Skip to content

Commit aab4709

Browse files
airweenairween
authored
Merge pull request #3364 from JakubOnderka/json-logging
Simplify code for JSON audit log
2 parents 990d99b + 797f7dc commit aab4709

File tree

4 files changed

+94
-36
lines changed

4 files changed

+94
-36
lines changed

‎headers/modsecurity/rules_set_properties.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -331,7 +331,7 @@ class RulesSetProperties {
331331
};
332332

333333

334-
static const char *ruleEngineStateString(RuleEngine i) {
334+
static std::string ruleEngineStateString(RuleEngine i) {
335335
switch (i) {
336336
case DisabledRuleEngine:
337337
return "Disabled";
@@ -342,7 +342,7 @@ class RulesSetProperties {
342342
case PropertyNotSetRuleEngine:
343343
return "PropertyNotSet/DetectionOnly";
344344
}
345-
return NULL;
345+
return std::string{};
346346
}
347347

348348

‎headers/modsecurity/transaction.h‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -80,15 +80,14 @@ typedef struct Rules_t RulesSet;
8080

8181
#define LOGFY_ADD(a, b) \
8282
yajl_gen_string(g, reinterpret_cast<const unsigned char*>(a), strlen(a)); \
83-
if (b == NULL) { \
83+
if (b.data() == NULL) { \
8484
yajl_gen_string(g, reinterpret_cast<const unsigned char*>(""), \
8585
strlen("")); \
8686
} else { \
87-
yajl_gen_string(g, reinterpret_cast<const unsigned char*>(b), \
88-
strlen(b)); \
87+
yajl_gen_string(g, reinterpret_cast<const unsigned char*>(b.data()), \
88+
b.length()); \
8989
}
9090

91-
9291
#define LOGFY_ADD_INT(a, b) \
9392
yajl_gen_string(g, reinterpret_cast<const unsigned char*>(a), strlen(a)); \
9493
yajl_gen_number(g, reinterpret_cast<const char*>(b), strlen(b));

‎src/transaction.cc‎

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1565,7 +1565,7 @@ std::string Transaction::toJSON(int parts) {
15651565
size_t len;
15661566
yajl_gen g;
15671567
std::string log;
1568-
std::string ts = utils::string::ascTime(&m_timeStamp).c_str();
1568+
std::string ts = utils::string::ascTime(&m_timeStamp);
15691569
std::string uniqueId = UniqueId::uniqueId();
15701570

15711571
g = yajl_gen_alloc(NULL);
@@ -1583,13 +1583,13 @@ std::string Transaction::toJSON(int parts) {
15831583

15841584
yajl_gen_map_open(g);
15851585
/* Part: A (header mandatory) */
1586-
LOGFY_ADD("client_ip", m_clientIpAddress.c_str());
1587-
LOGFY_ADD("time_stamp", ts.c_str());
1588-
LOGFY_ADD("server_id", uniqueId.c_str());
1586+
LOGFY_ADD("client_ip", m_clientIpAddress);
1587+
LOGFY_ADD("time_stamp", ts);
1588+
LOGFY_ADD("server_id", uniqueId);
15891589
LOGFY_ADD_NUM("client_port", m_clientPort);
1590-
LOGFY_ADD("host_ip", m_serverIpAddress.c_str());
1590+
LOGFY_ADD("host_ip", m_serverIpAddress);
15911591
LOGFY_ADD_NUM("host_port", m_serverPort);
1592-
LOGFY_ADD("unique_id", m_id.c_str());
1592+
LOGFY_ADD("unique_id", m_id);
15931593

15941594
/* request */
15951595
yajl_gen_string(g, reinterpret_cast<const unsigned char*>("request"),
@@ -1598,14 +1598,14 @@ std::string Transaction::toJSON(int parts) {
15981598

15991599
LOGFY_ADD("method",
16001600
utils::string::dash_if_empty(
1601-
m_variableRequestMethod.evaluate()).c_str());
1601+
m_variableRequestMethod.evaluate()));
16021602

1603-
LOGFY_ADD_INT("http_version", m_httpVersion.c_str());
1604-
LOGFY_ADD("uri", this->m_uri.c_str());
1603+
LOGFY_ADD("http_version", m_httpVersion);
1604+
LOGFY_ADD("uri", this->m_uri);
16051605

16061606
if (parts & audit_log::AuditLog::CAuditLogPart) {
16071607
// FIXME: check for the binary content size.
1608-
LOGFY_ADD("body", this->m_requestBody.str().c_str());
1608+
LOGFY_ADD("body", this->m_requestBody.str());
16091609
}
16101610

16111611
/* request headers */
@@ -1617,7 +1617,7 @@ std::string Transaction::toJSON(int parts) {
16171617

16181618
m_variableRequestHeaders.resolve(&l);
16191619
for (auto &h : l) {
1620-
LOGFY_ADD(h->getKey().c_str(), h->getValue().c_str());
1620+
LOGFY_ADD(h->getKey().c_str(), h->getValue());
16211621
delete h;
16221622
}
16231623

@@ -1634,7 +1634,7 @@ std::string Transaction::toJSON(int parts) {
16341634
yajl_gen_map_open(g);
16351635

16361636
if (parts & audit_log::AuditLog::EAuditLogPart) {
1637-
LOGFY_ADD("body", this->m_responseBody.str().c_str());
1637+
LOGFY_ADD("body", this->m_responseBody.str());
16381638
}
16391639
LOGFY_ADD_NUM("http_code", m_httpCodeReturned);
16401640

@@ -1647,7 +1647,7 @@ std::string Transaction::toJSON(int parts) {
16471647

16481648
m_variableResponseHeaders.resolve(&l);
16491649
for (auto &h : l) {
1650-
LOGFY_ADD(h->getKey().c_str(), h->getValue().c_str());
1650+
LOGFY_ADD(h->getKey().c_str(), h->getValue());
16511651
delete h;
16521652
}
16531653

@@ -1664,10 +1664,10 @@ std::string Transaction::toJSON(int parts) {
16641664
yajl_gen_map_open(g);
16651665

16661666
/* producer > libmodsecurity */
1667-
LOGFY_ADD("modsecurity", m_ms->whoAmI().c_str());
1667+
LOGFY_ADD("modsecurity", m_ms->whoAmI());
16681668

16691669
/* producer > connector */
1670-
LOGFY_ADD("connector", m_ms->getConnectorInformation().c_str());
1670+
LOGFY_ADD("connector", m_ms->getConnectorInformation());
16711671

16721672
/* producer > engine state */
16731673
LOGFY_ADD("secrules_engine",
@@ -1683,7 +1683,7 @@ std::string Transaction::toJSON(int parts) {
16831683
for (const auto &a : m_rules->m_components) {
16841684
yajl_gen_string(g,
16851685
reinterpret_cast<const unsigned char*>
1686-
(a.c_str()), a.length());
1686+
(a.data()), a.length());
16871687
}
16881688
yajl_gen_array_close(g);
16891689

@@ -1697,34 +1697,34 @@ std::string Transaction::toJSON(int parts) {
16971697
yajl_gen_array_open(g);
16981698
for (auto a : m_rulesMessages) {
16991699
yajl_gen_map_open(g);
1700-
LOGFY_ADD("message", a.m_message.c_str());
1700+
LOGFY_ADD("message", a.m_message);
17011701
yajl_gen_string(g,
17021702
reinterpret_cast<const unsigned char*>("details"),
17031703
strlen("details"));
17041704
yajl_gen_map_open(g);
1705-
LOGFY_ADD("match", a.m_match.c_str());
1706-
LOGFY_ADD("reference", a.m_reference.c_str());
1707-
LOGFY_ADD("ruleId", std::to_string(a.m_rule.m_ruleId).c_str());
1708-
LOGFY_ADD("file", a.m_rule.getFileName().c_str());
1709-
LOGFY_ADD("lineNumber", std::to_string(a.m_rule.getLineNumber()).c_str());
1710-
LOGFY_ADD("data", a.m_data.c_str());
1711-
LOGFY_ADD("severity", std::to_string(a.m_severity).c_str());
1712-
LOGFY_ADD("ver", a.m_rule.m_ver.c_str());
1713-
LOGFY_ADD("rev", a.m_rule.m_rev.c_str());
1705+
LOGFY_ADD("match", a.m_match);
1706+
LOGFY_ADD("reference", a.m_reference);
1707+
LOGFY_ADD("ruleId", std::to_string(a.m_rule.m_ruleId));
1708+
LOGFY_ADD("file", a.m_rule.getFileName());
1709+
LOGFY_ADD("lineNumber", std::to_string(a.m_rule.getLineNumber()));
1710+
LOGFY_ADD("data", a.m_data);
1711+
LOGFY_ADD("severity", std::to_string(a.m_severity));
1712+
LOGFY_ADD("ver", a.m_rule.m_ver);
1713+
LOGFY_ADD("rev", a.m_rule.m_rev);
17141714

17151715
yajl_gen_string(g,
17161716
reinterpret_cast<const unsigned char*>("tags"),
17171717
strlen("tags"));
17181718
yajl_gen_array_open(g);
17191719
for (auto b : a.m_tags) {
17201720
yajl_gen_string(g,
1721-
reinterpret_cast<const unsigned char*>(b.c_str()),
1722-
strlen(b.c_str()));
1721+
reinterpret_cast<const unsigned char*>(b.data()),
1722+
b.length());
17231723
}
17241724
yajl_gen_array_close(g);
17251725

1726-
LOGFY_ADD("maturity", std::to_string(a.m_rule.m_maturity).c_str());
1727-
LOGFY_ADD("accuracy", std::to_string(a.m_rule.m_accuracy).c_str());
1726+
LOGFY_ADD("maturity", std::to_string(a.m_rule.m_maturity));
1727+
LOGFY_ADD("accuracy", std::to_string(a.m_rule.m_accuracy));
17281728
yajl_gen_map_close(g);
17291729
yajl_gen_map_close(g);
17301730
}

‎test/test-cases/regression/auditlog.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,65 @@
172172
"SecAuditLogRelevantStatus \"^(?:5|4(?!04))\""
173173
]
174174
},
175+
{
176+
"enabled": 1,
177+
"version_min": 300000,
178+
"version_max": 0,
179+
"title": "auditlog : basic parser test - JSON",
180+
"client": {
181+
"ip": "200.249.12.31",
182+
"port": 2313
183+
},
184+
"server": {
185+
"ip": "200.249.12.31",
186+
"port": 80
187+
},
188+
"request": {
189+
"headers": {
190+
"Host": "www.modsecurity.org",
191+
"User-Agent": "Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)",
192+
"Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
193+
"Accept-Language": "en-us,en;q=0.5",
194+
"Accept-Encoding": "gzip,deflate",
195+
"Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
196+
"Keep-Alive": "300",
197+
"Connection": "keep-alive",
198+
"Pragma": "no-cache",
199+
"Cache-Control": "no-cache"
200+
},
201+
"uri": "\/test.pl?param1= test &param2=test2",
202+
"method": "GET",
203+
"http_version": 1.1,
204+
"body": ""
205+
},
206+
"response": {
207+
"headers": {
208+
"Content-Type": "plain\/text\n\r"
209+
},
210+
"body": [
211+
"test"
212+
]
213+
},
214+
"expected": {
215+
"audit_log": "{\"transaction\":{\"client_ip\":\"200.249.12.31\",\"time_stamp\":\"\\S{3} \\S{3} \\d{2} \\d{2}:\\d{2}:\\d{2} \\d{4}\"",
216+
"debug_log": "",
217+
"error_log": "",
218+
"http_code": 403
219+
},
220+
"rules": [
221+
"SecRuleEngine On",
222+
"SecRule ARGS \"@contains test\" \"id:1,t:trim,deny,auditlog\"",
223+
"SecAuditEngine RelevantOnly",
224+
"SecAuditLogFormat JSON",
225+
"SecAuditLogParts ABCFHZ",
226+
"SecAuditLogStorageDir /tmp/test",
227+
"SecAuditLog /tmp/audit_test_parallel.log",
228+
"SecAuditLogDirMode 0766",
229+
"SecAuditLogFileMode 0600",
230+
"SecAuditLogType Serial",
231+
"SecAuditLogRelevantStatus \"^(?:5|4(?!04))\""
232+
]
233+
},
175234
{
176235
"enabled": 1,
177236
"version_min": 300000,

0 commit comments

Comments
 (0)