3034 Commits

Author SHA1 Message Date
WGH
592c8f0b19
Make all "rule id" variables of type RuleId
Previously, ModSecurity inconsistently used RuleId, int and double for
rule id variables in different places.
2021-01-12 13:01:21 -03:00
Felipe Zimmerle
bf98e3424f
Makes RuleWithActions const in run time operations 2021-01-12 13:01:21 -03:00
Felipe Zimmerle
6a5ff56c8e
Introduces ActionWithExecution 2021-01-12 13:01:21 -03:00
Felipe Zimmerle
838ff53ed4
Makes Lua::run const 2021-01-12 13:01:21 -03:00
Felipe Zimmerle
4c1ca56259
Removes method isDisruptive from Action class 2021-01-12 13:01:21 -03:00
Felipe Zimmerle
a79bfa5c28
Action: make sure that null constructor is not used 2021-01-12 13:01:20 -03:00
Felipe Zimmerle
c7813a1973
Computes auditlog during rules load time 2021-01-12 13:01:20 -03:00
Felipe Zimmerle
d6e8352873
actions: Removes Rule parameter from runtime execute
Generals organization on the Action class
2021-01-12 13:01:20 -03:00
Felipe Zimmerle
1b705aeb54
actions: Compute the rule association during rules load 2021-01-12 13:01:20 -03:00
Felipe Zimmerle
6ea4340a15
tests: Romoves unused header from a test case 2021-01-12 13:01:20 -03:00
Felipe Zimmerle
65f73442e7
tests: Prints test number on segfault 2021-01-12 13:01:20 -03:00
Felipe Zimmerle
69d1112da3
Replaces lower case implementation 2021-01-12 13:01:20 -03:00
Felipe Zimmerle
1d33015934
Makes operator to use string_view 2021-01-12 13:01:19 -03:00
Felipe Zimmerle
9699ec7f44
Improves rules dump for better testing 2021-01-12 13:01:19 -03:00
Felipe Zimmerle
62d894f98e
Better error handling when loading configurations 2021-01-12 13:01:19 -03:00
Felipe Zimmerle
303a4a3b2e
Adds method getVariableNames to variables 2021-01-12 13:01:19 -03:00
Felipe Zimmerle
7d03e3505a
Cosmetics: Defining a type for RuleId 2021-01-12 13:01:19 -03:00
Felipe Zimmerle
1071fadfd7
Moves rule* headers to src/ 2021-01-12 13:01:19 -03:00
Felipe Zimmerle
8191b7efc8
Cleanup on Action class 2021-01-12 13:01:19 -03:00
Felipe Zimmerle
73dfd3aa5f
Removes RuleMessage from action execute signature 2021-01-12 13:01:18 -03:00
Felipe Zimmerle
7640f7b40b
Refactoring: Makes transformations to work with new execute signature 2021-01-12 13:01:18 -03:00
nikolas
3c0c4a8ba0
Move travis to use a new version of Ubuntu 2021-01-12 13:01:18 -03:00
Felipe Zimmerle
08e63662e8
Cosmetics: fix some cppcheck complains 2021-01-12 13:01:18 -03:00
Felipe Zimmerle
affdc49a9e
Refactoring: rename evaluate to execute on actions 2021-01-12 13:01:18 -03:00
Felipe Zimmerle
47ec32fba8
Refactoring in the Rule class to make it more elegant 2021-01-12 13:01:18 -03:00
Felipe Zimmerle
ff79de3237
Rule: isMarker is no longer necessary 2021-01-12 13:01:17 -03:00
Felipe Zimmerle
be4d242a75
Adds new method for rule merge
IMPORTANT: SecDefaultAction specified on a child configuration will
overwrite the ones specified on the parent; Previously it was
concatenating.
2021-01-12 13:01:17 -03:00
Felipe Zimmerle
7d1c37a42b
Moves default actions to be part of the rules 2021-01-12 13:01:17 -03:00
martinhsv
89c63387f2
Fix: FILES variable does not use multipart part name for key 2021-01-12 13:01:17 -03:00
marshal09
409c5e491d
Add new transformation call phpArgsNames 2021-01-12 13:01:17 -03:00
LEI BAO
310cbf899b Fix the typo 2021-01-06 08:44:42 -03:00
Felipe Zimmerle
f18595f428
Makes regular expression selection on collections key case insensitive
This issue was initially reported by @michaelgranzow-avi on #2296.

@airween made an initial attempt to provide a fixed at #2107; As a
consequence of the pull request review - provided by @victorhora,
@zimmerle, and @michaelgranzow-avi - @airween made a second attempt
at #2297. After reviewing by @martinhsv, @zimmerle, I have absorbed
the essential pieces from @airween patch into this one.

This patch differs from @airween's because @airween's patches were
partially working: Key exclusions with regex weren't covered, same
for anchored variables (e.g. ARGS). During the review, I have
highlighted the importance of having elementary test cases. A simple
test case on ARGS could spot the issue. Since that is an important
fix, I don't want to hold this for one more review cycle; therefore,
I am committing the fix myself.

Thank you all involved in the solution of this very own issue.
2020-12-10 10:05:07 -03:00
David Carlier
560f81200f Adding DragonFlyBSD support. 2020-12-10 09:51:03 -03:00
Aleks
afefda53c6 Fix Path to projekt logo 2020-11-16 09:15:26 -03:00
martinhsv
d72be1c470
Fix: Only delete Multipart tmp files after rules have run 2020-11-04 13:50:07 -03:00
Michael Granzow
1b7aa42c77
Issue-2423: Meta-actions like 'msg' should be applied at end of chain 2020-10-29 10:33:02 -03:00
martinhsv
2672db103e
Add support for new operator rxGlobal 2020-10-26 08:55:07 -03:00
Felipe Zimmerle
785958f9b5
Fix maxminddb link on FreeBSD
Issue #2131
2020-10-23 14:44:54 -03:00
Felipe Zimmerle
4b425850cf
Cosmetics: fix cppcheck warnings 2020-10-23 08:29:07 -03:00
martinhsv
8da787a390
Merge pull request #2424 from martinhsv/v3/master
Fix IP address logging in Section A
2020-10-19 09:09:05 -04:00
martinhsv
8436c78993
Fix IP address logging in Section A 2020-10-16 13:14:42 -07:00
Felipe Zimmerle
995f22b3ce
Having Bison 3.7.2 2020-10-14 13:58:37 -03:00
Felipe Zimmerle
377fb723ca
Makes lua 5.1 workable again
Issue #2389
2020-09-21 10:04:40 -03:00
Felipe Zimmerle
e9dce44f6a
build: Minor fixies on Lua detection 2020-08-18 09:19:51 -03:00
Felipe Zimmerle
9e6d8b7bbc
CHANGES: Adds support to lua 5.4 2020-08-17 11:35:51 -03:00
Felipe Zimmerle
8c85b78361
Adds support to lua 5.4 2020-08-17 11:08:03 -03:00
Felipe Zimmerle
ae3ad5eaa7
cosmetics: Address some cppcheck complains 2020-08-06 19:02:00 -03:00
Felipe Zimmerle
51d06d7a8e
CHANGES: Adds info about #2378 2020-07-30 13:51:33 -03:00
Andrei Belov
fe12385148 GeoIP: switch to GEOIP_MEMORY_CACHE from GEOIP_INDEX_CACHE
Using GEOIP_INDEX_CACHE on some older versions of libGeoIP (e.g. 1.5.0
which is the default version on CentOS 7) leads to "Error reading file"
error while opening completely valid GeoIP.dat:

    # cat test.c
    #include <stdio.h>
    #include "GeoIP.h"

    int main(void) {
      GeoIP *g;

      g = GeoIP_open("/tmp/GeoIP.dat", GEOIP_INDEX_CACHE);

      if (g == NULL) {
        printf("error!\n");
      }

      GeoIP_delete(g);

      exit(0);
    }
    # cc -lGeoIP -o test test.c
    # ./test
    Error reading file /tmp/GeoIP.dat
    error!
    # sed -i -e 's,GEOIP_INDEX_CACHE,GEOIP_MEMORY_CACHE,' test.c
    # cc -lGeoIP -o test test.c
    # ./test
    # geoiplookup -f /tmp/GeoIP.dat -v 8.8.8.8
    GeoIP Country Edition: GEO-106FREE 20180327 Build 1 Copyright (c) 2018 MaxMind Inc All Rights Reserved

Also tested with recent GeoLite databases converted from new format
into legacy format, distributed here:

    https://mailfud.org/geoip-legacy/
2020-07-30 13:48:40 -03:00
martinhsv
0eb3c123f4
Merge pull request #2348 from martinhsv/v3/master
rx:exit after full match; fix TX population after unused group
2020-07-06 07:54:44 -04:00