/variable.h"
+
+namespace modsecurity {
+
+class Transaction;
+namespace Variables {
+
+class Geo_DictElement : public Variable {
+ public:
+    Geo_DictElement(std::string dictElement)
+        : Variable("GEO" + std::string(":") +
+            std::string(dictElement)),
+        m_dictElement(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableGeo.resolve(m_dictElement, l);
+    }
+
+    std::string m_dictElement;
+};
+
+
+class Geo_NoDictElement : public Variable {
+ public:
+    Geo_NoDictElement()
+        : Variable("GEO") { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableGeo.resolve(l);
+    }
+};
+
+
+class Geo_DictElementRegexp : public Variable {
+ public:
+    Geo_DictElementRegexp(std::string dictElement)
+        : Variable("GEO"),
+        m_r(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_variableGeo.resolveRegularExpression(
+            &m_r, l);
+    }
+
+    Utils::Regex m_r;
+};
+
+
+}  // namespace Variables
+}  // namespace modsecurity
+
+#endif  // SRC_VARIABLES_GEO_H_
+

src/variables/global.h

@@ -0,0 +1,84 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include <iostream>
+#include <string>
+#include <vector>
+#include <list>
+#include <utility>
+
+#ifndef SRC_VARIABLES_GLOBAL_H_
+#define SRC_VARIABLES_GLOBAL_H_
+
+#include "src/variables/variable.h"
+
+namespace modsecurity {
+
+class Transaction;
+namespace Variables {
+
+
+class Global_DictElement : public Variable {
+ public:
+    explicit Global_DictElement(std::string dictElement)
+        : Variable("GLOBAL"),
+        m_dictElement("GLOBAL:" + dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_collections.resolveMultiMatches(m_dictElement, "GLOBAL", l);
+    }
+
+    std::string m_dictElement;
+};
+
+
+class Global_NoDictElement : public Variable {
+ public:
+    explicit Global_NoDictElement()
+        : Variable("GLOBAL") { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_collections.resolveMultiMatches(m_name, "GLOBAL", l);
+    }
+};
+
+
+class Global_DictElementRegexp : public Variable {
+ public:
+    Global_DictElementRegexp(std::string dictElement)
+        : Variable("GLOBAL"),
+        m_r(dictElement),
+        m_dictElement("GLOBAL:" + dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_collections.resolveRegularExpression(m_dictElement,
+            "GLOBAL", l);
+    }
+
+    Utils::Regex m_r;
+    std::string m_dictElement;
+};
+
+
+}  // namespace Variables
+}  // namespace modsecurity
+
+#endif  // SRC_VARIABLES_GLOBAL_H_

src/variables/highest_severity.cc

@@ -26,7 +26,8 @@
 namespace modsecurity {
 namespace Variables {
 
-void HighestSeverity::evaluateInternal(Transaction *transaction,
+void HighestSeverity::evaluate(Transaction *transaction,
+    Rule *rule,
     std::vector<const collection::Variable *> *l) {
     transaction->m_variableHighestSeverityAction.assign(
         std::to_string(transaction->m_highestSeverityAction));

src/variables/highest_severity.h

@@ -34,7 +34,8 @@ class HighestSeverity : public Variable {
         : Variable(_name),
         m_retName("HIGHEST_SEVERITY") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) override;
     std::string m_retName;
 };

src/variables/inbound_data_error.h

@@ -34,7 +34,8 @@ class InboundDataError : public Variable {
     InboundDataError()
         : Variable("INBOUND_DATA_ERROR") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableInboundDataError.evaluate(l);
     }

src/variables/ip.h

@@ -0,0 +1,84 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include <iostream>
+#include <string>
+#include <vector>
+#include <list>
+#include <utility>
+
+#ifndef SRC_VARIABLES_IP_H_
+#define SRC_VARIABLES_IP_H_
+
+#include "src/variables/variable.h"
+
+namespace modsecurity {
+
+class Transaction;
+namespace Variables {
+
+
+class Ip_DictElement : public Variable {
+ public:
+    explicit Ip_DictElement(std::string dictElement)
+        : Variable("IP"),
+        m_dictElement("IP:" + dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_collections.resolveMultiMatches(m_dictElement, "IP", l);
+    }
+
+    std::string m_dictElement;
+};
+
+
+class Ip_NoDictElement : public Variable {
+ public:
+    explicit Ip_NoDictElement()
+        : Variable("IP") { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_collections.resolveMultiMatches(m_name, "IP", l);
+    }
+};
+
+
+class Ip_DictElementRegexp : public Variable {
+ public:
+    Ip_DictElementRegexp(std::string dictElement)
+        : Variable("IP"),
+        m_r(dictElement),
+        m_dictElement("IP:" + dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_collections.resolveRegularExpression(m_dictElement,
+            "IP", l);
+    }
+
+    Utils::Regex m_r;
+    std::string m_dictElement;
+};
+
+
+}  // namespace Variables
+}  // namespace modsecurity
+
+#endif  // SRC_VARIABLES_IP_H_

src/variables/matched_var.h

@@ -34,7 +34,8 @@ class MatchedVar : public Variable {
     MatchedVar()
         : Variable("MATCHED_VAR") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableMatchedVar.evaluate(l);
     }

src/variables/matched_var_name.h

@@ -34,7 +34,8 @@ class MatchedVarName : public Variable {
     MatchedVarName()
         : Variable("MATCHED_VAR_NAME") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableMatchedVarName.evaluate(l);
     }

src/variables/matched_vars.h

@@ -0,0 +1,83 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include <iostream>
+#include <string>
+#include <vector>
+#include <list>
+#include <utility>
+
+#ifndef SRC_VARIABLES_MATCHED_VARS_H_
+#define SRC_VARIABLES_MATCHED_VARS_H_
+
+#include "src/variables/variable.h"
+
+namespace modsecurity {
+
+class Transaction;
+namespace Variables {
+
+class MatchedVars_DictElement : public Variable {
+ public:
+    MatchedVars_DictElement(std::string dictElement)
+        : Variable("MATCHED_VARS" + std::string(":") +
+            std::string(dictElement)),
+        m_dictElement(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableMatchedVars.resolve(m_dictElement, l);
+    }
+
+    std::string m_dictElement;
+};
+
+
+class MatchedVars_NoDictElement : public Variable {
+ public:
+    MatchedVars_NoDictElement()
+        : Variable("MATCHED_VARS") { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableMatchedVars.resolve(l);
+    }
+};
+
+
+class MatchedVars_DictElementRegexp : public Variable {
+ public:
+    MatchedVars_DictElementRegexp(std::string dictElement)
+        : Variable("MATCHED_VARS"),
+        m_r(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_variableMatchedVars.resolveRegularExpression(
+            &m_r, l);
+    }
+
+    Utils::Regex m_r;
+};
+
+
+}  // namespace Variables
+}  // namespace modsecurity
+
+#endif  // SRC_VARIABLES_MATCHED_VARS_H_
+

src/variables/matched_vars_names.h

@@ -0,0 +1,83 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include <iostream>
+#include <string>
+#include <vector>
+#include <list>
+#include <utility>
+
+#ifndef SRC_VARIABLES_MATCHED_VARS_NAMES_H_
+#define SRC_VARIABLES_MATCHED_VARS_NAMES_H_
+
+#include "src/variables/variable.h"
+
+namespace modsecurity {
+
+class Transaction;
+namespace Variables {
+
+class MatchedVarsNames_DictElement : public Variable {
+ public:
+    MatchedVarsNames_DictElement(std::string dictElement)
+        : Variable("MATCHED_VARS_NAMES" + std::string(":") +
+            std::string(dictElement)),
+        m_dictElement(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableMatchedVarsNames.resolve(m_dictElement, l);
+    }
+
+    std::string m_dictElement;
+};
+
+
+class MatchedVarsNames_NoDictElement : public Variable {
+ public:
+    MatchedVarsNames_NoDictElement()
+        : Variable("MATCHED_VARS_NAMES") { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableMatchedVarsNames.resolve(l);
+    }
+};
+
+
+class MatchedVarsNames_DictElementRegexp : public Variable {
+ public:
+    MatchedVarsNames_DictElementRegexp(std::string dictElement)
+        : Variable("MATCHED_VARS_NAMES"),
+        m_r(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableMatchedVarsNames.resolveRegularExpression(
+            &m_r, l);
+    }
+
+     Utils::Regex m_r;
+};
+
+
+}  // namespace Variables
+}  // namespace modsecurity
+
+#endif  // SRC_VARIABLES_MATCHED_VARS_NAMES_H_
+

src/variables/modsec_build.cc

@@ -24,7 +24,8 @@
 namespace modsecurity {
 namespace Variables {
 
-void ModsecBuild::evaluateInternal(Transaction *transaction,
+void ModsecBuild::evaluate(Transaction *transaction,
+    Rule *rule,
     std::vector<const collection::Variable *> *l) {
 
     l->push_back(new collection::Variable(&m_retName, &m_build));

src/variables/modsec_build.h

@@ -43,7 +43,8 @@ class ModsecBuild : public Variable {
         m_build = ss.str();
     }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) override;
 
     std::string m_build;

src/variables/multipart_crlf_lf_lines.h

@@ -34,7 +34,8 @@ class MultipartCrlfLFLines : public Variable {
     MultipartCrlfLFLines()
         : Variable("MULTIPART_CRLF_LF_LINES") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableMultipartCrlfLFLines.evaluate(l);
     }

src/variables/multipart_data_after.h

@@ -34,7 +34,8 @@ class MultipartDateAfter : public Variable {
     MultipartDateAfter()
         : Variable("MULTIPART_DATA_AFTER") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableMultipartDataAfter.evaluate(l);
     }

src/variables/multipart_file_limit_exceeded.h

@@ -34,7 +34,8 @@ class MultipartFileLimitExceeded : public Variable {
     MultipartFileLimitExceeded()
         : Variable("MULTIPART_FILE_LIMIT_EXCEEDED") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableMultipartFileLimitExceeded.evaluate(l);
     }

src/variables/multipart_file_name.h

@@ -0,0 +1,83 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include <iostream>
+#include <string>
+#include <vector>
+#include <list>
+#include <utility>
+
+#ifndef SRC_VARIABLES_MULTIPART_FILENAME_H_
+#define SRC_VARIABLES_MULTIPART_FILENAME_H_
+
+#include "src/variables/variable.h"
+
+namespace modsecurity {
+
+class Transaction;
+namespace Variables {
+
+class MultiPartFileName_DictElement : public Variable {
+ public:
+    MultiPartFileName_DictElement(std::string dictElement)
+        : Variable("MULTIPART_FILENAME" + std::string(":") +
+            std::string(dictElement)),
+        m_dictElement(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableMultiPartFileName.resolve(m_dictElement, l);
+    }
+
+    std::string m_dictElement;
+};
+
+
+class MultiPartFileName_NoDictElement : public Variable {
+ public:
+    MultiPartFileName_NoDictElement()
+        : Variable("MULTIPART_FILENAME") { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableMultiPartFileName.resolve(l);
+    }
+};
+
+
+class MultiPartFileName_DictElementRegexp : public Variable {
+ public:
+    MultiPartFileName_DictElementRegexp(std::string dictElement)
+        : Variable("MULTIPART_FILENAME"),
+        m_r(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_variableMultiPartFileName.resolveRegularExpression(
+            &m_r, l);
+    }
+
+    Utils::Regex m_r;
+};
+
+
+}  // namespace Variables
+}  // namespace modsecurity
+
+#endif  // SRC_VARIABLES_MULTIPART_FILENAME_H_
+

src/variables/multipart_header_folding.h

@@ -34,7 +34,8 @@ class MultipartHeaderFolding : public Variable {
     MultipartHeaderFolding()
         : Variable("MULTIPART_HEADER_FOLDING") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableMultipartHeaderFolding.evaluate(l);
     }

src/variables/multipart_invalid_header_folding.h

@@ -34,7 +34,8 @@ class MultipartInvalidHeaderFolding : public Variable {
     MultipartInvalidHeaderFolding()
         : Variable("MULTIPART_INVALID_HEADER_FOLDING") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableMultipartInvalidHeaderFolding.evaluate(l);
     }

src/variables/multipart_invalid_quoting.h

@@ -33,7 +33,8 @@ class MultipartInvalidQuoting : public Variable {
  public:
     MultipartInvalidQuoting()
         : Variable("MULTIPART_INVALID_QUOTING") { }
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableMultipartInvalidQuoting.evaluate(l);
     }

src/variables/multipart_name.h

@@ -0,0 +1,83 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include <iostream>
+#include <string>
+#include <vector>
+#include <list>
+#include <utility>
+
+#ifndef SRC_VARIABLES_MULTIPART_NAME_H_
+#define SRC_VARIABLES_MULTIPART_NAME_H_
+
+#include "src/variables/variable.h"
+
+namespace modsecurity {
+
+class Transaction;
+namespace Variables {
+
+class MultiPartName_DictElement : public Variable {
+ public:
+    MultiPartName_DictElement(std::string dictElement)
+        : Variable("MULTIPART_NAME" + std::string(":") +
+            std::string(dictElement)),
+        m_dictElement(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableMultiPartName.resolve(m_dictElement, l);
+    }
+
+    std::string m_dictElement;
+};
+
+
+class MultiPartName_NoDictElement : public Variable {
+ public:
+    MultiPartName_NoDictElement()
+        : Variable("MULTIPART_NAME") { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableMultiPartName.resolve(l);
+    }
+};
+
+
+class MultiPartName_DictElementRegexp : public Variable {
+ public:
+    MultiPartName_DictElementRegexp(std::string dictElement)
+        : Variable("MULTIPART_NAME"),
+        m_r(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_variableMultiPartName.resolveRegularExpression(
+            &m_r, l);
+    }
+
+    Utils::Regex m_r;
+};
+
+
+}  // namespace Variables
+}  // namespace modsecurity
+
+#endif  // SRC_VARIABLES_MULTIPART_FILENAME_H_
+

src/variables/multipart_strict_error.h

@@ -34,7 +34,8 @@ class MultipartStrictError : public Variable {
     MultipartStrictError()
         : Variable("MULTIPART_STRICT_ERROR") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableMultipartStrictError.evaluate(l);
     }

src/variables/multipart_unmatched_boundary.h

@@ -34,7 +34,8 @@ class MultipartUnmatchedBoundary : public Variable {
     MultipartUnmatchedBoundary()
         : Variable("MULTIPART_UNMATCHED_BOUNDARY") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableMultipartUnmatchedBoundary.evaluate(l);
     }

src/variables/outbound_data_error.h

@@ -34,7 +34,8 @@ class OutboundDataError : public Variable {
     OutboundDataError()
         : Variable("OUTBOUND_DATA_ERROR") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableOutboundDataError.evaluate(l);
     }

src/variables/path_info.h

@@ -34,7 +34,8 @@ class PathInfo : public Variable {
     PathInfo()
         : Variable("PATH_INFO") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variablePathInfo.evaluate(l);
     }

src/variables/query_string.h

@@ -34,7 +34,8 @@ class QueryString : public Variable {
     QueryString()
         : Variable("QUERY_STRING") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableQueryString.evaluate(l);
     }

src/variables/remote_addr.h

@@ -34,7 +34,8 @@ class RemoteAddr : public Variable {
     RemoteAddr()
         : Variable("REMOTE_ADDR") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableRemoteAddr.evaluate(l);
     }

src/variables/remote_host.h

@@ -34,7 +34,8 @@ class RemoteHost : public Variable {
     RemoteHost()
         : Variable("REMOTE_HOST") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableRemoteHost.evaluate(l);
     }

src/variables/remote_port.h

@@ -34,7 +34,8 @@ class RemotePort : public Variable {
     RemotePort()
         : Variable("REMOTE_PORT") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableRemotePort.evaluate(l);
     }

src/variables/remote_user.cc

@@ -35,13 +35,14 @@ namespace modsecurity {
 namespace Variables {
 
 
-void RemoteUser::evaluateInternal(Transaction *transaction,
+void RemoteUser::evaluate(Transaction *transaction,
+    Rule *rule,
     std::vector<const collection::Variable *> *l) {
     size_t pos;
     std::string base64;
 
-    std::string *header = transaction->m_collections.resolveFirst(
-        "REQUEST_HEADERS:Authorization");
+    std::unique_ptr<std::string> header = std::move(transaction->m_variableRequestHeaders.resolveFirst(
+        "Authorization"));
 
     if (header == NULL) {
         return;
@@ -61,6 +62,7 @@ void RemoteUser::evaluateInternal(Transaction *transaction,
 
     l->push_back(new collection::Variable(&m_retName,
         &transaction->m_variableRemoteUser));
+
 }
 
 

src/variables/remote_user.h

@@ -36,7 +36,8 @@ class RemoteUser : public Variable {
         : Variable(_name),
         m_retName("REMOTE_USER") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) override;
     std::string m_retName;
 };

src/variables/reqbody_error.h

@@ -34,7 +34,8 @@ class ReqbodyError : public Variable {
     ReqbodyError()
         : Variable("REQBODY_ERROR") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableReqbodyError.evaluate(l);
     }

src/variables/reqbody_error_msg.h

@@ -33,7 +33,8 @@ class ReqbodyErrorMsg : public Variable {
  public:
     ReqbodyErrorMsg()
         : Variable("REQBODY_ERROR_MSG") { }
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableReqbodyErrorMsg.evaluate(l);
     }

src/variables/reqbody_processor.h

@@ -33,7 +33,8 @@ class ReqbodyProcessor : public Variable {
  public:
     ReqbodyProcessor()
         : Variable("REQBODY_PROCESSOR") { }
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableReqbodyProcessor.evaluate(l);
     }

src/variables/reqbody_processor_error.h

@@ -34,7 +34,8 @@ class ReqbodyProcessorError : public Variable {
     ReqbodyProcessorError()
         : Variable("REQBODY_PROCESSOR_ERROR") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableReqbodyProcessorError.evaluate(l);
     }

src/variables/reqbody_processor_error_msg.h

@@ -34,7 +34,8 @@ class ReqbodyProcessorErrorMsg : public Variable {
     ReqbodyProcessorErrorMsg()
         : Variable("PROCESSOR_ERROR_MSG") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableReqbodyProcessorErrorMsg.evaluate(l);
     }

src/variables/request_base_name.h

@@ -34,7 +34,8 @@ class RequestBasename : public Variable {
     RequestBasename()
         : Variable("REQUEST_BASENAME") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableRequestBasename.evaluate(l);
     }

src/variables/request_body.h

@@ -33,7 +33,8 @@ class RequestBody : public Variable {
  public:
     RequestBody()
         : Variable("REQUEST_BODY") { }
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableRequestBody.evaluate(l);
     }

src/variables/request_body_length.h

@@ -33,7 +33,8 @@ class RequestBodyLength : public Variable {
  public:
     RequestBodyLength()
         : Variable("REQUEST_BODY_LENGTH") { }
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableRequestBodyLength.evaluate(l);
     }

src/variables/request_cookies.h

@@ -0,0 +1,83 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include <iostream>
+#include <string>
+#include <vector>
+#include <list>
+#include <utility>
+
+#ifndef SRC_VARIABLES_REQUEST_COOKIES_H_
+#define SRC_VARIABLES_REQUEST_COOKIES_H_
+
+#include "src/variables/variable.h"
+
+namespace modsecurity {
+
+class Transaction;
+namespace Variables {
+
+class RequestCookies_DictElement : public Variable {
+ public:
+    RequestCookies_DictElement(std::string dictElement)
+        : Variable("REQUEST_COOKIES" + std::string(":") +
+            std::string(dictElement)),
+        m_dictElement(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableRequestCookies.resolve(m_dictElement, l);
+    }
+
+    std::string m_dictElement;
+};
+
+
+class RequestCookies_NoDictElement : public Variable {
+ public:
+    RequestCookies_NoDictElement()
+        : Variable("REQUEST_COOKIES") { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableRequestCookies.resolve(l);
+    }
+};
+
+
+class RequestCookies_DictElementRegexp : public Variable {
+ public:
+    RequestCookies_DictElementRegexp(std::string dictElement)
+        : Variable("REQUEST_COOKIES"),
+        m_r(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableRequestCookies.resolveRegularExpression(
+            &m_r, l);
+    }
+
+    Utils::Regex m_r;
+};
+
+
+}  // namespace Variables
+}  // namespace modsecurity
+
+#endif  // SRC_VARIABLES_REQUEST_COOKIES_H_
+

src/variables/request_cookies_names.h

@@ -0,0 +1,83 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include <iostream>
+#include <string>
+#include <vector>
+#include <list>
+#include <utility>
+
+#ifndef SRC_VARIABLES_REQUEST_COOKIES_NAMES_H_
+#define SRC_VARIABLES_REQUEST_COOKIES_NAMES_H_
+
+#include "src/variables/variable.h"
+
+namespace modsecurity {
+
+class Transaction;
+namespace Variables {
+
+class RequestCookiesNames_DictElement : public Variable {
+ public:
+    RequestCookiesNames_DictElement(std::string dictElement)
+        : Variable("REQUEST_COOKIES_NAMES" + std::string(":") +
+            std::string(dictElement)),
+        m_dictElement(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableRequestCookiesNames.resolve(m_dictElement, l);
+    }
+
+    std::string m_dictElement;
+};
+
+
+class RequestCookiesNames_NoDictElement : public Variable {
+ public:
+    RequestCookiesNames_NoDictElement()
+        : Variable("REQUEST_COOKIES_NAMES") { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableRequestCookiesNames.resolve(l);
+    }
+};
+
+
+class RequestCookiesNames_DictElementRegexp : public Variable {
+ public:
+    RequestCookiesNames_DictElementRegexp(std::string dictElement)
+        : Variable("REQUEST_COOKIES_NAMES"),
+        m_r(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_variableRequestCookiesNames.resolveRegularExpression(
+            &m_r, l);
+    }
+
+    Utils::Regex m_r;
+};
+
+
+}  // namespace Variables
+}  // namespace modsecurity
+
+#endif  // SRC_VARIABLES_REQUEST_COOKIES_NAMES_H_
+

src/variables/request_file_name.h

@@ -33,7 +33,8 @@ class RequestFilename : public Variable {
  public:
     RequestFilename()
         : Variable("REQUEST_FILENAME") { }
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableRequestFilename.evaluate(l);
     }

src/variables/request_headers.h

@@ -0,0 +1,83 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include <iostream>
+#include <string>
+#include <vector>
+#include <list>
+#include <utility>
+
+#ifndef SRC_VARIABLES_REQUEST_HEADERS_H_
+#define SRC_VARIABLES_REQUEST_HEADERS_H_
+
+#include "src/variables/variable.h"
+
+namespace modsecurity {
+
+class Transaction;
+namespace Variables {
+
+class RequestHeaders_DictElement : public Variable {
+ public:
+    RequestHeaders_DictElement(std::string dictElement)
+        : Variable("REQUEST_HEADERS" + std::string(":") +
+            std::string(dictElement)),
+        m_dictElement(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableRequestHeaders.resolve(m_dictElement, l);
+    }
+
+    std::string m_dictElement;
+};
+
+
+class RequestHeaders_NoDictElement : public Variable {
+ public:
+    RequestHeaders_NoDictElement()
+        : Variable("REQUEST_HEADERS") { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableRequestHeaders.resolve(l);
+    }
+};
+
+
+class RequestHeaders_DictElementRegexp : public Variable {
+ public:
+    RequestHeaders_DictElementRegexp(std::string dictElement)
+        : Variable("REQUEST_HEADERS"),
+        m_r(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_variableRequestHeaders.resolveRegularExpression(
+            &m_r, l);
+    }
+
+    Utils::Regex m_r;
+};
+
+
+}  // namespace Variables
+}  // namespace modsecurity
+
+#endif  // SRC_VARIABLES_REQUEST_HEADERS_H_
+

src/variables/request_headers_names.h

@@ -33,7 +33,8 @@ class RequestHeadersNames : public Variable {
  public:
     RequestHeadersNames()
         : Variable("REQUEST_HEADERS_NAMES") { }
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableRequestHeadersNames.evaluate(l);
     }

src/variables/request_line.h

@@ -33,7 +33,8 @@ class RequestLine : public Variable {
  public:
     RequestLine()
         : Variable("REQUEST_LINE") { }
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableRequestLine.evaluate(l);
     }

src/variables/request_method.h

@@ -33,7 +33,8 @@ class RequestMethod : public Variable {
  public:
     RequestMethod()
         : Variable("REQUEST_METHOD") { }
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableRequestMethod.evaluate(l);
     }

src/variables/request_protocol.h

@@ -33,7 +33,8 @@ class RequestProtocol : public Variable {
  public:
     RequestProtocol()
         : Variable("REQUEST_PROTOCOL") { }
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableRequestProtocol.evaluate(l);
     }

src/variables/request_uri.h

@@ -33,7 +33,8 @@ class RequestURI : public Variable {
  public:
     RequestURI()
         : Variable("REQUEST_URI") { }
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableRequestURI.evaluate(l);
     }

src/variables/request_uri_raw.h

@@ -33,7 +33,8 @@ class RequestURIRaw : public Variable {
  public:
     RequestURIRaw()
         : Variable("REQUEST_URI_RAW") { }
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableRequestURIRaw.evaluate(l);
     }

src/variables/resource.h

@@ -34,7 +34,8 @@ class Resource : public Variable {
     Resource()
         : Variable("RESOURCE") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableResource.evaluate(l);
     }

src/variables/response_body.h

@@ -33,7 +33,8 @@ class ResponseBody : public Variable {
  public:
     ResponseBody()
         : Variable("RESPONSE_BODY") { }
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableResponseBody.evaluate(l);
     }

src/variables/response_content_length.h

@@ -33,7 +33,8 @@ class ResponseContentLength : public Variable {
  public:
     ResponseContentLength()
         : Variable("RESPONSE_CONTENT_LENGTH") { }
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableResponseContentLength.evaluate(l);
     }

src/variables/response_content_type.h

@@ -33,7 +33,8 @@ class ResponseContentType : public Variable {
  public:
     ResponseContentType()
         : Variable("RESPONSE_CONTENT_TYPE") { }
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableResponseContentType.evaluate(l);
     }

src/variables/response_headers.h

@@ -0,0 +1,83 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include <iostream>
+#include <string>
+#include <vector>
+#include <list>
+#include <utility>
+
+#ifndef SRC_VARIABLES_RESPONSE_HEADERS_H_
+#define SRC_VARIABLES_RESPONSE_HEADERS_H_
+
+#include "src/variables/variable.h"
+
+namespace modsecurity {
+
+class Transaction;
+namespace Variables {
+
+class ResponseHeaders_DictElement : public Variable {
+ public:
+    ResponseHeaders_DictElement(std::string dictElement)
+        : Variable("RESPONSE_HEADERS" + std::string(":") +
+            std::string(dictElement)),
+        m_dictElement(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableResponseHeaders.resolve(m_dictElement, l);
+    }
+
+    std::string m_dictElement;
+};
+
+
+class ResponseHeaders_NoDictElement : public Variable {
+ public:
+    ResponseHeaders_NoDictElement()
+        : Variable("RESPONSE_HEADERS") { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableResponseHeaders.resolve(l);
+    }
+};
+
+
+class ResponseHeaders_DictElementRegexp : public Variable {
+ public:
+    ResponseHeaders_DictElementRegexp(std::string dictElement)
+        : Variable("RESPONSE_HEADERS"),
+        m_r(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_variableResponseHeaders.resolveRegularExpression(
+            &m_r, l);
+    }
+
+    Utils::Regex m_r;
+};
+
+
+}  // namespace Variables
+}  // namespace modsecurity
+
+#endif  // SRC_VARIABLES_RESPONSE_HEADERS_H_
+

src/variables/response_headers_names.h

@@ -34,7 +34,8 @@ class ResponseHeadersNames : public Variable {
     ResponseHeadersNames()
         : Variable("RESPONSE_HEADERS_NAMES") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableResponseHeadersNames.evaluate(l);
     }

src/variables/response_protocol.h

@@ -33,7 +33,8 @@ class ResponseProtocol : public Variable {
  public:
     ResponseProtocol()
         : Variable("RESPONSE_PROTOCOL") { }
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableResponseProtocol.evaluate(l);
     }

src/variables/response_status.h

@@ -33,7 +33,8 @@ class ResponseStatus : public Variable {
  public:
     ResponseStatus()
         : Variable("RESPONSE_STATUS") { }
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableResponseStatus.evaluate(l);
     }

src/variables/rule.cc

@@ -1,60 +0,0 @@
-/*
- * ModSecurity, http://www.modsecurity.org/
- * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
- *
- * You may not use this file except in compliance with
- * the License.  You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * If any of the files related to licensing are missing or if you have any
- * other questions related to licensing please contact Trustwave Holdings, Inc.
- * directly using the email address security@modsecurity.org.
- *
- */
-
-#include "src/variables/rule.h"
-
-#include <time.h>
-#include <stdio.h>
-#include <string.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <libxml/xmlschemas.h>
-#include <libxml/xpath.h>
-#include <libxml/tree.h>
-#include <libxml/parser.h>
-#include <libxml/xpathInternals.h>
-
-#include <iostream>
-#include <string>
-#include <vector>
-#include <list>
-#include <utility>
-#include <map>
-
-#include "modsecurity/transaction.h"
-#include "modsecurity/rules_properties.h"
-#include "modsecurity/rules.h"
-
-#include "src/request_body_processor/xml.h"
-#include "modsecurity/actions/action.h"
-#include "src/actions/severity.h"
-#include "src/actions/xmlns.h"
-#include "src/actions/log_data.h"
-#include "src/actions/msg.h"
-#include "src/utils/string.h"
-
-
-namespace modsecurity {
-namespace Variables {
-
-void Rule::evaluateInternal(Transaction *t,
-    modsecurity::Rule *rule,
-    std::vector<const collection::Variable *> *l) {
-    // Variable rule is now being saved as part of the transient collection.
-}
-
-}  // namespace Variables
-}  // namespace modsecurity

src/variables/rule.h

@@ -27,14 +27,50 @@ namespace modsecurity {
 class Transaction;
 namespace Variables {
 
-class Rule : public Variable {
+class Rule_DictElement : public Variable {
  public:
-    explicit Rule(std::string _name)
-        : Variable(_name) { }
+    Rule_DictElement(std::string dictElement)
+        : Variable("RULE" + std::string(":") +
+            std::string(dictElement)),
+        m_dictElement(dictElement) { }
 
-    void evaluateInternal(Transaction *transaction,
-        modsecurity::Rule *rule,
-        std::vector<const collection::Variable *> *l) override;
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableRule.resolve(m_dictElement, l);
+    }
+
+    std::string m_dictElement;
+};
+
+
+class Rule_NoDictElement : public Variable {
+ public:
+    Rule_NoDictElement()
+        : Variable("RULE") { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableRule.resolve(l);
+    }
+};
+
+
+class Rule_DictElementRegexp : public Variable {
+ public:
+    Rule_DictElementRegexp(std::string dictElement)
+        : Variable("RULE"),
+        m_r(dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_variableRule.resolveRegularExpression(
+            &m_r, l);
+    }
+
+    Utils::Regex m_r;
 };
 
 }  // namespace Variables

src/variables/server_addr.h

@@ -34,7 +34,8 @@ class ServerAddr : public Variable {
     ServerAddr()
         : Variable("SERVER_ADDR") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableServerAddr.evaluate(l);
     }

src/variables/server_name.h

@@ -34,7 +34,8 @@ class ServerName : public Variable {
     ServerName()
         : Variable("SERVER_NAME") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableServerName.evaluate(l);
     }

src/variables/server_port.h

@@ -34,7 +34,8 @@ class ServerPort : public Variable {
     ServerPort()
         : Variable("SERVER_PORT") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableServerPort.evaluate(l);
     }

src/variables/session.h

@@ -0,0 +1,84 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include <iostream>
+#include <string>
+#include <vector>
+#include <list>
+#include <utility>
+
+#ifndef SRC_VARIABLES_SESSION_H_
+#define SRC_VARIABLES_SESSION_H_
+
+#include "src/variables/variable.h"
+
+namespace modsecurity {
+
+class Transaction;
+namespace Variables {
+
+
+class Session_DictElement : public Variable {
+ public:
+    explicit Session_DictElement(std::string dictElement)
+        : Variable("SESSION"),
+        m_dictElement("SESSION:" + dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_collections.resolveMultiMatches(m_dictElement, "SESSION", l);
+    }
+
+    std::string m_dictElement;
+};
+
+
+class Session_NoDictElement : public Variable {
+ public:
+    explicit Session_NoDictElement()
+        : Variable("SESSION") { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_collections.resolveMultiMatches(m_name, "SESSION", l);
+    }
+};
+
+
+class Session_DictElementRegexp : public Variable {
+ public:
+    Session_DictElementRegexp(std::string dictElement)
+        : Variable("SESSION"),
+        m_r(dictElement),
+        m_dictElement("SESSION:" + dictElement) { }
+
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) override {
+        transaction->m_collections.resolveRegularExpression(m_dictElement,
+            "SESSION", l);
+    }
+
+    Utils::Regex m_r;
+    std::string m_dictElement;
+};
+
+
+}  // namespace Variables
+}  // namespace modsecurity
+
+#endif  // SRC_VARIABLES_SESSION_H_

src/variables/session_id.h

@@ -34,7 +34,8 @@ class SessionID : public Variable {
     SessionID()
         : Variable("SESSIONID") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) {
         transaction->m_variableSessionID.evaluate(l);
     }

src/variables/status.h

@@ -13,28 +13,35 @@
  *
  */
 
-#include "src/variables/variations/exclusion.h"
-
 #include <iostream>
 #include <string>
 #include <vector>
 #include <list>
 #include <utility>
 
-#include "modsecurity/transaction.h"
+#ifndef SRC_VARIABLES_STATUS_H_
+#define SRC_VARIABLES_STATUS_H_
 
+#include "src/variables/variable.h"
 
 namespace modsecurity {
+
+class Transaction;
 namespace Variables {
-namespace Variations {
 
+class Status : public Variable {
+ public:
+    Status()
+        : Variable("STATUS") { }
 
-void Exclusion::evaluateInternal(Transaction *transaction,
-    std::vector<const collection::Variable *> *l) {
-    transaction->m_collections.resolveMultiMatches(m_name, l);
-}
+    void evaluate(Transaction *transaction,
+        Rule *rule,
+        std::vector<const collection::Variable *> *l) {
+        transaction->m_variableResponseStatus.evaluate(l);
+    }
+};
 
-
-}  // namespace Variations
 }  // namespace Variables
 }  // namespace modsecurity
+
+#endif  // SRC_VARIABLES_STATUS_H_

src/variables/time.cc

@@ -33,7 +33,8 @@
 namespace modsecurity {
 namespace Variables {
 
-void Time::evaluateInternal(Transaction *transaction,
+void Time::evaluate(Transaction *transaction,
+    Rule *rule,
     std::vector<const collection::Variable *> *l) {
 
     char tstr[200];

src/variables/time.h

@@ -35,7 +35,8 @@ class Time : public Variable {
         : Variable(_name),
         m_retName("TIME") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) override;
     std::string m_retName;
 };

src/variables/time_day.cc

@@ -33,7 +33,8 @@
 namespace modsecurity {
 namespace Variables {
 
-void TimeDay::evaluateInternal(Transaction *transaction,
+void TimeDay::evaluate(Transaction *transaction,
+    Rule *rule,
     std::vector<const collection::Variable *> *l) {
     char tstr[200];
     struct tm timeinfo;

src/variables/time_day.h

@@ -34,7 +34,8 @@ class TimeDay : public Variable {
         : Variable(_name),
         m_retName("TIME_DAY") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) override;
     std::string m_retName;
 };

src/variables/time_epoch.cc

@@ -33,7 +33,8 @@
 namespace modsecurity {
 namespace Variables {
 
-void TimeEpoch::evaluateInternal(Transaction *transaction,
+void TimeEpoch::evaluate(Transaction *transaction,
+    Rule *rule,
     std::vector<const collection::Variable *> *l) {
     transaction->m_variableTimeEpoch.assign(
         std::to_string(std::time(nullptr)));

src/variables/time_epoch.h

@@ -34,7 +34,8 @@ class TimeEpoch : public Variable {
         : Variable(_name),
         m_retName("TIME_EPOCH") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) override;
     std::string m_retName;
 };

src/variables/time_hour.cc

@@ -33,7 +33,8 @@
 namespace modsecurity {
 namespace Variables {
 
-void TimeHour::evaluateInternal(Transaction *transaction,
+void TimeHour::evaluate(Transaction *transaction,
+    Rule *rule,
     std::vector<const collection::Variable *> *l) {
     char tstr[200];
     struct tm timeinfo;

src/variables/time_hour.h

@@ -34,7 +34,8 @@ class TimeHour : public Variable {
         : Variable(_name),
         m_retName("TIME_HOUR") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) override;
     std::string m_retName;
 };

src/variables/time_min.cc

@@ -33,7 +33,8 @@
 namespace modsecurity {
 namespace Variables {
 
-void TimeMin::evaluateInternal(Transaction *transaction,
+void TimeMin::evaluate(Transaction *transaction,
+    Rule *rule,
     std::vector<const collection::Variable *> *l) {
     char tstr[200];
     struct tm timeinfo;

src/variables/time_min.h

@@ -34,7 +34,8 @@ class TimeMin : public Variable {
         : Variable(_name),
         m_retName("TIME_MIN") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) override;
     std::string m_retName;
 };

src/variables/time_mon.cc

@@ -33,7 +33,8 @@
 namespace modsecurity {
 namespace Variables {
 
-void TimeMon::evaluateInternal(Transaction *transaction,
+void TimeMon::evaluate(Transaction *transaction,
+    Rule *rule,
     std::vector<const collection::Variable *> *l) {
     char tstr[200];
     struct tm timeinfo;

src/variables/time_mon.h

@@ -34,7 +34,8 @@ class TimeMon : public Variable {
         : Variable(_name),
         m_retName("TIME_MON") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) override;
     std::string m_retName;
 };

src/variables/time_sec.cc

@@ -33,7 +33,8 @@
 namespace modsecurity {
 namespace Variables {
 
-void TimeSec::evaluateInternal(Transaction *transaction,
+void TimeSec::evaluate(Transaction *transaction,
+    Rule *rule,
     std::vector<const collection::Variable *> *l) {
     char tstr[200];
     struct tm timeinfo;

src/variables/time_sec.h

@@ -34,7 +34,8 @@ class TimeSec : public Variable {
         : Variable(_name),
         m_retName("TIME_SEC") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) override;
     std::string m_retName;
 };

src/variables/time_wday.cc

@@ -33,7 +33,8 @@
 namespace modsecurity {
 namespace Variables {
 
-void TimeWDay::evaluateInternal(Transaction *transaction,
+void TimeWDay::evaluate(Transaction *transaction,
+    Rule *rule,
     std::vector<const collection::Variable *> *l) {
     char tstr[200];
     struct tm timeinfo;

src/variables/time_wday.h

@@ -34,7 +34,8 @@ class TimeWDay : public Variable {
         : Variable(_name),
         m_retName("TIME_WDAY") { }
 
-    void evaluateInternal(Transaction *transaction,
+    void evaluate(Transaction *transaction,
+        Rule *rule,
         std::vector<const collection::Variable *> *l) override;
     std::string m_retName;
 };