Commit Graph

1018 Commits

Author SHA1 Message Date
Felipe Zimmerle
17c4201522 Better error handling when loading configurations 2021-08-04 10:44:15 -03:00
Felipe Zimmerle
8de527ebb1 Adds method getVariableNames to variables 2021-08-03 19:12:30 -03:00
Felipe Zimmerle
4b03e89b01 Cosmetics: Defining a type for RuleId 2021-08-03 18:30:06 -03:00
Felipe Zimmerle
99350b885d Moves rule* headers to src/ 2021-08-03 14:33:28 -03:00
Felipe Zimmerle
17122a05d3 Cleanup on Action class 2021-08-03 09:08:38 -03:00
Felipe Zimmerle
dc33ed7abc Removes RuleMessage from action execute signature 2021-08-02 13:28:44 -03:00
Felipe Zimmerle
d329d52cc3 Refactoring: Makes transformations to work with new execute signature 2021-08-02 11:04:44 -03:00
Felipe Zimmerle
81b98f3e0c Refactoring: rename evaluate to execute on actions 2021-07-30 10:30:12 -03:00
Felipe Zimmerle
9c0d5d104d Refactoring in the Rule class to make it more elegant 2021-07-30 09:12:56 -03:00
Felipe Zimmerle
4669387d1f Rule: isMarker is no longer necessary 2021-07-27 09:44:51 -03:00
Felipe Zimmerle
b079faee97 Adds new method for rule merge
IMPORTANT: SecDefaultAction specified on a child configuration will
overwrite the ones specified on the parent; Previously it was
concatenating.
2021-07-26 12:28:54 -03:00
Felipe Zimmerle
6c874721cf Moves default actions to be part of the rules 2021-07-19 15:01:01 -03:00
marshal09
2e2417f107 Add new transformation call phpArgsNames 2021-07-19 14:40:42 -03:00
Felipe Zimmerle
ca52e88e60 cosmetics: Please cppcheck 2021-07-19 10:11:15 -03:00
martinhsv
cd5fba8974 Handle URI received with uri-fragment 2021-07-05 14:51:21 -03:00
martinhsv
65e7e474b1 fix missing parentheses in filename* parsing 2021-05-11 13:46:50 -07:00
Felipe Zimmerle
7fccb0d225 Cosmetic: pleasing cppcheck 2021-05-11 10:27:58 -03:00
Felipe Zimmerle
6fdba42c02 Cosmetics: Having cppcheck pleased
(...) remove_comments.cc,62,style,knownConditionTrueFalse,Condition 'incomment==0' is always true
(...) remove_comments.cc,66,style,knownConditionTrueFalse,Condition 'incomment==0' is always true
(...) remove_comments.cc,69,style,knownConditionTrueFalse,Condition 'incomment==0' is always true
2021-05-10 12:32:09 -03:00
Felipe Zimmerle
66ba7b065a Cosmetic: fix static warning 2021-05-04 21:04:21 -03:00
Felipe Zimmerle
4cdcc15334 Revert "Adds suppor for HyperScan in the bulid system"
This reverts commit 912704b6d4.
2021-02-26 11:33:12 -03:00
Felipe Zimmerle
912704b6d4 Adds suppor for HyperScan in the bulid system 2021-02-26 11:15:02 -03:00
Felipe Zimmerle
2e69ce6ccf build: Fix curl include path
Issue #2519
2021-02-24 13:20:24 -03:00
Felipe Zimmerle
50fc347ed4 Fix rules dump
The unique pointer for file name was being used multiple times
on SecMarker.
2021-02-04 11:07:22 -03:00
martinhsv
6ca028b6f5 Fix memory leak in rx operator when pattern includes macro 2021-01-25 19:39:10 -03:00
martinhsv
fbea73120c Fix: FILES variable does not use multipart part name for key 2021-01-24 15:06:30 -03:00
Felipe Zimmerle
f1f2527c03 Using setenv instead of putenv on SetEnv action 2021-01-24 14:59:59 -03:00
Felipe Zimmerle
e8bd2151f2 Having _NAMES, variables proxied
Some variables share content with others; that is the case
for ARGS and ARGS_NAMES. Those are different in value, as
ARGS_NAMES holds the key name as value.

Instead of duplicating the strings for the different
collections, this patch unifies the collection in radix,
avoiding memory fragmentation. It is currently doing some
fragmentation while resolving the variable, but to be
mitigated by shared_ptr is VariableValues, a different
change.

TODO: place others variables such as COOKIE*NAMES to use
the same proxy.
2021-01-24 11:30:22 -03:00
Felipe Zimmerle
3748d62f19 Changes copyright dates on the code 2021-01-19 09:24:37 -03:00
Felipe Zimmerle
9b40a045bb Cosmetics: fix some cppcheck complains to please QA 2021-01-13 13:30:04 -03:00
Felipe Zimmerle
f18595f428 Makes regular expression selection on collections key case insensitive
This issue was initially reported by @michaelgranzow-avi on #2296.

@airween made an initial attempt to provide a fixed at #2107; As a
consequence of the pull request review - provided by @victorhora,
@zimmerle, and @michaelgranzow-avi - @airween made a second attempt
at #2297. After reviewing by @martinhsv, @zimmerle, I have absorbed
the essential pieces from @airween patch into this one.

This patch differs from @airween's because @airween's patches were
partially working: Key exclusions with regex weren't covered, same
for anchored variables (e.g. ARGS). During the review, I have
highlighted the importance of having elementary test cases. A simple
test case on ARGS could spot the issue. Since that is an important
fix, I don't want to hold this for one more review cycle; therefore,
I am committing the fix myself.

Thank you all involved in the solution of this very own issue.
2020-12-10 10:05:07 -03:00
David Carlier
560f81200f Adding DragonFlyBSD support. 2020-12-10 09:51:03 -03:00
martinhsv
d72be1c470 Fix: Only delete Multipart tmp files after rules have run 2020-11-04 13:50:07 -03:00
Michael Granzow
1b7aa42c77 Issue-2423: Meta-actions like 'msg' should be applied at end of chain 2020-10-29 10:33:02 -03:00
martinhsv
2672db103e Add support for new operator rxGlobal 2020-10-26 08:55:07 -03:00
Felipe Zimmerle
4b425850cf Cosmetics: fix cppcheck warnings 2020-10-23 08:29:07 -03:00
martinhsv
8436c78993 Fix IP address logging in Section A 2020-10-16 13:14:42 -07:00
Felipe Zimmerle
995f22b3ce Having Bison 3.7.2 2020-10-14 13:58:37 -03:00
Felipe Zimmerle
377fb723ca Makes lua 5.1 workable again
Issue #2389
2020-09-21 10:04:40 -03:00
Felipe Zimmerle
8c85b78361 Adds support to lua 5.4 2020-08-17 11:08:03 -03:00
Felipe Zimmerle
ae3ad5eaa7 cosmetics: Address some cppcheck complains 2020-08-06 19:02:00 -03:00
Andrei Belov
fe12385148 GeoIP: switch to GEOIP_MEMORY_CACHE from GEOIP_INDEX_CACHE
Using GEOIP_INDEX_CACHE on some older versions of libGeoIP (e.g. 1.5.0
which is the default version on CentOS 7) leads to "Error reading file"
error while opening completely valid GeoIP.dat:

    # cat test.c
    #include <stdio.h>
    #include "GeoIP.h"

    int main(void) {
      GeoIP *g;

      g = GeoIP_open("/tmp/GeoIP.dat", GEOIP_INDEX_CACHE);

      if (g == NULL) {
        printf("error!\n");
      }

      GeoIP_delete(g);

      exit(0);
    }
    # cc -lGeoIP -o test test.c
    # ./test
    Error reading file /tmp/GeoIP.dat
    error!
    # sed -i -e 's,GEOIP_INDEX_CACHE,GEOIP_MEMORY_CACHE,' test.c
    # cc -lGeoIP -o test test.c
    # ./test
    # geoiplookup -f /tmp/GeoIP.dat -v 8.8.8.8
    GeoIP Country Edition: GEO-106FREE 20180327 Build 1 Copyright (c) 2018 MaxMind Inc All Rights Reserved

Also tested with recent GeoLite databases converted from new format
into legacy format, distributed here:

    https://mailfud.org/geoip-legacy/
2020-07-30 13:48:40 -03:00
martinhsv
b9620c26a0 rx:exit after full match; fix TX population after unused group 2020-06-29 06:13:45 -07:00
Felipe Zimmerle
7e0bc26917 Using performLogging function 2020-03-31 15:20:15 -03:00
Felipe Zimmerle
7a48245aed Creates RuleUnconditional
Makes RuleScript child of RuleWithActions instead of Operator
2020-03-31 14:44:19 -03:00
Felipe Zimmerle
f63bd1a45d Moves Rule[WithActions|WithOperator] to their own files 2020-03-31 13:33:38 -03:00
Felipe Zimmerle
8274be066a Refactoring: Having RuleMarker in a separated file 2020-03-31 12:45:46 -03:00
Felipe Zimmerle
bdedfd2463 Refactoring: Renames RuleBase to Rule 2020-03-31 12:26:13 -03:00
Felipe Zimmerle
59d4268882 Refactoring: renames Rule to RuleWithOperator 2020-03-31 10:00:08 -03:00
Felipe Zimmerle
8eb7b8fe6c Refactoring: Splits Rule into Rule and RuleWithActions 2020-03-30 20:22:37 -03:00
Felipe Zimmerle
43f8aee6b6 Splits Rule class into: Rule, RuleBase, RuleMarker 2020-03-30 20:21:36 -03:00