509 Commits

Author SHA1 Message Date
Felipe Zimmerle
7857031f56
Having macro to support variable modificator count 2020-12-02 13:58:02 -03:00
Felipe Zimmerle
b8478b11bb
Adds support to setvar string manipulation
As discussed on #340
2020-12-02 12:11:43 -03:00
Felipe Zimmerle
7ebb81b037
Using a custom VariableMatch* implementation
Delay the variable name resolution till last minute.

Fix one of the issues raised in #2376
2020-11-30 12:48:37 -03:00
Felipe Zimmerle
ec7d2db400
Avoids to cleanup GeoIp on ModSecurity destructor
GeoIp is already being cleaned elsewhere.

Fix #2041
2020-11-30 12:48:37 -03:00
martinhsv
0396e89619
Implement id ranges for ctl:ruleRemoveTargetById 2020-11-30 12:48:37 -03:00
Felipe Zimmerle
bb7bd975bf
Refactoring on Action - having RuleWithAction and RuleWithActionsProperties 2020-11-30 12:48:35 -03:00
Felipe Zimmerle
943da64fe7
Delays variable name resolution to whenever it is necessary 2020-11-27 23:25:07 -03:00
WGH
3a72237d25
Use std::shared_ptr for variable resolution
AnchoredSetVariable::resolve is called for every rule
(see RuleWithOperator::evaluate). The previous implementation allocated
a new copy of every variable, which quickly added up. In my tests,
AnchoredSetVariable::resolve function consumed 7.8% of run time.

AnchoredSetVariable (which is a multimap) values are never changed,
only added. This means it's safe to store them in std::shared_ptr,
and make resolve return shared_ptr pointing to the same object.

Other resolve implementation could also use this optimization by not
allocating new objects, however, they are not hot spots, so this
optimization was not implemented there.

In my benchmark, this raises performance from 117 requests per second to
131 RPS, and overhead is lowered from 7.8% to 2.4%.

As a bonus, replacing plain pointer with smart pointers make code
cleaner, since using smart pointers makes manual deletes no longer necessary.

Additionally, VariableOrigin is now stored in plain std::vector,
since it's wasteful to store structure containing just two integer
values using std::list<std::unique_ptr<T>>.
2020-11-27 23:20:04 -03:00
Felipe Zimmerle
f115018157
Makes RuleWithActions const in run time operations 2020-11-26 11:22:34 -03:00
Felipe Zimmerle
fc0fef3646
Makes Lua::run const 2020-11-26 11:22:33 -03:00
Felipe Zimmerle
e0cd76355f
Computes auditlog during rules load time 2020-11-26 11:14:30 -03:00
Felipe Zimmerle
3832042531
actions: Removes Rule parameter from runtime execute
Generals organization on the Action class
2020-11-26 11:10:25 -03:00
Felipe Zimmerle
5e5180c93b
tests: Romoves unused header from a test case 2020-11-26 11:02:05 -03:00
Felipe Zimmerle
bfaff92a51
tests: Prints test number on segfault 2020-11-26 11:01:26 -03:00
Felipe Zimmerle
193c794fb7
Makes operator to use string_view 2020-11-26 10:57:02 -03:00
Felipe Zimmerle
43b1c4f459
Better error handling when loading configurations 2020-11-26 10:50:23 -03:00
Felipe Zimmerle
7ac2fd5fb0
Cosmetics: Defining a type for RuleId 2020-11-26 10:44:37 -03:00
Felipe Zimmerle
8d0017919f
Cleanup on Action class 2020-11-26 10:41:17 -03:00
Felipe Zimmerle
5cb58b412c
Refactoring: Makes transformations to work with new execute signature 2020-11-25 10:47:16 -03:00
Felipe Zimmerle
8bb1a90c4f
Cosmetics: fix some cppcheck complains 2020-11-25 10:26:02 -03:00
Felipe Zimmerle
1f7d202985
Refactoring: rename evaluate to execute on actions 2020-11-25 10:26:00 -03:00
Felipe Zimmerle
6cdbad05ad
Refactoring in the Rule class to make it more elegant 2020-11-25 10:15:04 -03:00
Felipe Zimmerle
766b373c3b
Adds new method for rule merge
IMPORTANT: SecDefaultAction specified on a child configuration will
overwrite the ones specified on the parent; Previously it was
concatenating.
2020-11-25 10:12:10 -03:00
martinhsv
1e954f5d54
Fix: FILES variable does not use multipart part name for key 2020-11-25 09:17:15 -03:00
marshal09
452faa55ce
Add new transformation call phpArgsNames 2020-11-25 09:16:30 -03:00
Felipe Zimmerle
910a1877a9
Makes regular expression selection on collections key case insensitive
This issue was initially reported by @michaelgranzow-avi on #2296.

@airween made an initial attempt to provide a fixed at #2107; As a
consequence of the pull request review - provided by @victorhora,
@zimmerle, and @michaelgranzow-avi - @airween made a second attempt
at #2297. After reviewing by @martinhsv, @zimmerle, I have absorbed
the essential pieces from @airween patch into this one.

This patch differs from @airween's because @airween's patches were
partially working: Key exclusions with regex weren't covered, same
for anchored variables (e.g. ARGS). During the review, I have
highlighted the importance of having elementary test cases. A simple
test case on ARGS could spot the issue. Since that is an important
fix, I don't want to hold this for one more review cycle; therefore,
I am committing the fix myself.

Thank you all involved in the solution of this very own issue.
2020-11-25 09:11:05 -03:00
martinhsv
d72be1c470
Fix: Only delete Multipart tmp files after rules have run 2020-11-04 13:50:07 -03:00
Michael Granzow
1b7aa42c77
Issue-2423: Meta-actions like 'msg' should be applied at end of chain 2020-10-29 10:33:02 -03:00
martinhsv
2672db103e
Add support for new operator rxGlobal 2020-10-26 08:55:07 -03:00
Felipe Zimmerle
4b425850cf
Cosmetics: fix cppcheck warnings 2020-10-23 08:29:07 -03:00
Felipe Zimmerle
377fb723ca
Makes lua 5.1 workable again
Issue #2389
2020-09-21 10:04:40 -03:00
martinhsv
b9620c26a0
rx:exit after full match; fix TX population after unused group 2020-06-29 06:13:45 -07:00
martinhsv
a1547eaa32
Regression tests: audit log compare support and test cases 2020-03-31 15:01:26 -03:00
Felipe Zimmerle
7a48245aed
Creates RuleUnconditional
Makes RuleScript child of RuleWithActions instead of Operator
2020-03-31 14:44:19 -03:00
Felipe Zimmerle
43f8aee6b6
Splits Rule class into: Rule, RuleBase, RuleMarker 2020-03-30 20:21:36 -03:00
Felipe Zimmerle
fda03c0016
Yet another refactoring in Rule 2020-03-30 15:38:51 -03:00
Felipe Zimmerle
5ebfa5eacb
Removes referece count from audit logs 2020-03-26 10:38:55 -03:00
Felipe Zimmerle
9d158611cf
Makes Rule a shared pointer 2020-03-25 16:11:23 -03:00
Felipe Zimmerle
6367e6d5e9
Having a class Rules 2020-03-24 17:20:10 -03:00
Felipe Zimmerle
fb7714f202
Creates class RulesSetPhases 2020-03-24 14:00:28 -03:00
Felipe Zimmerle
7a0ad43087
fuzz: minor adjustment on op_test 2020-03-24 09:42:45 -03:00
Felipe Zimmerle
6de5c5984d
Adds some operators to the fuzzing tests 2020-03-23 22:15:48 -03:00
Felipe Zimmerle
edd0a4bb26
Updates the fuzzing example 2020-03-23 21:41:24 -03:00
Felipe Zimmerle
1e26bf2078
Revert "Creates the RulesSetPhases clas"
This reverts commit 072e4edc53e388fdf64a5eb9d4317544a1c8ada6.
2020-03-11 08:17:56 -03:00
Felipe Zimmerle
072e4edc53
Creates the RulesSetPhases clas 2020-03-05 07:13:02 -03:00
Felipe Zimmerle
014adabda4
cppcheck: Adds rules_set_properties.cc supressions 2020-02-18 14:18:22 -03:00
Felipe Zimmerle
6a742cdf76
Refactoring: Renames RulesProperties to RulesSetProperties 2020-02-17 13:17:03 -03:00
martinhsv
f57265a3e2
Support configurable limit on number of arguments processed 2020-02-14 11:00:01 -03:00
Felipe Zimmerle
4671608d5b
cppcheck: more suppressions 2020-02-12 09:32:15 -03:00
Felipe Zimmerle
b7e28c246f
static: fix static checks 2020-02-11 15:16:24 -03:00