Commit Graph

994 Commits

Author SHA1 Message Date
martinhsv
fbea73120c Fix: FILES variable does not use multipart part name for key 2021-01-24 15:06:30 -03:00
Felipe Zimmerle
f1f2527c03 Using setenv instead of putenv on SetEnv action 2021-01-24 14:59:59 -03:00
Felipe Zimmerle
e8bd2151f2 Having _NAMES, variables proxied
Some variables share content with others; that is the case
for ARGS and ARGS_NAMES. Those are different in value, as
ARGS_NAMES holds the key name as value.

Instead of duplicating the strings for the different
collections, this patch unifies the collection in radix,
avoiding memory fragmentation. It is currently doing some
fragmentation while resolving the variable, but to be
mitigated by shared_ptr is VariableValues, a different
change.

TODO: place others variables such as COOKIE*NAMES to use
the same proxy.
2021-01-24 11:30:22 -03:00
Felipe Zimmerle
3748d62f19 Changes copyright dates on the code 2021-01-19 09:24:37 -03:00
Felipe Zimmerle
9b40a045bb Cosmetics: fix some cppcheck complains to please QA 2021-01-13 13:30:04 -03:00
Felipe Zimmerle
f18595f428 Makes regular expression selection on collections key case insensitive
This issue was initially reported by @michaelgranzow-avi on #2296.

@airween made an initial attempt to provide a fixed at #2107; As a
consequence of the pull request review - provided by @victorhora,
@zimmerle, and @michaelgranzow-avi - @airween made a second attempt
at #2297. After reviewing by @martinhsv, @zimmerle, I have absorbed
the essential pieces from @airween patch into this one.

This patch differs from @airween's because @airween's patches were
partially working: Key exclusions with regex weren't covered, same
for anchored variables (e.g. ARGS). During the review, I have
highlighted the importance of having elementary test cases. A simple
test case on ARGS could spot the issue. Since that is an important
fix, I don't want to hold this for one more review cycle; therefore,
I am committing the fix myself.

Thank you all involved in the solution of this very own issue.
2020-12-10 10:05:07 -03:00
David Carlier
560f81200f Adding DragonFlyBSD support. 2020-12-10 09:51:03 -03:00
martinhsv
d72be1c470 Fix: Only delete Multipart tmp files after rules have run 2020-11-04 13:50:07 -03:00
Michael Granzow
1b7aa42c77 Issue-2423: Meta-actions like 'msg' should be applied at end of chain 2020-10-29 10:33:02 -03:00
martinhsv
2672db103e Add support for new operator rxGlobal 2020-10-26 08:55:07 -03:00
Felipe Zimmerle
4b425850cf Cosmetics: fix cppcheck warnings 2020-10-23 08:29:07 -03:00
martinhsv
8436c78993 Fix IP address logging in Section A 2020-10-16 13:14:42 -07:00
Felipe Zimmerle
995f22b3ce Having Bison 3.7.2 2020-10-14 13:58:37 -03:00
Felipe Zimmerle
377fb723ca Makes lua 5.1 workable again
Issue #2389
2020-09-21 10:04:40 -03:00
Felipe Zimmerle
8c85b78361 Adds support to lua 5.4 2020-08-17 11:08:03 -03:00
Felipe Zimmerle
ae3ad5eaa7 cosmetics: Address some cppcheck complains 2020-08-06 19:02:00 -03:00
Andrei Belov
fe12385148 GeoIP: switch to GEOIP_MEMORY_CACHE from GEOIP_INDEX_CACHE
Using GEOIP_INDEX_CACHE on some older versions of libGeoIP (e.g. 1.5.0
which is the default version on CentOS 7) leads to "Error reading file"
error while opening completely valid GeoIP.dat:

    # cat test.c
    #include <stdio.h>
    #include "GeoIP.h"

    int main(void) {
      GeoIP *g;

      g = GeoIP_open("/tmp/GeoIP.dat", GEOIP_INDEX_CACHE);

      if (g == NULL) {
        printf("error!\n");
      }

      GeoIP_delete(g);

      exit(0);
    }
    # cc -lGeoIP -o test test.c
    # ./test
    Error reading file /tmp/GeoIP.dat
    error!
    # sed -i -e 's,GEOIP_INDEX_CACHE,GEOIP_MEMORY_CACHE,' test.c
    # cc -lGeoIP -o test test.c
    # ./test
    # geoiplookup -f /tmp/GeoIP.dat -v 8.8.8.8
    GeoIP Country Edition: GEO-106FREE 20180327 Build 1 Copyright (c) 2018 MaxMind Inc All Rights Reserved

Also tested with recent GeoLite databases converted from new format
into legacy format, distributed here:

    https://mailfud.org/geoip-legacy/
2020-07-30 13:48:40 -03:00
martinhsv
b9620c26a0 rx:exit after full match; fix TX population after unused group 2020-06-29 06:13:45 -07:00
Felipe Zimmerle
7e0bc26917 Using performLogging function 2020-03-31 15:20:15 -03:00
Felipe Zimmerle
7a48245aed Creates RuleUnconditional
Makes RuleScript child of RuleWithActions instead of Operator
2020-03-31 14:44:19 -03:00
Felipe Zimmerle
f63bd1a45d Moves Rule[WithActions|WithOperator] to their own files 2020-03-31 13:33:38 -03:00
Felipe Zimmerle
8274be066a Refactoring: Having RuleMarker in a separated file 2020-03-31 12:45:46 -03:00
Felipe Zimmerle
bdedfd2463 Refactoring: Renames RuleBase to Rule 2020-03-31 12:26:13 -03:00
Felipe Zimmerle
59d4268882 Refactoring: renames Rule to RuleWithOperator 2020-03-31 10:00:08 -03:00
Felipe Zimmerle
8eb7b8fe6c Refactoring: Splits Rule into Rule and RuleWithActions 2020-03-30 20:22:37 -03:00
Felipe Zimmerle
43f8aee6b6 Splits Rule class into: Rule, RuleBase, RuleMarker 2020-03-30 20:21:36 -03:00
Felipe Zimmerle
fda03c0016 Yet another refactoring in Rule 2020-03-30 15:38:51 -03:00
Felipe Zimmerle
b66224853b Refactoring in Rule: Meaningful structures name 2020-03-27 17:43:43 -03:00
Felipe Zimmerle
96849c07de Makes action name a shared pointer 2020-03-27 16:13:15 -03:00
Felipe Zimmerle
9c526b3647 Avoids copy on the transformation operation 2020-03-27 16:12:55 -03:00
Felipe Zimmerle
8cfb289cea Lets reserve some memory for rule message 2020-03-27 15:49:02 -03:00
Felipe Zimmerle
a609249d64 Makes m_id a shared pointer 2020-03-27 15:48:11 -03:00
Felipe Zimmerle
343b86c2a7 Makes m_fileName a shared pointer 2020-03-27 15:00:22 -03:00
Felipe Zimmerle
14b2bd77a0 Makes m_uri_no_query_string_decoded a shared pointer 2020-03-27 14:46:56 -03:00
Felipe Zimmerle
d7d5cd2a91 Makes m_serverIpAddress a shared pointer 2020-03-27 14:46:43 -03:00
Felipe Zimmerle
8df35deadb Makes m_clientIpAddress a shared pointer 2020-03-27 14:22:20 -03:00
Felipe Zimmerle
f2f5c9c958 Removes reference counter from audit_log writer 2020-03-26 10:42:35 -03:00
Felipe Zimmerle
4b88fdc513 Removes reference counter from log write agent 2020-03-26 10:40:40 -03:00
Felipe Zimmerle
5ebfa5eacb Removes referece count from audit logs 2020-03-26 10:38:55 -03:00
Felipe Zimmerle
6b0ad8049a Having default actions as o shared pointer 2020-03-26 09:59:57 -03:00
Felipe Zimmerle
9d158611cf Makes Rule a shared pointer 2020-03-25 16:11:23 -03:00
Felipe Zimmerle
f1d22f9b02 Fix version check 2020-03-24 17:20:22 -03:00
Felipe Zimmerle
6367e6d5e9 Having a class Rules 2020-03-24 17:20:10 -03:00
Felipe Zimmerle
fb7714f202 Creates class RulesSetPhases 2020-03-24 14:00:28 -03:00
Felipe Zimmerle
88789a577f parser: Using bison 3.5.2 2020-03-11 14:21:11 -03:00
Felipe Zimmerle
1e26bf2078 Revert "Creates the RulesSetPhases clas"
This reverts commit 072e4edc53.
2020-03-11 08:17:56 -03:00
Felipe Zimmerle
072e4edc53 Creates the RulesSetPhases clas 2020-03-05 07:13:02 -03:00
Felipe Zimmerle
6a742cdf76 Refactoring: Renames RulesProperties to RulesSetProperties 2020-02-17 13:17:03 -03:00
martinhsv
f57265a3e2 Support configurable limit on number of arguments processed 2020-02-14 11:00:01 -03:00
Felipe Zimmerle
4e9ba44d03 build: Keep the installation of rules.h 2020-02-13 09:16:35 -03:00