337 Commits

Author SHA1 Message Date
Felipe Zimmerle
ae128ad94d
Having the Sec[Request|Response]BodyAccess deprecated 2020-12-23 19:32:32 -03:00
Felipe Zimmerle
62d35fbf97
Adds support to config warnings 2020-12-23 19:27:54 -03:00
Felipe Zimmerle
bf87f11036
Cosmetics: Refactoring on regression utility 2020-12-23 15:11:56 -03:00
Felipe Zimmerle
3a55909eae Using setenv instead of putenv on SetEnv action 2020-12-22 22:14:46 -03:00
Felipe Zimmerle
eec1f00bea Using a custom VariableMatch* implementation
Delay the variable name resolution till last minute.

Fix one of the issues raised in #2376
2020-12-22 22:14:46 -03:00
martinhsv
c258cff815 Implement id ranges for ctl:ruleRemoveTargetById 2020-12-22 22:14:45 -03:00
Felipe Zimmerle
5b204642ab Refactoring on Action - having RuleWithAction and RuleWithActionsProperties 2020-12-22 22:14:45 -03:00
Felipe Zimmerle
9f0e345f43 Delays variable name resolution to whenever it is necessary 2020-12-22 22:14:44 -03:00
WGH
6528c95765 Use std::shared_ptr for variable resolution
AnchoredSetVariable::resolve is called for every rule
(see RuleWithOperator::evaluate). The previous implementation allocated
a new copy of every variable, which quickly added up. In my tests,
AnchoredSetVariable::resolve function consumed 7.8% of run time.

AnchoredSetVariable (which is a multimap) values are never changed,
only added. This means it's safe to store them in std::shared_ptr,
and make resolve return shared_ptr pointing to the same object.

Other resolve implementation could also use this optimization by not
allocating new objects, however, they are not hot spots, so this
optimization was not implemented there.

In my benchmark, this raises performance from 117 requests per second to
131 RPS, and overhead is lowered from 7.8% to 2.4%.

As a bonus, replacing plain pointer with smart pointers make code
cleaner, since using smart pointers makes manual deletes no longer necessary.

Additionally, VariableOrigin is now stored in plain std::vector,
since it's wasteful to store structure containing just two integer
values using std::list<std::unique_ptr<T>>.
2020-12-22 22:14:43 -03:00
Felipe Zimmerle
c38051324d Computes auditlog during rules load time 2020-12-22 22:14:41 -03:00
Felipe Zimmerle
bf3a1d84ff actions: Removes Rule parameter from runtime execute
Generals organization on the Action class
2020-12-22 22:14:38 -03:00
Felipe Zimmerle
374203b000
tests: Romoves unused header from a test case 2020-12-10 10:10:48 -03:00
Felipe Zimmerle
78d9575dd2
Better error handling when loading configurations 2020-12-10 10:10:48 -03:00
Felipe Zimmerle
68f85628dd
Refactoring: Makes transformations to work with new execute signature 2020-12-10 10:10:47 -03:00
Felipe Zimmerle
f605359ca5
Refactoring in the Rule class to make it more elegant 2020-12-10 10:10:47 -03:00
Felipe Zimmerle
2b9ec1a0f1
Adds new method for rule merge
IMPORTANT: SecDefaultAction specified on a child configuration will
overwrite the ones specified on the parent; Previously it was
concatenating.
2020-12-10 10:10:46 -03:00
martinhsv
36457f36bf
Fix: FILES variable does not use multipart part name for key 2020-12-10 10:10:46 -03:00
marshal09
288e9dbb3e
Add new transformation call phpArgsNames 2020-12-10 10:10:46 -03:00
Felipe Zimmerle
f18595f428
Makes regular expression selection on collections key case insensitive
This issue was initially reported by @michaelgranzow-avi on #2296.

@airween made an initial attempt to provide a fixed at #2107; As a
consequence of the pull request review - provided by @victorhora,
@zimmerle, and @michaelgranzow-avi - @airween made a second attempt
at #2297. After reviewing by @martinhsv, @zimmerle, I have absorbed
the essential pieces from @airween patch into this one.

This patch differs from @airween's because @airween's patches were
partially working: Key exclusions with regex weren't covered, same
for anchored variables (e.g. ARGS). During the review, I have
highlighted the importance of having elementary test cases. A simple
test case on ARGS could spot the issue. Since that is an important
fix, I don't want to hold this for one more review cycle; therefore,
I am committing the fix myself.

Thank you all involved in the solution of this very own issue.
2020-12-10 10:05:07 -03:00
martinhsv
d72be1c470
Fix: Only delete Multipart tmp files after rules have run 2020-11-04 13:50:07 -03:00
Michael Granzow
1b7aa42c77
Issue-2423: Meta-actions like 'msg' should be applied at end of chain 2020-10-29 10:33:02 -03:00
martinhsv
2672db103e
Add support for new operator rxGlobal 2020-10-26 08:55:07 -03:00
Felipe Zimmerle
377fb723ca
Makes lua 5.1 workable again
Issue #2389
2020-09-21 10:04:40 -03:00
martinhsv
b9620c26a0
rx:exit after full match; fix TX population after unused group 2020-06-29 06:13:45 -07:00
martinhsv
a1547eaa32
Regression tests: audit log compare support and test cases 2020-03-31 15:01:26 -03:00
Felipe Zimmerle
7a48245aed
Creates RuleUnconditional
Makes RuleScript child of RuleWithActions instead of Operator
2020-03-31 14:44:19 -03:00
Felipe Zimmerle
43f8aee6b6
Splits Rule class into: Rule, RuleBase, RuleMarker 2020-03-30 20:21:36 -03:00
Felipe Zimmerle
9d158611cf
Makes Rule a shared pointer 2020-03-25 16:11:23 -03:00
Felipe Zimmerle
1e26bf2078
Revert "Creates the RulesSetPhases clas"
This reverts commit 072e4edc53e388fdf64a5eb9d4317544a1c8ada6.
2020-03-11 08:17:56 -03:00
Felipe Zimmerle
072e4edc53
Creates the RulesSetPhases clas 2020-03-05 07:13:02 -03:00
martinhsv
f57265a3e2
Support configurable limit on number of arguments processed 2020-02-14 11:00:01 -03:00
martinhsv
136db3e582
Multipart Content-Disposition should allow filename* field 2020-02-11 10:29:38 -03:00
martinhsv
1b1fdc055b
Fix rule-update-target exclusions for plain (non-regex) variables 2020-02-11 09:42:37 -03:00
martinhsv
0470168056 Fix: audit log data omitted when nolog,auditlog 2020-01-07 11:16:07 -03:00
martinhsv
b8160cce6b Fix Cookie header parsing issues 2019-11-20 08:51:06 -03:00
Ervin Hegedus
7ba77631f9 Replace Cookie parsing method 2019-11-20 08:51:05 -03:00
martinhsv
9cac167faf Fix argument key-value pair parsing cases 2019-11-05 13:06:29 -03:00
felipe
c41ab312f3
Updates test cases 2019-10-24 09:59:57 -03:00
Felipe Zimmerle
beedddd6c6 Fix @pm lookup for possible matches on offset zero 2019-10-02 08:05:14 -07:00
Felipe Zimmerle
2bdc5f9d0a
Adds test case to cover issue #2005 2019-06-18 15:10:43 -03:00
Felipe Zimmerle
6ab464ab78
negative lookup on the key name instead of COLLECTION:key 2019-06-17 13:04:25 -03:00
Ervin Hegedus
c0142cf326
Changed compared variables of range id intervall in ruleRemoveById ctl action. #2111
* changed the variables in clause
* added test case (@theMiddle)
* fixes #2111
2019-06-04 10:28:30 -03:00
Felipe Zimmerle
9ebebfc838
Fix test case 1960 2019-06-04 08:38:45 -03:00
Felipe Zimmerle
50abc072c4
Make block action execution dependent of the SecEngine status 2019-06-03 19:55:02 -03:00
Felipe Zimmerle
a4e8484115
Having body limits to respect the rule engine state 2019-06-03 14:05:10 -03:00
Felipe Zimmerle
20b90364fa
Adds test case for #1872 2019-05-31 11:50:47 -03:00
Felipe Zimmerle
1b8d69da02
Fix dict element regular expression selection on SecRuleUpdateTargetByTag 2019-05-31 01:42:51 -03:00
Felipe Zimmerle
5472362313
Fix SecRuleUpdateTargetByTag with regular expressions 2019-05-31 01:42:47 -03:00
Ervin Hegedus
7a93bea8f7 Added some test cases related to #2099 2019-05-30 09:52:27 -03:00
Rufus125
86ce479b59
Adds new operator to check for data leakage of Austrian social security number 2019-05-29 20:57:08 -03:00