brectanus
3232a2d41e
Fix debug log "Expanded" msg to only print when expanded.
2008-02-04 18:21:27 +00:00
brectanus
ed581b56f4
Revert part of the noauditlog fix in changelog:878. See #451 .
2008-01-28 22:10:12 +00:00
brectanus
4c6dccada2
Fixed noauditlog. See #451 .
2008-01-25 05:52:49 +00:00
brectanus
52ccced72b
Cleanup building actionsets and use minimal default. See #445 .
...
Fully resolve all rules before logging.
2008-01-25 04:52:49 +00:00
brectanus
946a350043
Fixed removing cained rules with ctl action.
2008-01-24 22:39:13 +00:00
brectanus
09ada31a28
Fixed potential crash if actionset was NULL. See #441 and #442 .
2008-01-24 18:08:39 +00:00
brectanus
a3584993f5
Implement "block" pseudo-action. See #441 .
2008-01-24 05:16:35 +00:00
brectanus
18e9ef0808
Remove default transformations. See #445 .
2008-01-22 05:50:42 +00:00
brectanus
c4e1ede358
Fixed merging actionsets so we can build a more accurate rule for auditing.
2008-01-22 05:39:33 +00:00
brectanus
0d24a08f33
Implemented SecRuleUpdateActionById. See #442 .
2008-01-19 02:23:41 +00:00
brectanus
f4a44bc320
Remove an extraneous debug log.
2008-01-18 01:02:29 +00:00
brectanus
9fb03d277d
Fixing code based on review comments...
...
Cleaned up what vars are cacheable.
Added parens around "*foo++" where it clarified the operation to be "*(foo++)".
Added " at VARNAME" to operator matches where needed.
Escaped var->name in the var generation (user-supplied data).
Marked a bunch of TODOs as ENHs instead.
Transformed some C++ style comments to C style.
Removed the %0-9 macros code which was commented out.
Optimized some ctl action code so that multiple ifs are else ifs.
Implemented some error messages marked as ENH.
Make commented out acmp debugging a configure-time option.
Cleanup GEO debug log messages.
Added relative filename support for geo dbs.
Added help text to Sec* directives.
2008-01-18 00:47:30 +00:00
brectanus
99c41afc3d
Added a check that SecServerSignature actually worked (Apache changed some of this code as of 2.2.4 and could potentially change it again and break this).
...
Cleaned up some configure code.
Cleaned up some extraneous cache logging.
Cleaned up the output from the test script.
2008-01-14 22:32:53 +00:00
brectanus
b5033e6e29
It is 2008 now :)
2008-01-11 00:00:31 +00:00
brectanus
106a54f876
Fixed partial transformation caching and reduced some debugging output.
2008-01-09 00:52:51 +00:00
brectanus
31e3ada844
Fixed phase 5 rules not being excludable.
2008-01-08 20:45:54 +00:00
brectanus
c622e7ec93
Expand PERFORMANCE_MEASUREMENT output to break down the full rule timing into transformation, operator and full.
...
Add a "Transformation completed in N usec." debug line to compliment the operator timing.
2008-01-08 16:21:40 +00:00
ivanr
2068357af8
Added m.getvars() and finalised Lua support.
2007-12-21 12:50:03 +00:00
ivanr
f64c7c39e8
Lua: Added support for scripting to @inspectFile.
2007-12-20 15:53:23 +00:00
ivanr
4cecdf4c5b
Added support for Lua to the exec action.
2007-12-20 12:06:30 +00:00
ivanr
e357bb55af
Add quoting to unparsed rule generation.
2007-12-19 16:11:32 +00:00
ivanr
aef5a460b6
Fix Lua support. Enable logging from Lua scripts (using m.log()).
2007-12-19 12:50:21 +00:00
ivanr
afd3cbf14f
Implemented SecRuleScript LUA_SCRIPT [ACTIONS].
2007-12-19 11:22:52 +00:00
ivanr
6f6934e9d3
Code polish.
2007-12-19 09:22:58 +00:00
brectanus
8360aacc22
Use use new msr->rule_was_intercepted flag. See #425 .
2007-12-17 19:58:35 +00:00
brectanus
cd51a10046
Allow all rules to run in phase 5. See #425 .
2007-12-14 22:34:16 +00:00
brectanus
4c11791a94
Escape cache value in log.
2007-12-14 00:42:04 +00:00
brectanus
715a8eae58
Implement SecMarker. See #416 .
2007-12-11 17:53:50 +00:00
brectanus
2bf4556cd0
Checkin fix to rule removal code to avoid placeholders.
2007-12-02 15:35:09 +00:00
brectanus
a6c2d867f4
Improvements to audit logging matching rules. See #93 .
2007-11-30 21:31:12 +00:00
brectanus
dcdce0cbc5
Added matching rules to audit log data. See #93 .
2007-11-30 00:52:21 +00:00
brectanus
85053718d9
Cleanup log output for skipAfter. See #258 .
2007-11-29 23:14:02 +00:00
brectanus
8cec4dd251
Some more debugging and fixes for skipAfter. See #258 .
2007-11-28 01:04:26 +00:00
brectanus
e47fdeb420
Changed %p formatter to APRs %pp (wish that was documented).
...
Marked msr_log() as a printf style function so GNU compiler can check formatting types.
Fixed a few other warnings with msr_log() formatters.
2007-11-26 22:53:51 +00:00
brectanus
9447ae67b8
Added placeholder support for skipAfter so that it works with removed rules. See #258 .
2007-11-26 22:27:15 +00:00
brectanus
aff6900539
Initial full pass through code to fix issues with 64-bit/mismatch sign/mismatch size printf style formatters.
...
Still need to look more into how we are handling time and convert to apr_time_t (or time_t) where appropriate.
Still need to look into our use of 'long' as windows is LLP64 where 'long' is still 32-bit.
2007-11-15 19:09:14 +00:00
brectanus
9d49adf028
Basic implementation of skipAfter (still need to implement placeholders so it works with removed rules). See #258 .
2007-10-17 19:59:28 +00:00
brectanus
974298a76c
Added ctl:ruleRemoveById action. See #259 .
2007-10-17 19:11:47 +00:00
brectanus
9efa02f423
Change ctl parameters to be case insensitive.
...
Initial implementation of ctl:removeRuleById. See #259 .
2007-10-16 00:14:42 +00:00
brectanus
793b576701
Added support for MATCHED_VAR and MATCHED_VAR_NAME. See #123 .
2007-10-15 16:50:36 +00:00
brectanus
b784e6cb73
Change from TX:LAST_MATCHED_VAR_NAME to MATCHED_VAR. See #123 .
2007-10-03 00:23:46 +00:00
brectanus
da1399f0b8
Added TX:LAST_MATCHED_VAR_NAME. See #123 .
2007-10-01 22:35:52 +00:00
brectanus
e0e031d163
Oops, too fast to blame apr :) This bug was a forgotten NULL in the apr_pstrcat function. Apparently newer APRs can handle this.
2007-10-01 19:05:34 +00:00
brectanus
dc71842cee
Revert to apr_psprintf (vs apr_pstrcat) to get around what appears to be an apr bug with FC4.
2007-10-01 18:45:06 +00:00
brectanus
2d526f1434
Fix typo in a comment.
2007-10-01 17:23:38 +00:00
brectanus
8b6f0e72a7
Wrap PERFORMANCE_MEASUREMENT variable as conditional compile.
2007-09-27 21:38:33 +00:00
brectanus
63a47c370e
Prefer %d string formatter to %i so we do not get warnings on some platforms.
2007-09-27 21:34:29 +00:00
ivanr
a1955d09e3
Add crude performance measurement.
2007-09-24 23:59:42 +00:00
brectanus
8f6385f784
Added logdata action (still needs byte limit). See #40 .
2007-08-10 00:22:15 +00:00
brectanus
9cfdd8f0d2
Rename TX_SEVERITY to HIGHEST_SEVERITY, fix and document.
2007-08-09 14:32:02 +00:00
