Felipe Zimmerle
|
f93c0de940
|
Disable NO_LOGS by default
|
2015-09-24 11:55:14 -07:00 |
|
Felipe Zimmerle
|
076a02951c
|
Huge performance improvement: passing variables as pointers avoiding copies
|
2015-09-18 20:21:12 -03:00 |
|
Felipe Zimmerle
|
2451bf05d7
|
Using pcre (with JIT) instead of pcrecpp
|
2015-09-17 19:26:44 -03:00 |
|
Felipe Zimmerle
|
ed86c24df6
|
Adds checks for the NO_LOGS definition and improved the vars resolution time
|
2015-09-17 17:41:38 -03:00 |
|
Felipe Zimmerle
|
3e067e7409
|
Core is now ready to deal with SecRulesEngine set to Off
|
2015-09-17 10:59:56 -03:00 |
|
Felipe Zimmerle
|
11e1a67d58
|
Fix disruptive action flow while RuleEngine is in DetectionOnly
|
2015-09-17 10:51:44 -03:00 |
|
Felipe Zimmerle
|
490ad23e41
|
Uses macro expansion before apply redirect action
|
2015-09-17 09:30:39 -03:00 |
|
Felipe Zimmerle
|
90df21bbb1
|
Removes the \' from setvar before name the collections
|
2015-09-17 09:29:55 -03:00 |
|
Felipe Zimmerle
|
d0c215d78b
|
Adds support for the server log integration
|
2015-09-17 09:01:52 -03:00 |
|
Felipe Zimmerle
|
5228b685bf
|
Fix disruptive actions execution
|
2015-09-16 19:43:31 -03:00 |
|
Felipe Zimmerle
|
5b18db779e
|
Makes multipart debug messages goes over modsec debug log not stdout
|
2015-09-16 15:24:42 -03:00 |
|
Felipe Zimmerle
|
639ccf7ddc
|
Fix the rule execution debug log, so that tests won't complain
|
2015-09-16 15:16:04 -03:00 |
|
Felipe Zimmerle
|
7f747d1dd0
|
Fix multipart parser in crlf blobs
|
2015-09-16 15:01:53 -03:00 |
|
Felipe Zimmerle
|
e88d2120fb
|
Including space in the list of readable characters for debuglog
|
2015-09-16 14:25:03 -03:00 |
|
Felipe Zimmerle
|
9d60dc6df8
|
Adds macro expansion for all operators
|
2015-09-16 11:25:07 -03:00 |
|
Felipe Zimmerle
|
320bcde89e
|
Adds rule number to the debug logs and printing expaded variables
|
2015-09-16 11:24:15 -03:00 |
|
Felipe Zimmerle
|
4bf7f7a44c
|
Adds 'expandKeepOriginal' method to macro expansion class
|
2015-09-16 11:22:57 -03:00 |
|
Felipe Zimmerle
|
c425b24ffb
|
Extends redirect action to support url without quotes
|
2015-09-15 18:25:15 -03:00 |
|
Felipe Zimmerle
|
b1e845211c
|
Limits the variable size into the debuglogs and print it in hex if needed
|
2015-09-15 16:09:44 -03:00 |
|
Felipe Zimmerle
|
8772daec4d
|
Adds functions limitTo and toHexIfNeed into utils.cc
Those will be used in order to make the debug and audit logs
readable.
|
2015-09-15 16:07:03 -03:00 |
|
Felipe Zimmerle
|
97214edf6e
|
Fix multipart parser on binary content
|
2015-09-15 16:06:41 -03:00 |
|
Felipe Zimmerle
|
23d843259d
|
Fix rule.h include on modsecurity.cc and seclang-parser.yy
|
2015-09-15 16:05:29 -03:00 |
|
Felipe Zimmerle
|
a0a2d2c77e
|
Adds support to read request body from a file
|
2015-09-15 16:04:27 -03:00 |
|
Felipe Zimmerle
|
140a62a2b5
|
Changes rule_id to long in order to have it visible by systemtap
|
2015-09-11 12:41:36 -03:00 |
|
Felipe Zimmerle
|
2a8f45b895
|
Adds transformations removeComments and replaceComments to the seclang parsers
|
2015-09-11 12:41:09 -03:00 |
|
Felipe Zimmerle
|
3c53869915
|
Adds transformation normalisePath to seclang parser
|
2015-09-09 23:02:07 -03:00 |
|
Felipe Zimmerle
|
92563da930
|
Adds t:utf8toUnicode and variable XML to the seclang parser
|
2015-09-09 22:51:19 -03:00 |
|
Felipe Zimmerle
|
736183b7f1
|
Adds ctl:forceRequestBodyVariable to the seclang parser
|
2015-09-09 22:43:18 -03:00 |
|
Felipe Zimmerle
|
4095ae7b52
|
Adds action accuracy to the parser
|
2015-09-09 22:26:35 -03:00 |
|
Felipe Zimmerle
|
1079b5ba54
|
Adds action maturity to the parser
|
2015-09-09 22:19:07 -03:00 |
|
Felipe Zimmerle
|
09651baf9a
|
Adds action ver to the seclang parser
|
2015-09-09 22:10:45 -03:00 |
|
Felipe Zimmerle
|
254b29265e
|
Adds action expirevar to the parser and fix the line counting
|
2015-09-09 18:31:37 -03:00 |
|
Felipe Zimmerle
|
ee8b886371
|
Adds parser support to ctl:[auditEngine|ruleEngine]
|
2015-09-09 17:51:53 -03:00 |
|
Felipe Zimmerle
|
ec6a5a0cd2
|
Adds support to t:sha1 and t:hexEncode at seclang parser
|
2015-09-09 17:13:07 -03:00 |
|
Felipe Zimmerle
|
d1fa2cfa7b
|
Parser: Fix redirect action and adds SecRule first line-only comment syle
|
2015-09-09 15:10:38 -03:00 |
|
Felipe Zimmerle
|
5c3a4b608d
|
Adds support to SecMarker and skipAfter
|
2015-09-08 10:06:37 -03:00 |
|
Felipe Zimmerle
|
b048794f4e
|
Adds support to unconditional rules
|
2015-09-04 15:55:53 -03:00 |
|
Chaim Sanders
|
4e8bb276b8
|
Fixing compilation problem on newer versions of gcc (Fedora 22+)
|
2015-09-04 11:08:15 -03:00 |
|
Felipe Zimmerle
|
010c18f63f
|
Adds support to SecDefaultAction configuration directive
|
2015-09-04 10:56:04 -03:00 |
|
Felipe Zimmerle
|
f2ed890ea6
|
Now accept SecRules regardless of the letter case
|
2015-09-03 11:09:40 -03:00 |
|
Felipe Zimmerle
|
7afd93196d
|
Adds contains to the list of operators compatibles with the capture action
|
2015-09-03 09:38:19 -03:00 |
|
Felipe Zimmerle
|
3de845fac1
|
Fix macro expansion string replacement
It was removing more characters from the string than the actual %{variable}%
|
2015-09-03 09:38:19 -03:00 |
|
Felipe Zimmerle
|
45d81e1c04
|
Adds sanity check to the rule id action
|
2015-09-03 09:38:12 -03:00 |
|
Felipe Zimmerle
|
a63aa50f1b
|
Changes the default operator to be @rx not @pm
For some reason the default operator was @pm, which was a huge mistake.
The default operator is @rx, thanks for Sanders who have noticed that.
|
2015-09-02 18:31:02 -03:00 |
|
Felipe Zimmerle
|
ea4cd53221
|
Accepts phases with its name instead of a number
|
2015-09-02 18:31:02 -03:00 |
|
Felipe Zimmerle
|
035040cd13
|
Adds sanity check to confirm that the rule has an ID and it is not duplicated
|
2015-09-02 18:30:41 -03:00 |
|
Felipe Zimmerle
|
aae8036c0c
|
Cosmetics: Fix debug log message
|
2015-09-02 10:55:35 -03:00 |
|
Felipe Zimmerle
|
5d24b237bd
|
Fix default parts to be logged on audit logs
|
2015-09-02 10:55:35 -03:00 |
|
Felipe Zimmerle
|
fa4f72d90d
|
Adds support to ctl:auditLogParts variation
|
2015-09-02 10:55:29 -03:00 |
|
Felipe Zimmerle
|
e89e395a32
|
Fix various minor issues on the auditlog schema
|
2015-08-27 17:50:42 -03:00 |
|