Adds support to @ipMatch operator

src/utils/ip_tree.cc

@@ -0,0 +1,121 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include "utils/ip_tree.h"
+
+#include <sys/socket.h>
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <string>
+
+#include <fstream>
+#include <iostream>
+
+#include "utils/geo_lookup.h"
+
+namespace ModSecurity {
+namespace Utils {
+
+void IpTree::postOrderTraversal(TreeNode *node) {
+    if (node == NULL) {
+        return;
+    }
+
+    postOrderTraversal(node->left);
+    postOrderTraversal(node->right);
+
+    if (node->netmasks) {
+        delete node->netmasks;
+        node->netmasks = NULL;
+    }
+    if (node->prefix) {
+        if (node->prefix->buffer) {
+            delete node->prefix->buffer;
+            node->prefix->buffer = NULL;
+        }
+        if (node->prefix->prefix_data) {
+            delete node->prefix->prefix_data;
+            node->prefix->prefix_data = NULL;
+        }
+        delete node->prefix;
+        node->prefix = NULL;
+    }
+    delete node;
+    node = NULL;
+}
+
+IpTree::~IpTree() {
+    if (m_tree != NULL) {
+        if (m_tree->ipv4_tree != NULL) {
+            // Tree_traversal: Post-order to delete all the items.
+            postOrderTraversal(m_tree->ipv4_tree->head);
+            delete m_tree->ipv4_tree;
+            m_tree->ipv4_tree = NULL;
+        }
+        if (m_tree->ipv6_tree != NULL) {
+            // Tree_traversal: Post-order to delete all the items.
+            postOrderTraversal(m_tree->ipv6_tree->head);
+            delete m_tree->ipv6_tree;
+            m_tree->ipv6_tree = NULL;
+        }
+
+        delete m_tree;
+        m_tree = NULL;
+    }
+}
+
+
+bool IpTree::addFromBuffer(const std::string& buffer, std::string *error) {
+    char *error_msg = NULL;
+    std::stringstream ss;
+    std::string line;
+    ss << buffer;
+    int res = 0;
+
+    for (std::string line; std::getline(ss, line); ) {
+        res = ip_tree_from_param(buffer.c_str(), &m_tree, &error_msg);
+        if (res != 0) {
+            if (error_msg != NULL) {
+                error->assign(error_msg);
+            }
+            return false;
+        }
+    }
+
+    return true;
+}
+
+
+bool IpTree::contains(const std::string& ip) {
+    int res = 0;
+    char *error_msg = NULL;
+
+    res = tree_contains_ip(m_tree, ip.c_str(), &error_msg);
+
+    if (res < 0) {
+        return false;
+    }
+
+    if (res > 0) {
+        return true;
+    }
+
+    return false;
+}
+
+
+}  // namespace Utils
+}  // namespace ModSecurity

src/utils/ip_tree.h

@@ -0,0 +1,50 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address security@modsecurity.org.
+ *
+ */
+
+#include <iostream>
+#include <fstream>
+#include <string>
+#include <functional>
+
+#include <GeoIPCity.h>
+
+#ifndef SRC_UTILS_IP_TREE_H_
+#define SRC_UTILS_IP_TREE_H_
+
+#include "modsecurity/assay.h"
+#include "utils/msc_tree.h"
+
+namespace ModSecurity {
+namespace Utils {
+
+
+class IpTree {
+ public:
+    IpTree()
+        : m_tree(NULL) { }
+    ~IpTree();
+
+    bool contains(const std::string &ip);
+    bool addFromBuffer(const std::string& buffer, std::string *error);
+    void postOrderTraversal(TreeNode *node);
+ private:
+    TreeRoot *m_tree;
+};
+
+
+}  // namespace Utils
+}  // namespace ModSecurity
+
+#endif  // SRC_UTILS_IP_TREE_H_

src/utils/msc_tree.h

@@ -0,0 +1,104 @@
+/*
+* ModSecurity for Apache 2.x, http://www.modsecurity.org/
+* Copyright (c) 2004-2013 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+*
+* You may not use this file except in compliance with
+* the License.  You may obtain a copy of the License at
+*
+*     http://www.apache.org/licenses/LICENSE-2.0
+*
+* If any of the files related to licensing are missing or if you have any
+* other questions related to licensing please contact Trustwave Holdings, Inc.
+* directly using the email address security@modsecurity.org.
+*/
+
+
+/*
+ *
+ * TODO: This is an improved copy of the ModSecurity 2.9 file, this may need
+ * some other enhancements and/or fixes.
+ *
+ */
+
+#ifndef SRC_UTILS_MSC_TREE_H_
+#define SRC_UTILS_MSC_TREE_H_
+
+
+typedef struct CPTData CPTData;
+typedef struct TreePrefix TreePrefix;
+typedef struct TreeNode TreeNode;
+typedef struct CPTTree CPTTree;
+typedef struct TreeRoot TreeRoot;
+
+#define IPV4_TREE 0x1
+#define IPV6_TREE 0x2
+
+#define IPV4_LEN 0x20
+#define IPV6_LEN 0x80
+
+#define TREE_CHECK(x, y) ((x) & (y))
+#define MASK_BITS(x) ((x + 1) * 8)
+#define SHIFT_LEFT_MASK(x) ((-1) << (x))
+#define SHIFT_RIGHT_MASK(x,y) ((x) >> (y))
+
+#define NETMASK_256 0x100
+#define NETMASK_128 0x80
+#define NETMASK_64  0x40
+#define NETMASK_32 0x20
+#define NETMASK_16 0x10
+#define NETMASK_8  0x8
+#define NETMASK_4  0x4
+#define NETMASK_2  0x2
+
+#define FALSE 0
+#define TRUE 1
+
+extern "C" {
+
+struct CPTData {
+    unsigned char netmask;
+    struct CPTData *next;
+};
+
+struct TreePrefix {
+    unsigned char *buffer;
+    unsigned int bitlen;
+    CPTData *prefix_data;
+};
+
+struct TreeNode {
+    unsigned int bit;
+    int count;
+    unsigned char *netmasks;
+    TreePrefix *prefix;
+    struct TreeNode *left, *right;
+    struct TreeNode *parent;
+};
+
+struct CPTTree {
+    int count;
+    TreeNode *head;
+};
+
+struct TreeRoot {
+    CPTTree *ipv4_tree;
+    CPTTree *ipv6_tree;
+};
+
+CPTTree *CPTCreateRadixTree();
+TreeNode *CPTIpMatch(unsigned char *ipdata, CPTTree *tree, int type);
+TreeNode *TreeAddIP(const char *buffer, CPTTree *tree, int type);
+
+unsigned char is_netmask_v4(char *ip_strv4);
+
+unsigned char is_netmask_v6(char *ip_strv6);
+
+/** @ingroup ModSecurity_Legacy */
+int tree_contains_ip(TreeRoot *rtree,
+    const char *value, char **error_msg);
+
+int ip_tree_from_param(const char *param, TreeRoot **rtree, char **error_msg);
+int create_radix_tree(TreeRoot **rtree, char **error_msg);
+}
+
+#endif  // SRC_UTILS_MSC_TREE_H_