Skip to content

Commit a07ed61

Browse files
airweenairween
authored
Merge pull request #3432 from szedenik-adam/auditlog-header
Add custom leading text to audit log lines
2 parents f9f4011 + 4e2788e commit a07ed61

File tree

12 files changed

+6159
-6031
lines changed

12 files changed

+6159
-6031
lines changed

‎headers/modsecurity/audit_log.h

Lines changed: 21 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -153,17 +153,18 @@ class AuditLog {
153153
bool setStorageDirMode(int permission);
154154
bool setFileMode(int permission);
155155
bool setStatus(AuditLogStatus new_status);
156-
bool setRelevantStatus(const std::basic_string<char>& new_relevant_status);
157-
bool setFilePath1(const std::basic_string<char>& path);
158-
bool setFilePath2(const std::basic_string<char>& path);
159-
bool setStorageDir(const std::basic_string<char>& path);
156+
bool setRelevantStatus(std::string_view new_relevant_status);
157+
bool setFilePath1(std::string_view path);
158+
bool setFilePath2(std::string_view path);
159+
bool setStorageDir(std::string_view path);
160+
bool setPrefix(std::string_view prefix);
160161
bool setFormat(AuditLogFormat fmt);
161162

162163
int getDirectoryPermission() const;
163164
int getFilePermission() const;
164165
int getParts() const;
165166

166-
bool setParts(const std::basic_string<char>& new_parts);
167+
bool setParts(std::string_view new_parts);
167168
bool setType(AuditLogType audit_type);
168169

169170
bool init(std::string *error);
@@ -173,40 +174,41 @@ class AuditLog {
173174
bool saveIfRelevant(Transaction *transaction, int parts);
174175
bool isRelevant(int status);
175176

176-
static int addParts(int parts, const std::string& new_parts);
177-
static int removeParts(int parts, const std::string& new_parts);
177+
static int addParts(int parts, std::string_view new_parts);
178+
static int removeParts(int parts, std::string_view new_parts);
178179

179180
void setCtlAuditEngineActive() {
180181
m_ctlAuditEngineActive = true;
181182
}
182183

183184
bool merge(AuditLog *from, std::string *error);
184185

185-
std::string m_path1;
186-
std::string m_path2;
187-
std::string m_storage_dir;
186+
std::string m_path1 = std::string("");
187+
std::string m_path2 = std::string("");
188+
std::string m_storage_dir = std::string("");
189+
std::string m_prefix = std::string("");
188190

189-
AuditLogFormat m_format;
191+
AuditLogFormat m_format = NotSetAuditLogFormat;
190192

191193
protected:
192-
int m_parts;
194+
int m_parts = -1;
193195
int m_defaultParts = AAuditLogPart | BAuditLogPart | CAuditLogPart
194196
| FAuditLogPart | HAuditLogPart | ZAuditLogPart;
195197

196-
int m_filePermission;
198+
int m_filePermission = -1;
197199
int m_defaultFilePermission = 0640;
198200

199-
int m_directoryPermission;
201+
int m_directoryPermission = -1;
200202
int m_defaultDirectoryPermission = 0750;
201203

202204
private:
203-
AuditLogStatus m_status;
205+
AuditLogStatus m_status = NotSetLogStatus;
204206

205-
AuditLogType m_type;
206-
std::string m_relevant;
207+
AuditLogType m_type = NotSetAuditLogType;
208+
std::string m_relevant = std::string("");
207209

208-
audit_log::writer::Writer *m_writer;
209-
bool m_ctlAuditEngineActive; // rules have at least one action On or RelevantOnly
210+
audit_log::writer::Writer *m_writer = nullptr;
211+
bool m_ctlAuditEngineActive = false; // rules have at least one action On or RelevantOnly
210212
};
211213

212214

‎headers/modsecurity/transaction.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -411,7 +411,7 @@ class Transaction : public TransactionAnchoredVariables, public TransactionSecMa
411411
int getRuleEngineState() const;
412412

413413
std::string toJSON(int parts);
414-
std::string toOldAuditLogFormat(int parts, const std::string &trailer);
414+
std::string toOldAuditLogFormat(int parts, const std::string &trailer, const std::string &header);
415415
std::string toOldAuditLogFormatIndex(const std::string &filename,
416416
double size, const std::string &md5);
417417

‎src/audit_log/audit_log.cc

Lines changed: 20 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -51,25 +51,13 @@ namespace modsecurity {
5151
namespace audit_log {
5252

5353

54-
AuditLog::AuditLog()
55-
: m_path1(""),
56-
m_path2(""),
57-
m_storage_dir(""),
58-
m_format(NotSetAuditLogFormat),
59-
m_parts(-1),
60-
m_filePermission(-1),
61-
m_directoryPermission(-1),
62-
m_status(NotSetLogStatus),
63-
m_type(NotSetAuditLogType),
64-
m_relevant(""),
65-
m_writer(NULL),
66-
m_ctlAuditEngineActive(false) { }
54+
AuditLog::AuditLog() = default;
6755

6856

6957
AuditLog::~AuditLog() {
7058
if (m_writer) {
7159
delete m_writer;
72-
m_writer = NULL;
60+
m_writer = nullptr;
7361
}
7462
}
7563

@@ -108,35 +96,42 @@ bool AuditLog::setStatus(AuditLogStatus status) {
10896
}
10997

11098

111-
bool AuditLog::setRelevantStatus(const std::basic_string<char>& status) {
99+
bool AuditLog::setRelevantStatus(std::string_view status) {
112100
this->m_relevant = std::string(status);
113101
return true;
114102
}
115103

116104

117-
bool AuditLog::setStorageDir(const std::basic_string<char>& path) {
105+
bool AuditLog::setStorageDir(std::string_view path) {
118106
this->m_storage_dir = path;
119107
return true;
120108
}
121109

122110

123-
bool AuditLog::setFilePath1(const std::basic_string<char>& path) {
111+
bool AuditLog::setFilePath1(std::string_view path) {
124112
this->m_path1 = path;
125113
return true;
126114
}
127115

128116

129-
bool AuditLog::setFilePath2(const std::basic_string<char>& path) {
117+
bool AuditLog::setFilePath2(std::string_view path) {
130118
this->m_path2 = path;
131119
return true;
132120
}
133121

122+
123+
bool AuditLog::setPrefix(std::string_view prefix) {
124+
this->m_prefix = prefix;
125+
return true;
126+
}
127+
128+
134129
bool AuditLog::setFormat(AuditLogFormat fmt) {
135130
this->m_format = fmt;
136131
return true;
137132
}
138133

139-
int AuditLog::addParts(int parts, const std::string& new_parts) {
134+
int AuditLog::addParts(int parts, std::string_view new_parts) {
140135
PARTS_CONSTAINS('A', AAuditLogPart)
141136
PARTS_CONSTAINS('B', BAuditLogPart)
142137
PARTS_CONSTAINS('C', CAuditLogPart)
@@ -154,7 +149,7 @@ int AuditLog::addParts(int parts, const std::string& new_parts) {
154149
}
155150

156151

157-
int AuditLog::removeParts(int parts, const std::string& new_parts) {
152+
int AuditLog::removeParts(int parts, std::string_view new_parts) {
158153
PARTS_CONSTAINS_REM('A', AAuditLogPart)
159154
PARTS_CONSTAINS_REM('B', BAuditLogPart)
160155
PARTS_CONSTAINS_REM('C', CAuditLogPart)
@@ -172,7 +167,7 @@ int AuditLog::removeParts(int parts, const std::string& new_parts) {
172167
}
173168

174169

175-
bool AuditLog::setParts(const std::basic_string<char>& new_parts) {
170+
bool AuditLog::setParts(std::string_view new_parts) {
176171
int parts = 0;
177172

178173
PARTS_CONSTAINS('A', AAuditLogPart)
@@ -208,15 +203,14 @@ bool AuditLog::setType(AuditLogType audit_type) {
208203
}
209204

210205

211-
212206
bool AuditLog::init(std::string *error) {
213207
audit_log::writer::Writer *tmp_writer;
214208

215209
if ((m_status == OffAuditLogStatus || m_status == NotSetLogStatus)
216210
&& !m_ctlAuditEngineActive) {
217211
if (m_writer) {
218212
delete m_writer;
219-
m_writer = NULL;
213+
m_writer = nullptr;
220214
}
221215
return true;
222216
}
@@ -234,7 +228,7 @@ bool AuditLog::init(std::string *error) {
234228
tmp_writer = new audit_log::writer::Serial(this);
235229
}
236230

237-
if (tmp_writer == NULL) {
231+
if (tmp_writer == nullptr) {
238232
error->assign("Writer memory alloc failed!");
239233
return false;
240234
}
@@ -312,7 +306,7 @@ bool AuditLog::saveIfRelevant(Transaction *transaction, int parts) {
312306
}
313307
ms_dbg_a(transaction, 5, "Saving this request as part " \
314308
"of the audit logs.");
315-
if (m_writer == NULL) {
309+
if (m_writer == nullptr) {
316310
ms_dbg_a(transaction, 1, "Internal error, audit log writer is null");
317311
} else {
318312
std::string error;
@@ -337,6 +331,7 @@ bool AuditLog::merge(AuditLog *from, std::string *error) {
337331
AL_MERGE_STRING_CONF(from->m_path2, m_path2);
338332
AL_MERGE_STRING_CONF(from->m_storage_dir, m_storage_dir);
339333
AL_MERGE_STRING_CONF(from->m_relevant, m_relevant);
334+
AL_MERGE_STRING_CONF(from->m_prefix, m_prefix);
340335

341336
if (from->m_filePermission != -1) {
342337
m_filePermission = from->m_filePermission;

‎src/audit_log/writer/parallel.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@ bool Parallel::write(Transaction *transaction, int parts, std::string *error) {
119119
} else {
120120
std::string boundary;
121121
generateBoundary(&boundary);
122-
log = transaction->toOldAuditLogFormat(parts, "-" + boundary + "--");
122+
log = transaction->toOldAuditLogFormat(parts, "-" + boundary + "--", m_audit->m_prefix);
123123
}
124124

125125
const auto &logPath = m_audit->m_storage_dir;

‎src/audit_log/writer/serial.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ bool Serial::write(Transaction *transaction, int parts, std::string *error) {
4242
} else {
4343
std::string boundary;
4444
generateBoundary(&boundary);
45-
msg = transaction->toOldAuditLogFormat(parts, "-" + boundary + "--");
45+
msg = transaction->toOldAuditLogFormat(parts, "-" + boundary + "--", m_audit->m_prefix);
4646
}
4747

4848
return utils::SharedFiles::getInstance().write(m_audit->m_path1, msg,

0 commit comments

Comments
 (0)