Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Multiphase: chains further support, ARGS split, CRS like tests #719

Merged
merged 22 commits into from
May 16, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
1fe6603
Support chain rules for multiphase evaluation
anuraaga Mar 7, 2023
be2e629
Multiphase work
M4tteoP Mar 13, 2023
daeff16
wip, fixes ARGS_forced_phased2 implementing ARGS,ARGSName split, make…
M4tteoP Mar 16, 2023
1436654
makes tests compatible with multiphase, adds multiphase tests and rea…
M4tteoP Mar 19, 2023
1b18213
adds some crs chains tests, initial tweaks on multiphase chain corner…
M4tteoP Mar 21, 2023
21aaf32
Merge branch 'v3/dev' into multiphase_work
M4tteoP Mar 21, 2023
ef0c93a
removes a todo
M4tteoP Mar 21, 2023
8b7d9d9
removes multiphase reasonings, moved to gist
M4tteoP Mar 22, 2023
41d9bb0
removes wrong fix, fixes chaines rule evaluation, adds more crs relat…
M4tteoP Mar 22, 2023
2c33c83
fix multiphase chained rules phase execution upper limit
M4tteoP Mar 23, 2023
ad8231f
fine tuning when chained rules are evaluated with multiphase
M4tteoP Mar 24, 2023
91755cf
Merge branch 'v3/dev' into multiphase_work
M4tteoP Apr 3, 2023
0bb9a6e
adds first implementation of isMultiphaseDoubleEvaluation
M4tteoP Apr 12, 2023
8bfcaad
Merge branch 'v3/dev' into multiphase_work
M4tteoP Apr 12, 2023
c616a28
small fix
M4tteoP Apr 12, 2023
a0dd4ff
Better decouples multiphase logic from standard one
M4tteoP Apr 18, 2023
e74c02f
Merge branch 'v3/dev' into multiphase_work
M4tteoP Apr 18, 2023
8db6250
Merge branch 'v3/dev' into multiphase_work
M4tteoP May 9, 2023
4f69bca
Merge branch 'v3/dev' into multiphase_work
M4tteoP May 9, 2023
d1d86a3
fixes post branch update
M4tteoP May 9, 2023
2bc9694
Merge branch 'v3/dev' into multiphase_work
M4tteoP May 15, 2023
52a2f6f
Merge branch 'v3/dev' into multiphase_work
M4tteoP May 15, 2023
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
8 changes: 4 additions & 4 deletions http/middleware_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -148,14 +148,14 @@ func createMultipartRequest(t *testing.T) *http.Request {
}

// from issue https://github.com/corazawaf/coraza/issues/159 @zpeasystart
func TestDirectiveSecAuditLog(t *testing.T) {
func TestChainEvaluation(t *testing.T) {
waf := corazawaf.NewWAF()
waf.RequestBodyAccess = true
if err := seclang.NewParser(waf).FromString(`
SecRule REQUEST_FILENAME "@unconditionalMatch" "id:100, phase:2, t:none, log, setvar:'tx.count=+1',chain"
SecRule ARGS:username "@unconditionalMatch" "t:none, setvar:'tx.count=+2',chain"
SecRule ARGS:password "@unconditionalMatch" "t:none, setvar:'tx.count=+3'"
`); err != nil {
SecRule ARGS_POST:username "@unconditionalMatch" "t:none, setvar:'tx.count=+2',chain"
SecRule ARGS_POST:password "@unconditionalMatch" "t:none, setvar:'tx.count=+3'"
`); err != nil {
t.Fatal(err)
}
if err := waf.Validate(); err != nil {
Expand Down
7 changes: 7 additions & 0 deletions internal/corazarules/rule_match.go
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,9 @@ type MatchData struct {
Message_ string
// Macro expanded logdata
Data_ string
// Keeps track of the chain depth in which the data matched.
// Multiphase specific field
ChainLevel_ int
}

func (m *MatchData) Variable() variables.RuleVariable {
Expand All @@ -47,6 +50,10 @@ func (m *MatchData) Data() string {
return m.Data_
}

func (m *MatchData) ChainLevel() int {
return m.ChainLevel_
}

// MatchedRule contains a list of macro expanded messages,
// matched variables and a pointer to the rule
type MatchedRule struct {
Expand Down