Felipe Zimmerle
96865a92d3
Adds fuzzyHash operator
...
The fuzzyHash operator can be used to match files. In conjuntcion
with FILES_TMP_CONTENT collection it can scan uploaded files and
try to match it with a pre caculated list of know malicious content,
more details on how it works can be found on ssdeep website:
http://ssdeep.sourceforge.net/
2014-11-14 11:53:39 -08:00
Felipe Zimmerle
0037a0732a
Using RadixTree instead of list to storage IPs
...
Used by the operator @ipMatch and variants, this structure storage all the IPs
addresses for later comparison. Last version was using RadixTree only if the
set of IPs was specified from files. IPs specified as parameters, was using
a chained list. Chained lists may affect the performance, since lookups in
worst case will be O(n). RadixTrees could provide better results depending
on the amount of elements and its contents.
2014-03-31 16:22:10 -07:00
David Andrews
27dd513ab6
Flip allocations that happen during initialization (typically) over to use non-global apr memory pools.
2014-03-03 08:00:53 -08:00
Breno Silva
aa18ec7f45
Updated copyright dates
2013-04-19 03:20:46 -04:00
brenosilva
d88a24da1f
fix rsub input parsing and add maturity, ver and accuracy actions
2012-06-04 15:29:51 +00:00
brenosilva
866cb6d6b4
Update trunk for 2.7
2012-05-10 23:18:39 +00:00
brenosilva
b0e9468d6e
MODSEC-249
2011-08-31 16:53:11 +00:00
brenosilva
6b7edc4d47
Fixes, code cleanups, improvements
2011-04-27 15:58:22 +00:00
brenosilva
d68731a38b
APR-Ipmatch operator
2011-04-16 21:25:30 +00:00
brenosilva
30da07b59b
MODSEC-37
2011-04-12 13:49:07 +00:00
brenosilva
b64d28eb5a
Testing new approach to tag macro expansion
2011-04-03 21:54:12 +00:00
brenosilva
f524cfee48
Testing new approach to tag macro expansion
2011-04-03 20:53:15 +00:00
brenosilva
2ff42243fa
Add escape option to rsub and rbl improvements
2011-03-31 17:15:37 +00:00
brenosilva
104f0de46e
New License
2011-03-30 14:12:44 +00:00
brenosilva
49732256f6
Improvements, fixes and new features
2011-03-25 13:51:13 +00:00
brenosilva
d170dd4ebe
MODSEC-57
2011-02-24 15:03:50 +00:00
brenosilva
e0a49f0b04
Change ipmatch to msre_ipmatch
2011-02-21 12:53:02 +00:00
brenosilva
882e537c92
MODSEC-140
2011-02-17 16:52:45 +00:00
brenosilva
7f52d86e4b
Include data edition, sanitizematched and few fixes
2011-02-14 12:49:55 +00:00
brenosilva
549f059480
move 2.5.13 into trunk
2010-12-08 18:58:18 +00:00
b1v1r
058283fb5a
Add the ability to build custom request body parser extensions.
...
Add an example for a request body parser extension.
2010-05-05 23:01:11 +00:00
b1v1r
08edc0c26f
Merge 2.5.x (2.5.12) changes into trunk.
2010-02-05 19:05:20 +00:00
b1v1r
dc0a2161ac
Merge 2.5.9 changes into trunk.
2009-03-12 15:31:10 +00:00
brectanus
10713fbd37
Sync up branches/2.5.x and trunk.
2008-07-31 22:36:24 +00:00
brectanus
f394c6faa2
Add atomic updates for persistent counters. See #20 .
2008-05-13 00:05:02 +00:00
brectanus
e4eaade2ca
Make Lua support optional since it is still experimental (--without-lua). If someone still uses SecRuleScript, however, it iignores it and just warns on Apache startup.
2008-02-16 00:27:44 +00:00
brectanus
f428d37680
Cleanup - remove extraneous whitespace and tabs.
2008-02-07 21:45:05 +00:00
brectanus
a3584993f5
Implement "block" pseudo-action. See #441 .
2008-01-24 05:16:35 +00:00
brectanus
c4e1ede358
Fixed merging actionsets so we can build a more accurate rule for auditing.
2008-01-22 05:39:33 +00:00
brectanus
0d24a08f33
Implemented SecRuleUpdateActionById. See #442 .
2008-01-19 02:23:41 +00:00
brectanus
b5033e6e29
It is 2008 now :)
2008-01-11 00:00:31 +00:00
brectanus
c622e7ec93
Expand PERFORMANCE_MEASUREMENT output to break down the full rule timing into transformation, operator and full.
...
Add a "Transformation completed in N usec." debug line to compliment the operator timing.
2008-01-08 16:21:40 +00:00
ivanr
2068357af8
Added m.getvars() and finalised Lua support.
2007-12-21 12:50:03 +00:00
ivanr
4414cb8527
Lua: Support retrieval of individual variables from scripts.
2007-12-19 14:35:20 +00:00
ivanr
afd3cbf14f
Implemented SecRuleScript LUA_SCRIPT [ACTIONS].
2007-12-19 11:22:52 +00:00
brectanus
715a8eae58
Implement SecMarker. See #416 .
2007-12-11 17:53:50 +00:00
brectanus
22873995f7
Rename placeholder type from RULE_PH_TARGET to RULE_PH_SKIPAFTER.
2007-12-02 16:26:05 +00:00
brectanus
dcdce0cbc5
Added matching rules to audit log data. See #93 .
2007-11-30 00:52:21 +00:00
brectanus
9447ae67b8
Added placeholder support for skipAfter so that it works with removed rules. See #258 .
2007-11-26 22:27:15 +00:00
brectanus
e45ea12fc8
Fix warnings on Solaris and/or 64bit builds.
2007-11-02 22:31:47 +00:00
brectanus
9d49adf028
Basic implementation of skipAfter (still need to implement placeholders so it works with removed rules). See #258 .
2007-10-17 19:59:28 +00:00
ivanr
a1955d09e3
Add crude performance measurement.
2007-09-24 23:59:42 +00:00
brectanus
8f6385f784
Added logdata action (still needs byte limit). See #40 .
2007-08-10 00:22:15 +00:00
brectanus
5a6ce01429
Added logging of target variable expansion. See #62 .
2007-08-08 14:48:49 +00:00
brectanus
72832c1b32
Working on cache enhancements. See trac #14 .
2007-08-02 20:25:06 +00:00
brectanus
81d0f84ad3
Update copyright text to Breach Security, Inc.
...
Merge in changes from branches/2.1.x
2007-06-14 16:05:45 +00:00
brectanus
dd6755985c
Move the transformation cache recort into re.h. See #14 .
2007-06-05 18:20:44 +00:00
brectanus
e5c00d156a
Added rule file/line to audit log messages. See #49 .
2007-06-01 15:32:08 +00:00
brectanus
a68eb04884
Add geo lookup support. See #22 .
2007-05-11 16:14:11 +00:00
brectanus
c0c5d8d894
Removed extraneous symbols from dso via DSOLOCAL.
2007-05-03 16:17:42 +00:00
