seclang

Documentation

Index

• func MergeActions(origin []ruleAction, defaults []ruleAction) []ruleAction
• func ParseActions(actions string) ([]ruleAction, error)
• func PhaseToInt(phase string) (int, error)
• type Directive
• type Parser
  • func NewParser(waf *engine.Waf) (*Parser, error)
  • func (p *Parser) AddDefaultActions(data string) error
  • func (p *Parser) FromFile(profilePath string) error
  • func (p *Parser) FromString(data string) error
  • func (p *Parser) GetDefaultActions() []string
  • func (p *Parser) ParseRule(data string, withOperator bool) (*engine.Rule, error)
• type RuleParser
  • func NewRuleParser(p *Parser) *RuleParser
  • func (p *RuleParser) ParseActions(actions string) error
  • func (p *RuleParser) ParseDefaultActions(actions string) error
  • func (p *RuleParser) ParseOperator(operator string) error
  • func (p *RuleParser) ParseVariables(vars string) error
  • func (p *RuleParser) Rule() *engine.Rule

Functions

func MergeActions

func MergeActions(origin []ruleAction, defaults []ruleAction) []ruleAction

So here is my research: SecDefaultAction must contain a phase and a disruptive action They will only be merged if the match the same phase If the rule disruptive action is block it will inherit the defaultaction disruptive actions DefaultAction's disruptive action will be added to the rule only if there is no DA or DA is block If we have: SecDefaultAction "phase:2,deny,status:403,log" Then we have a Rule: SecAction "id:1, phase:2, block, nolog" The rule ID 1 will inherit default actions and become SecAction "id:1, phase:2, status:403, log, nolog, deny" In the future I shall optimize that redundant log and nolog, it won't actually change anything but would look cooler

func ParseActions

func ParseActions(actions string) ([]ruleAction, error)

ParseActions will assign the function name, arguments and function (pkg.actions) for each action splitted by comma (,) Action arguments are allowed to wrap values between collons(”)

func PhaseToInt

func PhaseToInt(phase string) (int, error)

PhaseToInt transforms a phase string to it's integer value, modsecurity allows request(1), response(3), log(5), 1,2,3,4,5 values

Types

type Directive

type Directive = func(p *Parser, opts string) error

type Parser

type Parser struct {
	Waf                   *engine.Waf
	DisabledDirectives    []string
	DisabledRuleActions   []string
	DisabledRuleOperators []string
	// contains filtered or unexported fields
}

Parser provides functions to evaluate (compile) SecLang directives

func NewParser

func NewParser(waf *engine.Waf) (*Parser, error)

NewParser creates a new parser from a WAF instance Rules and settings will be associated with the supplied waf

func (*Parser) AddDefaultActions

func (p *Parser) AddDefaultActions(data string) error

AddDEfaultActions compiles an actions string Requires a phase and a disruptive action, example: AddDefaultActions("deny,phase:1,log")

func (*Parser) FromFile

func (p *Parser) FromFile(profilePath string) error

FromFile imports directives from a file It will return error if any directive fails to parse or arguments are invalid

func (*Parser) FromString

func (p *Parser) FromString(data string) error

FromString imports directives from a string It will return error if any directive fails to parse or arguments are invalid

func (*Parser) GetDefaultActions

func (p *Parser) GetDefaultActions() []string

GetDefaultActions returns the default actions as an array of strings, they are not evaluated yet

func (*Parser) ParseRule

func (p *Parser) ParseRule(data string, withOperator bool) (*engine.Rule, error)

ParseRule will take a rule string and create a rule struct Rules without operator will become SecActions

type RuleParser

type RuleParser struct {
	Configdir string
	// contains filtered or unexported fields
}

func NewRuleParser

func NewRuleParser(p *Parser) *RuleParser

NewRuleParser Creates a new rule parser, each rule parser will contain a single rule that can be obtained using ruleparser.Rule()

func (*RuleParser) ParseActions

func (p *RuleParser) ParseActions(actions string) error

ParseActions

func (*RuleParser) ParseDefaultActions

func (p *RuleParser) ParseDefaultActions(actions string) error

func (*RuleParser) ParseOperator

func (p *RuleParser) ParseOperator(operator string) error

func (*RuleParser) ParseVariables

func (p *RuleParser) ParseVariables(vars string) error

func (*RuleParser) Rule

func (p *RuleParser) Rule() *engine.Rule

Rule returns the compiled rule