mirror of
https://github.com/owasp-modsecurity/ModSecurity.git
synced 2025-08-14 05:45:59 +03:00
96a1f55e16
Instead of reading the fuzzy db on every invocation, read and store the db contents during initialization and store the contents in memory. The only significant behavior change here is that a change in db contents now (obviously) requires a daemon restart, as no API is provided to flush the list of ssdeep chunks.
424 lines
15 KiB
C
424 lines
15 KiB
C
/*
|
||
* ModSecurity for Apache 2.x, http://www.modsecurity.org/
|
||
* Copyright (c) 2004-2013 Trustwave Holdings, Inc. (http://www.trustwave.com/)
|
||
*
|
||
* You may not use this file except in compliance with
|
||
* the License. You may obtain a copy of the License at
|
||
*
|
||
* http://www.apache.org/licenses/LICENSE-2.0
|
||
*
|
||
* If any of the files related to licensing are missing or if you have any
|
||
* other questions related to licensing please contact Trustwave Holdings, Inc.
|
||
* directly using the email address security@modsecurity.org.
|
||
*/
|
||
|
||
#ifndef _MSC_RE_H_
|
||
#define _MSC_RE_H_
|
||
|
||
#define ABSOLUTE_VALUE 0
|
||
#define POSITIVE_VALUE 1
|
||
#define NEGATIVE_VALUE 2
|
||
|
||
typedef struct msre_engine msre_engine;
|
||
typedef struct msre_ruleset msre_ruleset;
|
||
typedef struct msre_ruleset_internal msre_ruleset_internal;
|
||
typedef struct msre_rule msre_rule;
|
||
typedef struct msre_var_metadata msre_var_metadata;
|
||
typedef struct msre_var msre_var;
|
||
typedef struct msre_op_metadata msre_op_metadata;
|
||
typedef struct msre_tfn_metadata msre_tfn_metadata;
|
||
typedef struct msre_actionset msre_actionset;
|
||
typedef struct msre_action_metadata msre_action_metadata;
|
||
typedef struct msre_action msre_action;
|
||
typedef struct msre_reqbody_processor_metadata msre_reqbody_processor_metadata;
|
||
typedef struct msre_cache_rec msre_cache_rec;
|
||
|
||
#include "apr_general.h"
|
||
#include "apr_tables.h"
|
||
#include "modsecurity.h"
|
||
#include "msc_pcre.h"
|
||
#include "msc_tree.h"
|
||
#include "persist_dbm.h"
|
||
#include "apache2.h"
|
||
#include "http_config.h"
|
||
|
||
#if defined(WITH_LUA)
|
||
#include "msc_lua.h"
|
||
#endif
|
||
|
||
/* Actions, variables, functions and operator functions */
|
||
char DSOLOCAL *update_rule_target_ex(modsec_rec *msr, msre_ruleset *ruleset, msre_rule *rule, const char *p2,
|
||
const char *p3);
|
||
|
||
int DSOLOCAL msre_ruleset_rule_matches_exception(msre_rule *rule, rule_exception *re);
|
||
|
||
char DSOLOCAL *msre_ruleset_rule_update_target_matching_exception(modsec_rec *msr, msre_ruleset *ruleset, rule_exception *re,
|
||
const char *p2, const char *p3);
|
||
|
||
char DSOLOCAL *msre_ruleset_phase_rule_update_target_matching_exception(modsec_rec *msr, msre_ruleset *ruleset, rule_exception *re,
|
||
apr_array_header_t *phase_arr, const char *p2, const char *p3);
|
||
|
||
apr_status_t DSOLOCAL collection_original_setvar(modsec_rec *msr, const char *col_name, const msc_string *orig_var);
|
||
|
||
int DSOLOCAL expand_macros(modsec_rec *msr, msc_string *var, msre_rule *rule, apr_pool_t *mptmp);
|
||
|
||
msre_var_metadata DSOLOCAL *msre_resolve_var(msre_engine *engine, const char *name);
|
||
|
||
msre_var DSOLOCAL *msre_create_var_ex(apr_pool_t *pool, msre_engine *engine, const char *name, const char *param,
|
||
modsec_rec *msr, char **error_msg);
|
||
|
||
int DSOLOCAL msre_parse_generic(apr_pool_t *pool, const char *text, apr_table_t *vartable,
|
||
char **error_msg);
|
||
|
||
int DSOLOCAL rule_id_in_range(int ruleid, const char *range);
|
||
|
||
msre_var DSOLOCAL *generate_single_var(modsec_rec *msr, msre_var *var, apr_array_header_t *tfn_arr,
|
||
msre_rule *rule, apr_pool_t *mptmp);
|
||
|
||
#if defined(WITH_LUA)
|
||
apr_table_t DSOLOCAL *generate_multi_var(modsec_rec *msr, msre_var *var, apr_array_header_t *tfn_arr,
|
||
msre_rule *rule, apr_pool_t *mptmp);
|
||
#endif
|
||
|
||
/* Structures with the corresponding functions */
|
||
|
||
struct msre_engine {
|
||
apr_pool_t *mp;
|
||
apr_table_t *variables;
|
||
apr_table_t *operators;
|
||
apr_table_t *actions;
|
||
apr_table_t *tfns;
|
||
apr_table_t *reqbody_processors;
|
||
};
|
||
|
||
msre_engine DSOLOCAL *msre_engine_create(apr_pool_t *parent_pool);
|
||
|
||
void DSOLOCAL msre_engine_destroy(msre_engine *engine);
|
||
|
||
msre_op_metadata DSOLOCAL *msre_engine_op_resolve(msre_engine *engine, const char *name);
|
||
|
||
struct msre_ruleset {
|
||
apr_pool_t *mp;
|
||
msre_engine *engine;
|
||
|
||
apr_array_header_t *phase_request_headers;
|
||
apr_array_header_t *phase_request_body;
|
||
apr_array_header_t *phase_response_headers;
|
||
apr_array_header_t *phase_response_body;
|
||
apr_array_header_t *phase_logging;
|
||
};
|
||
|
||
apr_status_t DSOLOCAL msre_ruleset_process_phase(msre_ruleset *ruleset, modsec_rec *msr);
|
||
|
||
apr_status_t DSOLOCAL msre_ruleset_process_phase_internal(msre_ruleset *ruleset, modsec_rec *msr);
|
||
|
||
msre_ruleset DSOLOCAL *msre_ruleset_create(msre_engine *engine, apr_pool_t *mp);
|
||
|
||
int DSOLOCAL msre_ruleset_rule_add(msre_ruleset *ruleset, msre_rule *rule, int phase);
|
||
|
||
msre_rule DSOLOCAL *msre_ruleset_fetch_rule(msre_ruleset *ruleset, const char *id, int offset);
|
||
|
||
int DSOLOCAL msre_ruleset_rule_remove_with_exception(msre_ruleset *ruleset, rule_exception *re);
|
||
|
||
/*
|
||
int DSOLOCAL msre_ruleset_phase_rule_remove_with_exception(msre_ruleset *ruleset, rule_exception *re,
|
||
apr_array_header_t *phase_arr);
|
||
*/
|
||
|
||
#define RULE_NO_MATCH 0
|
||
#define RULE_MATCH 1
|
||
|
||
#define RULE_PH_NONE 0 /* Not a placeholder */
|
||
#define RULE_PH_SKIPAFTER 1 /* Implicit placeholder for skipAfter */
|
||
#define RULE_PH_MARKER 2 /* Explicit placeholder for SecMarker */
|
||
|
||
#define RULE_TYPE_NORMAL 0 /* SecRule */
|
||
#define RULE_TYPE_ACTION 1 /* SecAction */
|
||
#define RULE_TYPE_MARKER 2 /* SecMarker */
|
||
#if defined(WITH_LUA)
|
||
#define RULE_TYPE_LUA 3 /* SecRuleScript */
|
||
#endif
|
||
|
||
struct msre_rule {
|
||
apr_array_header_t *targets;
|
||
const char *op_name;
|
||
const char *op_param;
|
||
void *op_param_data;
|
||
msre_op_metadata *op_metadata;
|
||
unsigned int op_negated;
|
||
msre_actionset *actionset;
|
||
const char *p1;
|
||
const char *unparsed;
|
||
const char *filename;
|
||
int line_num;
|
||
int placeholder;
|
||
int type;
|
||
|
||
msre_ruleset *ruleset;
|
||
msre_rule *chain_starter;
|
||
#if defined(PERFORMANCE_MEASUREMENT)
|
||
unsigned int execution_time;
|
||
unsigned int trans_time;
|
||
unsigned int op_time;
|
||
#endif
|
||
|
||
#if defined(WITH_LUA)
|
||
/* Compiled Lua script. */
|
||
msc_script *script;
|
||
#endif
|
||
|
||
#if AP_SERVER_MAJORVERSION_NUMBER > 1 && AP_SERVER_MINORVERSION_NUMBER > 0
|
||
ap_regex_t *sub_regex;
|
||
#else
|
||
regex_t *sub_regex;
|
||
#endif
|
||
char *sub_str;
|
||
char *re_str;
|
||
int re_precomp;
|
||
int escape_re;
|
||
|
||
TreeRoot *ip_op;
|
||
};
|
||
|
||
char DSOLOCAL *msre_rule_generate_unparsed(apr_pool_t *pool, const msre_rule *rule, const char *targets, const char *args, const char *actions);
|
||
|
||
msre_rule DSOLOCAL *msre_rule_create(msre_ruleset *ruleset, int type,
|
||
const char *fn, int line, const char *targets,
|
||
const char *args, const char *actions, char **error_msg);
|
||
|
||
#if defined(WITH_LUA)
|
||
msre_rule DSOLOCAL *msre_rule_lua_create(msre_ruleset *ruleset,
|
||
const char *fn, int line, const char *script_filename,
|
||
const char *actions, char **error_msg);
|
||
#endif
|
||
|
||
#define VAR_SIMPLE 0 /* REQUEST_URI */
|
||
#define VAR_LIST 1
|
||
|
||
#define PHASE_REQUEST_HEADERS 1
|
||
#define PHASE_REQUEST_BODY 2
|
||
#define PHASE_RESPONSE_HEADERS 3
|
||
#define PHASE_RESPONSE_BODY 4
|
||
#define PHASE_LOGGING 5
|
||
|
||
typedef int (*fn_op_param_init_t)(msre_rule *rule, char **error_msg);
|
||
typedef int (*fn_op_execute_t)(modsec_rec *msr, msre_rule *rule, msre_var *var, char **error_msg);
|
||
|
||
struct msre_op_metadata {
|
||
const char *name;
|
||
fn_op_param_init_t param_init;
|
||
fn_op_execute_t execute;
|
||
};
|
||
|
||
typedef int (*fn_tfn_execute_t)(apr_pool_t *pool, unsigned char *input, long int input_length, char **rval, long int *rval_length);
|
||
|
||
struct msre_tfn_metadata {
|
||
const char *name;
|
||
|
||
/* Functions should populate *rval and return 1 on
|
||
* success, or return -1 on failure (in which case *rval
|
||
* should contain the error message. Strict functions
|
||
* (those that validate in
|
||
* addition to transforming) can return 0 when input
|
||
* fails validation. Functions are free to perform
|
||
* in-place transformation, or to allocate a new buffer
|
||
* from the provideded temporary (per-rule) memory pool.
|
||
*
|
||
* NOTE Strict transformation functions not supported yet.
|
||
*/
|
||
fn_tfn_execute_t execute;
|
||
};
|
||
|
||
void DSOLOCAL msre_engine_tfn_register(msre_engine *engine, const char *name,
|
||
fn_tfn_execute_t execute);
|
||
|
||
void DSOLOCAL msre_engine_op_register(msre_engine *engine, const char *name,
|
||
fn_op_param_init_t fn1, fn_op_execute_t fn2);
|
||
|
||
void DSOLOCAL msre_engine_register_default_tfns(msre_engine *engine);
|
||
|
||
void DSOLOCAL msre_engine_register_default_variables(msre_engine *engine);
|
||
|
||
void DSOLOCAL msre_engine_register_default_operators(msre_engine *engine);
|
||
|
||
void DSOLOCAL msre_engine_register_default_actions(msre_engine *engine);
|
||
|
||
msre_tfn_metadata DSOLOCAL *msre_engine_tfn_resolve(msre_engine *engine, const char *name);
|
||
|
||
#define VAR_DONT_CACHE 0
|
||
#define VAR_CACHE 1
|
||
|
||
typedef char *(*fn_var_validate_t)(msre_ruleset *ruleset, msre_var *var);
|
||
typedef int (*fn_var_generate_t)(modsec_rec *msr, msre_var *var, msre_rule *rule, apr_table_t *table, apr_pool_t *mptmp);
|
||
|
||
struct msre_var_metadata {
|
||
const char *name;
|
||
unsigned int type; /* VAR_TYPE_ constants */
|
||
unsigned int argc_min;
|
||
unsigned int argc_max;
|
||
fn_var_validate_t validate;
|
||
fn_var_generate_t generate;
|
||
unsigned int is_cacheable; /* 0 - no, 1 - yes */
|
||
unsigned int availability; /* when does this variable become available? */
|
||
};
|
||
|
||
struct msre_var {
|
||
char *name;
|
||
const char *value;
|
||
unsigned int value_len;
|
||
char *param;
|
||
const void *param_data;
|
||
msre_var_metadata *metadata;
|
||
msc_regex_t *param_regex;
|
||
unsigned int is_negated;
|
||
unsigned int is_counting;
|
||
};
|
||
|
||
|
||
struct msre_actionset {
|
||
apr_table_t *actions;
|
||
|
||
/* Metadata */
|
||
const char *id;
|
||
const char *rev;
|
||
const char *msg;
|
||
const char *logdata;
|
||
const char *version;
|
||
int maturity;
|
||
int accuracy;
|
||
int severity;
|
||
int phase;
|
||
msre_rule *rule;
|
||
int arg_min;
|
||
int arg_max;
|
||
|
||
/* Flow */
|
||
int is_chained;
|
||
int skip_count;
|
||
const char *skip_after;
|
||
|
||
/* Disruptive */
|
||
int intercept_action;
|
||
const char *intercept_uri;
|
||
int intercept_status;
|
||
const char *intercept_pause;
|
||
|
||
/* "block" needs parent action to reset it */
|
||
msre_action *parent_intercept_action_rec;
|
||
msre_action *intercept_action_rec;
|
||
int parent_intercept_action;
|
||
|
||
/* Other */
|
||
int log;
|
||
int auditlog;
|
||
int block;
|
||
};
|
||
|
||
void DSOLOCAL msre_engine_variable_register(msre_engine *engine, const char *name,
|
||
unsigned int type, unsigned int argc_min, unsigned int argc_max,
|
||
fn_var_validate_t validate, fn_var_generate_t generate,
|
||
unsigned int is_cacheable, unsigned int availability);
|
||
|
||
msre_actionset DSOLOCAL *msre_actionset_create(msre_engine *engine, apr_pool_t *mp, const char *text,
|
||
char **error_msg);
|
||
|
||
msre_actionset DSOLOCAL *msre_actionset_merge(msre_engine *engine, apr_pool_t *mp, msre_actionset *parent,
|
||
msre_actionset *child, int inherit_by_default);
|
||
|
||
msre_actionset DSOLOCAL *msre_actionset_create_default(msre_engine *engine);
|
||
|
||
void DSOLOCAL msre_actionset_set_defaults(msre_actionset *actionset);
|
||
|
||
void DSOLOCAL msre_actionset_init(msre_actionset *actionset, msre_rule *rule);
|
||
|
||
typedef char *(*fn_action_validate_t)(msre_engine *engine, apr_pool_t *mp, msre_action *action);
|
||
typedef apr_status_t (*fn_action_init_t)(msre_engine *engine, apr_pool_t *mp, msre_actionset *actionset, msre_action *action);
|
||
typedef apr_status_t (*fn_action_execute_t)(modsec_rec *msr, apr_pool_t *mptmp, msre_rule *rule, msre_action *action);
|
||
|
||
#define ACTION_DISRUPTIVE 1
|
||
#define ACTION_NON_DISRUPTIVE 2
|
||
#define ACTION_METADATA 3
|
||
#define ACTION_FLOW 4
|
||
|
||
#define NO_PLUS_MINUS 0
|
||
#define ALLOW_PLUS_MINUS 1
|
||
|
||
#define ACTION_CARDINALITY_ONE 1
|
||
#define ACTION_CARDINALITY_MANY 2
|
||
|
||
#define ACTION_CGROUP_NONE 0
|
||
#define ACTION_CGROUP_DISRUPTIVE 1
|
||
#define ACTION_CGROUP_LOG 2
|
||
#define ACTION_CGROUP_AUDITLOG 3
|
||
|
||
struct msre_action_metadata {
|
||
const char *name;
|
||
unsigned int type;
|
||
unsigned int argc_min;
|
||
unsigned int argc_max;
|
||
unsigned int allow_param_plusminus;
|
||
unsigned int cardinality;
|
||
unsigned int cardinality_group;
|
||
fn_action_validate_t validate;
|
||
fn_action_init_t init;
|
||
fn_action_execute_t execute;
|
||
};
|
||
|
||
struct msre_action {
|
||
msre_action_metadata *metadata;
|
||
const char *param;
|
||
const void *param_data;
|
||
unsigned int param_plusminus; /* ABSOLUTE_VALUE, POSITIVE_VALUE, NEGATIVE_VALUE */
|
||
};
|
||
|
||
void DSOLOCAL msre_engine_reqbody_processor_register(msre_engine *engine,
|
||
const char *name, void *fn_init, void *fn_process, void *fn_complete);
|
||
|
||
typedef int (*fn_reqbody_processor_init_t)(modsec_rec *msr, char **error_msg);
|
||
typedef int (*fn_reqbody_processor_process_t)(modsec_rec *msr, const char *buf,
|
||
unsigned int size, char **error_msg);
|
||
typedef int (*fn_reqbody_processor_complete_t)(modsec_rec *msr, char **error_msg);
|
||
|
||
struct msre_reqbody_processor_metadata {
|
||
const char *name;
|
||
fn_reqbody_processor_init_t init;
|
||
fn_reqbody_processor_process_t process;
|
||
fn_reqbody_processor_complete_t complete;
|
||
};
|
||
|
||
/* -- MSRE Function Prototypes ---------------------------------------------- */
|
||
|
||
msre_var_metadata DSOLOCAL *msre_resolve_var(msre_engine *engine, const char *name);
|
||
|
||
int DSOLOCAL msre_parse_generic(apr_pool_t *pool, const char *text, apr_table_t *vartable,
|
||
char **error_msg);
|
||
|
||
apr_status_t DSOLOCAL msre_parse_vars(msre_ruleset *ruleset, const char *text,
|
||
apr_array_header_t *arr, char **error_msg);
|
||
|
||
char DSOLOCAL *msre_format_metadata(modsec_rec *msr, msre_actionset *actionset);
|
||
|
||
/* -- Data Cache -- */
|
||
|
||
struct msre_cache_rec {
|
||
int hits;
|
||
int changed;
|
||
int num;
|
||
const char *path;
|
||
const char *val;
|
||
apr_size_t val_len;
|
||
};
|
||
|
||
struct fuzzy_hash_chunk {
|
||
const char *data;
|
||
struct fuzzy_hash_chunk *next;
|
||
};
|
||
|
||
struct fuzzy_hash_param_data {
|
||
const char *file;
|
||
struct fuzzy_hash_chunk *head;
|
||
int threshold;
|
||
};
|
||
|
||
#endif
|