Adds capture action to RBL

Author: Felipe Zimmerle

CHANGES

@@ -1,6 +1,8 @@
 v3.0.x - YYYY-MMM-DD (To be released)
 -------------------------------------
 
+ - Adds capture action to rbl
+   [Issue #1698 - @zimmerle]
  - Adds capture action to verifyCC
    [Issue #1698 - @michaelgranzow-avi, @zimmerle]
  - Adds capture action to verifySSN

src/operators/rbl.cc

@@ -196,9 +196,11 @@ void Rbl::furtherInfo(struct sockaddr_in *sin, std::string ipStr,
 }
 
 
-bool Rbl::evaluate(Transaction *transaction, const std::string &ipStr) {
+bool Rbl::evaluate(Transaction *t, Rule *rule,
+        const std::string& ipStr,
+        std::shared_ptr<RuleMessage> ruleMessage) {
     struct addrinfo *info = NULL;
-    std::string host = mapIpToAddress(ipStr, transaction);
+    std::string host = mapIpToAddress(ipStr, t);
     int rc = 0;
 
     if (host.empty()) {
@@ -211,15 +213,24 @@ bool Rbl::evaluate(Transaction *transaction, const std::string &ipStr) {
         if (info != NULL) {
             freeaddrinfo(info);
         }
-        debug(transaction, 5, "RBL lookup of " + ipStr + " failed.");
+        debug(t, 5, "RBL lookup of " + ipStr + " failed.");
         return false;
     }
 
     struct sockaddr *addr = info->ai_addr;
     struct sockaddr_in *sin = (struct sockaddr_in *) addr;
-    furtherInfo(sin, ipStr, transaction);
+    furtherInfo(sin, ipStr, t);
 
     freeaddrinfo(info);
+    if (rule && t
+        && rule->getActionsByName("capture").size() > 0) {
+        t->m_collections.m_tx_collection->storeOrUpdateFirst(
+        "0", std::string(ipStr));
+#ifndef NO_LOGS
+        t->debug(7, "Added RXL match TX.0: " + \
+            std::string(ipStr));
+#endif
+    }
 
     return true;
 }

src/operators/rbl.h

@@ -75,7 +75,9 @@ class Rbl : public Operator {
                 m_provider = RblProvider::httpbl;
             }
         }
-    bool evaluate(Transaction *transaction, const std::string  &str) override;
+    bool evaluate(Transaction *transaction, Rule *rule,
+        const std::string& input,
+        std::shared_ptr<RuleMessage> ruleMessage) override;
 
     std::string mapIpToAddress(std::string ipStr, Transaction *trans);