github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-09-29 19:24:29 +03:00
Code Issues Packages Projects Releases Wiki Activity

Adds support to the msg action

Browse Source
This commit is contained in:
Felipe Zimmerle
2015-08-07 01:48:16 -03:00
parent 5fdb5b7d2e
commit f519717bdf
8 changed files with 188 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/Makefile.am
View File

@@ -56,6 +56,7 @@ ACTIONS = \
actions/block.cc \
actions/capture.cc \
actions/chain.cc \
actions/msg.cc \
actions/no_audit_log.cc \
actions/phase.cc \
actions/redirect.cc \

46
src/actions/msg.cc Normal file
View File

@@ -0,0 +1,46 @@
/*
* ModSecurity, http://www.modsecurity.org/
* Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
*
* You may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* If any of the files related to licensing are missing or if you have any
* other questions related to licensing please contact Trustwave Holdings, Inc.
* directly using the email address security@modsecurity.org.
*
*/
#include "actions/msg.h"
#include <iostream>
#include <string>
#include "actions/action.h"
#include "modsecurity/assay.h"
#include "src/utils.h"
#include "src/macro_expansion.h"
namespace ModSecurity {
namespace actions {
Msg::Msg(std::string action)
: Action(action, RunTimeOnlyIfMatchKind),
m_msg(action) {
m_msg.erase(0, 1);
m_msg.pop_back();
}
bool Msg::evaluate(Rule *rule, Assay *assay) {
std::string msg = MacroExpansion::expand(m_msg, assay);
assay->debug(9, "Saving msg: " + msg);
assay->rulesMessages.push_back(msg);
assay->serverLog(msg);
return true;
}
} // namespace actions
} // namespace ModSecurity

44
src/actions/msg.h Normal file
View File

@@ -0,0 +1,44 @@
/*
* ModSecurity, http://www.modsecurity.org/
* Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
*
* You may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* If any of the files related to licensing are missing or if you have any
* other questions related to licensing please contact Trustwave Holdings, Inc.
* directly using the email address security@modsecurity.org.
*
*/
#include <string>
#include "actions/action.h"
#ifndef SRC_ACTIONS_MSG_H_
#define SRC_ACTIONS_MSG_H_
class Assay;
namespace ModSecurity {
class Assay;
namespace actions {
class Msg : public Action {
public:
explicit Msg(std::string action);
bool evaluate(Rule *rule, Assay *assay) override;
private:
std::string m_msg;
};
} // namespace actions
} // namespace ModSecurity
#endif // SRC_ACTIONS_MSG_H_

3
src/assay.cc
View File

@@ -1353,6 +1353,9 @@ std::list<std::pair<std::string, std::string>>
return l;
}
void Assay::serverLog(const std::string& msg) {
std::cerr << "Server log is not ready : " << msg << std::endl;
}
std::string* Assay::resolve_variable_first(std::string var) {
auto range = m_variables_strings.equal_range(var);

24
src/parser/seclang-parser.yy
View File

@@ -18,6 +18,7 @@ class Driver;
#include "actions/action.h"
#include "actions/set_var.h"
#include "actions/msg.h"
#include "actions/transformations/transformation.h"
#include "operators/operator.h"
#include "rule.h"
@@ -42,6 +43,7 @@ class Driver;
using ModSecurity::actions::Action;
using ModSecurity::actions::SetVar;
using ModSecurity::actions::Msg;
using ModSecurity::actions::transformations::Transformation;
using ModSecurity::operators::Operator;
using ModSecurity::Rule;
@@ -186,6 +188,7 @@ using ModSecurity::Variables::Variable;
%token <std::string> ACTION
%token <std::string> ACTION_SEVERITY
%token <std::string> ACTION_SETVAR
%token <std::string> ACTION_MSG
%token <std::string> TRANSFORMATION
%token <double> CONFIG_VALUE_NUMBER
@@ -643,7 +646,28 @@ actions:
actions->push_back(setVar);
$$ = actions;
}
| actions COMMA ACTION_MSG
{
std::vector<Action *> *a = $1;
Msg *msg = new Msg($3);
a->push_back(msg);
$$ = $1;
}
| SPACE ACTION_MSG
{
std::vector<Action *> *actions = new std::vector<Action *>;
Msg *msg = new Msg($2);
actions->push_back(msg);
$$ = actions;
}
| ACTION_MSG
{
std::vector<Action *> *actions = new std::vector<Action *>;
Msg *msg = new Msg($1);
actions->push_back(msg);
$$ = actions;
}
%%
void

7
src/parser/seclang-scanner.ll
View File

@@ -23,9 +23,10 @@ using ModSecurity::split;
%}
%option noyywrap nounput batch debug noinput
ACTION (?i:accuracy|allow|append|auditlog|block|capture|chain|ctl|deny|deprecatevar|drop|exec|expirevar|id:[0-9]+|id:'[0-9]+'|initcol|log|logdata|maturity|msg|multiMatch|noauditlog|nolog|pass|pause|phase:[0-9]+|prepend|proxy|redirect:[A-Z0-9_\|\&\:\/\/\.]+|rev|sanitiseArg|sanitiseMatched|sanitiseMatchedBytes|sanitiseRequestHeader|sanitiseResponseHeader|setuid|setrsc|setsid|setenv|skip|skipAfter|status:[0-9]+|tag|ver|xmlns)
ACTION (?i:accuracy|allow|append|auditlog|block|capture|chain|ctl|deny|deprecatevar|drop|exec|expirevar|id:[0-9]+|id:'[0-9]+'|initcol|log|logdata|maturity|multiMatch|noauditlog|nolog|pass|pause|phase:[0-9]+|prepend|proxy|redirect:[A-Z0-9_\|\&\:\/\/\.]+|rev|sanitiseArg|sanitiseMatched|sanitiseMatchedBytes|sanitiseRequestHeader|sanitiseResponseHeader|setuid|setrsc|setsid|setenv|skip|skipAfter|status:[0-9]+|tag|ver|xmlns)
ACTION_SEVERITY (?i:severity:[0-9]+|severity:'[0-9]+'|severity:(EMERGENCY|ALERT|CRITICAL|ERROR|WARNING|NOTICE|INFO|DEBUG)|severity:'(EMERGENCY|ALERT|CRITICAL|ERROR|WARNING|NOTICE|INFO|DEBUG)')
ACTION_SETVAR (?i:setvar)
ACTION_MSG (?i:msg)
DIRECTIVE SecRule
CONFIG_DIRECTIVE SecRequestBodyNoFilesLimit|SecRequestBodyInMemoryLimit|SecPcreMatchLimitRecursion|SecPcreMatchLimit|SecResponseBodyMimeType|SecTmpDir|SecDataDir|SecArgumentSeparator|SecCookieFormat|SecStatusEngine
@@ -154,7 +155,7 @@ FREE_TEXT_NEW_LINE [^\"|\n]+
%{ /* Variables: TIME */ %}
[!|&]?{RUN_TIME_VAR_TIME} { return yy::seclang_parser::make_RUN_TIME_VAR_TIME(yytext, *driver.loc.back()); }
[!|&]?{RUN_TIME_VAR_TIME_DAY} { return yy::seclang_parser::make_RUN_TIME_VAR_TIME_DAY(yytext, *driver.loc.back()); }
[!|&]?[&]?{RUN_TIME_VAR_TIME_EPOCH} { return yy::seclang_parser::make_RUN_TIME_VAR_TIME_EPOCH(yytext, *driver.loc.back()); }
[!|&]?{RUN_TIME_VAR_TIME_EPOCH} { return yy::seclang_parser::make_RUN_TIME_VAR_TIME_EPOCH(yytext, *driver.loc.back()); }
[!|&]?{RUN_TIME_VAR_TIME_HOUR} { return yy::seclang_parser::make_RUN_TIME_VAR_TIME_HOUR(yytext, *driver.loc.back()); }
[!|&]?{RUN_TIME_VAR_TIME_MIN} { return yy::seclang_parser::make_RUN_TIME_VAR_TIME_MIN(yytext, *driver.loc.back()); }
[!|&]?{RUN_TIME_VAR_TIME_MON} { return yy::seclang_parser::make_RUN_TIME_VAR_TIME_MON(yytext, *driver.loc.back()); }
@@ -198,6 +199,8 @@ FREE_TEXT_NEW_LINE [^\"|\n]+
{ACTION_SETVAR}:{FREE_TEXT} {
return yy::seclang_parser::make_ACTION_SETVAR(strchr(yytext, ':') + 1, *driver.loc.back());
}
{ACTION_MSG}:'{FREE_TEXT}' { return yy::seclang_parser::make_ACTION_MSG(strchr(yytext, ':') + 1, *driver.loc.back()); }
["] { return yy::seclang_parser::make_QUOTATION_MARK(*driver.loc.back()); }
[,] { return yy::seclang_parser::make_COMMA(*driver.loc.back()); }
[|] { return yy::seclang_parser::make_PIPE(*driver.loc.back()); }