Skip to content

Commit 7a48245

Browse files
zimmerlezimmerle
committed
Creates RuleUnconditional
Makes RuleScript child of RuleWithActions instead of Operator
1 parent f63bd1a commit 7a48245

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

94 files changed

+1314
-1166
lines changed

‎headers/modsecurity/rule.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,8 @@ class Rule {
7373
m_phase(modsecurity::Phases::RequestHeadersPhase) {
7474
}
7575

76+
virtual bool evaluate(Transaction *transaction) = 0;
77+
7678
virtual bool evaluate(Transaction *transaction,
7779
std::shared_ptr<RuleMessage> rm) = 0;
7880

‎headers/modsecurity/rule_marker.h

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,10 @@ class RuleMarker : public Rule {
4747

4848
virtual bool evaluate(Transaction *transaction,
4949
std::shared_ptr<RuleMessage> rm) override {
50+
return evaluate(transaction);
51+
}
5052

53+
virtual bool evaluate(Transaction *transaction) override {
5154
if (transaction->isInsideAMarker()) {
5255
if (*transaction->getCurrentMarker() == *m_name) {
5356
transaction->removeMarker();

‎headers/modsecurity/rule_message.h

Lines changed: 40 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,13 @@ class RuleMessage {
4242
ClientLogMessageInfo = 4
4343
};
4444

45-
explicit RuleMessage(RuleWithOperator *rule, Transaction *trans) :
45+
/**
46+
*
47+
* FIXME: RuleMessage is currently too big, doing a lot of
48+
* unnecessary data duplication. Needs to be shrink down.
49+
*
50+
*/
51+
RuleMessage(RuleWithActions *rule, Transaction *trans) :
4652
m_accuracy(rule->m_accuracy),
4753
m_clientIpAddress(trans->m_clientIpAddress),
4854
m_data(""),
@@ -66,6 +72,38 @@ class RuleMessage {
6672
m_ver(rule->m_ver)
6773
{ }
6874

75+
explicit RuleMessage(RuleMessage *rule) :
76+
m_accuracy(rule->m_accuracy),
77+
m_clientIpAddress(rule->m_clientIpAddress),
78+
m_data(rule->m_data),
79+
m_id(rule->m_id),
80+
m_isDisruptive(rule->m_isDisruptive),
81+
m_match(rule->m_match),
82+
m_maturity(rule->m_maturity),
83+
m_message(rule->m_message),
84+
m_noAuditLog(rule->m_noAuditLog),
85+
m_phase(rule->m_phase),
86+
m_reference(rule->m_reference),
87+
m_rev(rule->m_rev),
88+
m_rule(rule->m_rule),
89+
m_ruleFile(rule->m_ruleFile),
90+
m_ruleId(rule->m_ruleId),
91+
m_ruleLine(rule->m_ruleLine),
92+
m_saveMessage(rule->m_saveMessage),
93+
m_serverIpAddress(rule->m_serverIpAddress),
94+
m_severity(rule->m_severity),
95+
m_uriNoQueryStringDecoded(rule->m_uriNoQueryStringDecoded),
96+
m_ver(rule->m_ver)
97+
{ }
98+
99+
void clean() {
100+
m_data = "";
101+
m_match = "";
102+
m_isDisruptive = false;
103+
m_reference = "";
104+
m_severity = 0;
105+
m_ver = "";
106+
}
69107

70108
std::string log() {
71109
return log(this, 0);
@@ -104,7 +142,7 @@ class RuleMessage {
104142
int m_phase;
105143
std::string m_reference;
106144
std::string m_rev;
107-
RuleWithOperator *m_rule;
145+
RuleWithActions *m_rule;
108146
std::shared_ptr<std::string> m_ruleFile;
109147
int m_ruleId;
110148
int m_ruleLine;

‎headers/modsecurity/rule_unconditional.h

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
/*
2+
* ModSecurity, http://www.modsecurity.org/
3+
* Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
4+
*
5+
* You may not use this file except in compliance with
6+
* the License. You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* If any of the files related to licensing are missing or if you have any
11+
* other questions related to licensing please contact Trustwave Holdings, Inc.
12+
* directly using the email address [email protected].
13+
*
14+
*/
15+
16+
#ifdef __cplusplus
17+
#include <stack>
18+
#include <vector>
19+
#include <string>
20+
#include <list>
21+
#include <memory>
22+
#include <utility>
23+
#endif
24+
25+
#ifndef HEADERS_MODSECURITY_RULE_UNCONDITIONAL_H_
26+
#define HEADERS_MODSECURITY_RULE_UNCONDITIONAL_H_
27+
28+
#include "modsecurity/modsecurity.h"
29+
#include "modsecurity/variable_value.h"
30+
#include "modsecurity/rule.h"
31+
#include "modsecurity/rules_set.h"
32+
#include "modsecurity/rule_with_actions.h"
33+
#include "modsecurity/actions/action.h"
34+
35+
#ifdef __cplusplus
36+
37+
namespace modsecurity {
38+
39+
40+
class RuleUnconditional : public RuleWithActions {
41+
public:
42+
RuleUnconditional(
43+
std::vector<actions::Action *> *actions,
44+
Transformations *transformations,
45+
std::unique_ptr<std::string> fileName,
46+
int lineNumber)
47+
: RuleWithActions(actions, transformations, std::move(fileName), lineNumber) { }
48+
49+
virtual bool evaluate(Transaction *transaction, std::shared_ptr<RuleMessage> ruleMessage) override;
50+
51+
private:
52+
};
53+
54+
55+
} // namespace modsecurity
56+
57+
#endif
58+
59+
#endif // HEADERS_MODSECURITY_RULE_UNCONDITIONAL_H_

‎headers/modsecurity/rule_with_actions.h

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,21 @@ class RuleWithActions : public Rule {
4545

4646
~RuleWithActions();
4747

48+
virtual bool evaluate(Transaction *transaction, std::shared_ptr<RuleMessage> ruleMessage) override;
49+
50+
virtual bool evaluate(Transaction *transaction) override;
51+
52+
53+
void executeActionsIndependentOfChainedRuleResult(
54+
Transaction *trasn,
55+
bool *containsDisruptive,
56+
std::shared_ptr<RuleMessage> ruleMessage);
57+
58+
void executeActionsAfterFullMatch(
59+
Transaction *trasn,
60+
bool containsDisruptive,
61+
std::shared_ptr<RuleMessage> ruleMessage);
62+
4863
void executeAction(Transaction *trans,
4964
bool containsBlock,
5065
std::shared_ptr<RuleMessage> ruleMessage,
@@ -63,10 +78,6 @@ class RuleWithActions : public Rule {
6378
std::string *path,
6479
int *nth) const;
6580

66-
void executeActionsIndependentOfChainedRuleResult(Transaction *trasn,
67-
bool *b, std::shared_ptr<RuleMessage> ruleMessage);
68-
void executeActionsAfterFullMatch(Transaction *trasn,
69-
bool containsDisruptive, std::shared_ptr<RuleMessage> ruleMessage);
7081

7182
std::vector<actions::Action *> getActionsByName(const std::string& name,
7283
Transaction *t);
@@ -95,6 +106,9 @@ class RuleWithActions : public Rule {
95106

96107
int64_t m_ruleId;
97108

109+
std::unique_ptr<RuleWithActions> m_chainedRuleChild;
110+
RuleWithActions *m_chainedRuleParent;
111+
98112
private:
99113
/* actions */
100114
actions::Action *m_disruptiveAction;
@@ -118,4 +132,4 @@ class RuleWithActions : public Rule {
118132
#endif
119133

120134

121-
#endif // HEADERS_MODSECURITY_RULE_WITH_ACTIONS_H_
135+
#endif // HEADERS_MODSECURITY_RULE_WITH_ACTIONS_H_

‎headers/modsecurity/rule_with_operator.h

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -62,23 +62,16 @@ class RuleWithOperator : public RuleWithActions {
6262
const std::string &value);
6363
static void cleanMatchedVars(Transaction *trasn);
6464

65-
inline bool isUnconditional() const { return m_operator == NULL; }
6665

6766
std::string getOperatorName() const;
6867

6968
virtual std::string getReference() override {
7069
return std::to_string(m_ruleId);
7170
}
7271

73-
std::unique_ptr<RuleWithOperator> m_chainedRuleChild;
74-
RuleWithOperator *m_chainedRuleParent;
75-
7672
private:
7773
modsecurity::variables::Variables *m_variables;
7874
operators::Operator *m_operator;
79-
80-
81-
bool m_unconditional:1;
8275
};
8376

8477

‎src/Makefile.am

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ pkginclude_HEADERS = \
4343
../headers/modsecurity/modsecurity.h \
4444
../headers/modsecurity/rule.h \
4545
../headers/modsecurity/rule_marker.h \
46+
../headers/modsecurity/rule_unconditional.h \
4647
../headers/modsecurity/rule_with_actions.h \
4748
../headers/modsecurity/rule_with_operator.h \
4849
../headers/modsecurity/rules.h \
@@ -285,6 +286,7 @@ libmodsecurity_la_SOURCES = \
285286
debug_log/debug_log_writer.cc \
286287
run_time_string.cc \
287288
rule.cc \
289+
rule_unconditional.cc \
288290
rule_with_actions.cc \
289291
rule_with_operator.cc \
290292
rule_message.cc \

‎src/operators/begins_with.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ namespace modsecurity {
2424
namespace operators {
2525

2626

27-
bool BeginsWith::evaluate(Transaction *transaction, RuleWithOperator *rule,
27+
bool BeginsWith::evaluate(Transaction *transaction, RuleWithActions *rule,
2828
const std::string &str, std::shared_ptr<RuleMessage> ruleMessage) {
2929
std::string p(m_string->evaluate(transaction));
3030

‎src/operators/begins_with.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ class BeginsWith : public Operator {
3232
explicit BeginsWith(std::unique_ptr<RunTimeString> param)
3333
: Operator("BeginsWith", std::move(param)) { }
3434

35-
bool evaluate(Transaction *transaction, RuleWithOperator *rule, const std::string &str,
35+
bool evaluate(Transaction *transaction, RuleWithActions *rule, const std::string &str,
3636
std::shared_ptr<RuleMessage> ruleMessage) override;
3737
};
3838

‎src/operators/contains.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
namespace modsecurity {
2222
namespace operators {
2323

24-
bool Contains::evaluate(Transaction *transaction, RuleWithOperator *rule,
24+
bool Contains::evaluate(Transaction *transaction, RuleWithActions *rule,
2525
const std::string &input, std::shared_ptr<RuleMessage> ruleMessage) {
2626
std::string p(m_string->evaluate(transaction));
2727
size_t offset = input.find(p);

‎src/operators/contains.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ class Contains : public Operator {
3434
/** @ingroup ModSecurity_Operator */
3535
explicit Contains(std::unique_ptr<RunTimeString> param)
3636
: Operator("Contains", std::move(param)) { }
37-
bool evaluate(Transaction *transaction, RuleWithOperator *rule,
37+
bool evaluate(Transaction *transaction, RuleWithActions *rule,
3838
const std::string &str,
3939
std::shared_ptr<RuleMessage> ruleMessage) override;
4040
};

‎src/operators/contains_word.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ bool ContainsWord::acceptableChar(const std::string& a, size_t pos) {
3636
return true;
3737
}
3838

39-
bool ContainsWord::evaluate(Transaction *transaction, RuleWithOperator *rule,
39+
bool ContainsWord::evaluate(Transaction *transaction, RuleWithActions *rule,
4040
const std::string &str, std::shared_ptr<RuleMessage> ruleMessage) {
4141
std::string paramTarget(m_string->evaluate(transaction));
4242

‎src/operators/contains_word.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ class ContainsWord : public Operator {
3232
explicit ContainsWord(std::unique_ptr<RunTimeString> param)
3333
: Operator("ContainsWord", std::move(param)) { }
3434

35-
bool evaluate(Transaction *transaction, RuleWithOperator *rule,
35+
bool evaluate(Transaction *transaction, RuleWithActions *rule,
3636
const std::string &str,
3737
std::shared_ptr<RuleMessage> ruleMessage) override;
3838

‎src/operators/detect_sqli.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ namespace modsecurity {
2525
namespace operators {
2626

2727

28-
bool DetectSQLi::evaluate(Transaction *t, RuleWithOperator *rule,
28+
bool DetectSQLi::evaluate(Transaction *t, RuleWithActions *rule,
2929
const std::string& input, std::shared_ptr<RuleMessage> ruleMessage) {
3030
char fingerprint[8];
3131
int issqli;

‎src/operators/detect_sqli.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ class DetectSQLi : public Operator {
3232
m_match_message.assign("detected SQLi using libinjection.");
3333
}
3434

35-
bool evaluate(Transaction *t, RuleWithOperator *rule,
35+
bool evaluate(Transaction *t, RuleWithActions *rule,
3636
const std::string& input,
3737
std::shared_ptr<RuleMessage> ruleMessage) override;
3838
};

‎src/operators/detect_xss.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ namespace modsecurity {
2525
namespace operators {
2626

2727

28-
bool DetectXSS::evaluate(Transaction *t, RuleWithOperator *rule,
28+
bool DetectXSS::evaluate(Transaction *t, RuleWithActions *rule,
2929
const std::string& input, std::shared_ptr<RuleMessage> ruleMessage) {
3030
int is_xss;
3131

‎src/operators/detect_xss.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ class DetectXSS : public Operator {
3131
m_match_message.assign("detected XSS using libinjection.");
3232
}
3333

34-
bool evaluate(Transaction *t, RuleWithOperator *rule,
34+
bool evaluate(Transaction *t, RuleWithActions *rule,
3535
const std::string& input,
3636
std::shared_ptr<RuleMessage> ruleMessage) override;
3737
};

‎src/operators/ends_with.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ namespace modsecurity {
2323
namespace operators {
2424

2525

26-
bool EndsWith::evaluate(Transaction *transaction, RuleWithOperator *rule,
26+
bool EndsWith::evaluate(Transaction *transaction, RuleWithActions *rule,
2727
const std::string &str, std::shared_ptr<RuleMessage> ruleMessage) {
2828
bool ret = false;
2929
std::string p(m_string->evaluate(transaction));

‎src/operators/ends_with.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ class EndsWith : public Operator {
3333
: Operator("EndsWith", std::move(param)) {
3434
m_couldContainsMacro = true;
3535
}
36-
bool evaluate(Transaction *transaction, RuleWithOperator *rule,
36+
bool evaluate(Transaction *transaction, RuleWithActions *rule,
3737
const std::string &str,
3838
std::shared_ptr<RuleMessage> ruleMessage) override;
3939
};

‎src/operators/operator.cc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ namespace operators {
7070

7171

7272
bool Operator::evaluateInternal(Transaction *transaction,
73-
RuleWithOperator *rule, const std::string& a, std::shared_ptr<RuleMessage> rm) {
73+
RuleWithActions *rule, const std::string& a, std::shared_ptr<RuleMessage> rm) {
7474
bool res = evaluate(transaction, rule, a, rm);
7575

7676
if (m_negation) {
@@ -81,7 +81,7 @@ bool Operator::evaluateInternal(Transaction *transaction,
8181
}
8282

8383
bool Operator::evaluateInternal(Transaction *transaction,
84-
RuleWithOperator *rule, const std::string& a) {
84+
RuleWithActions *rule, const std::string& a) {
8585
bool res = evaluate(transaction, rule, a);
8686

8787
if (m_negation) {

‎src/operators/operator.h

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -111,24 +111,23 @@ class Operator {
111111
std::string key, std::string value);
112112

113113
bool evaluateInternal(Transaction *t, const std::string& a);
114-
bool evaluateInternal(Transaction *t, RuleWithOperator *rule,
114+
bool evaluateInternal(Transaction *t, RuleWithActions *rule,
115115
const std::string& a);
116-
bool evaluateInternal(Transaction *t, RuleWithOperator *rule,
116+
bool evaluateInternal(Transaction *t, RuleWithActions *rule,
117117
const std::string& a, std::shared_ptr<RuleMessage> ruleMessage);
118118

119119

120120
virtual bool evaluate(Transaction *transaction, const std::string &str);
121-
virtual bool evaluate(Transaction *transaction, RuleWithOperator *rule,
121+
virtual bool evaluate(Transaction *transaction, RuleWithActions *rule,
122122
const std::string &str) {
123123
return evaluate(transaction, str);
124124
}
125-
virtual bool evaluate(Transaction *transaction, RuleWithOperator *rule,
125+
virtual bool evaluate(Transaction *transaction, RuleWithActions *rule,
126126
const std::string &str, std::shared_ptr<RuleMessage> ruleMessage) {
127127
return evaluate(transaction, str);
128128
}
129129

130-
static void logOffset(std::shared_ptr<RuleMessage> ruleMessage,
131-
int offset, int len) {
130+
static void logOffset(std::shared_ptr<RuleMessage> ruleMessage, int offset, int len) {
132131
if (ruleMessage) {
133132
ruleMessage->m_reference.append("o"
134133
+ std::to_string(offset) + ","

‎src/operators/pm.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ void Pm::postOrderTraversal(acmp_btree_node_t *node) {
8181
}
8282

8383

84-
bool Pm::evaluate(Transaction *transaction, RuleWithOperator *rule,
84+
bool Pm::evaluate(Transaction *transaction, RuleWithActions *rule,
8585
const std::string &input, std::shared_ptr<RuleMessage> ruleMessage) {
8686
int rc;
8787
ACMPT pt;

0 commit comments

Comments
 (0)