owasp-modsecurity / owasp-modsecurity/ModSecurity
No "real" capture of HTTP:BL response
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
Unfortunately the RBL operator returns the originally IP on match, but not the "real" response. This means, that this operator only could be used on a boolean base like "If there is a DNS response, then match".
IMHO being able to filter requests based on a score would be much better and more feasible, so I changed the code like mentioned below.
if (rule && t && rule->hasCaptureAction()) {
char *respBl;
int first, second, third, fourth;
respBl = inet_ntoa(sin.sin_addr);
if (sscanf(respBl, "%d.%d.%d.%d", &first, &second, &third, &fourth) != 4) {
ms_dbg_a(t, 4, "RBL lookup of " + ipStr + " failed: bad response");
//return false;
}
else {
t->m_collections.m_tx_collection->storeOrUpdateFirst(
"1", std::string(respBl));
t->m_collections.m_tx_collection->storeOrUpdateFirst(
"2", std::to_string(fourth));
}
furtherInfo(&sin, ipStr, t, m_provider);
}
trans->m_collections.m_tx_collection->storeOrUpdateFirst(
"2", std::to_string(score));
trans->m_collections.m_tx_collection->storeOrUpdateFirst(
"3", std::to_string(type));
trans->m_collections.m_tx_collection->storeOrUpdateFirst(
"4", std::to_string(days));
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading src/operators/rbl.cc at the linked regions and compare current behavior with the historical snippets. Trace how the RBL response and transaction captures are represented; done means the operator exposes the real response data needed for score-based filtering rather than only the original IP.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100