pub fn content_filter_check(
    logs: &mut Logs,
    tags: &mut Tags,
    rinfo: &RequestInfo,
    profile: &ContentFilterProfile,
    mhsdb: Option<&ContentFilterRules>,
) -> Result<(), ContentFilterBlock> {
    use SectionIdx::*;
    let mut omit = Default::default();

    // directly exit if omitted profile
    if tags.has_intersection(&profile.ignore) {
        logs.debug("content filter bypass because of global ignore");
        return Ok(());
    }

    // check section profiles
    for idx in &[Path, Headers, Cookies, Args] {
        section_check(
            logs,
            tags,
            *idx,
            profile.sections.get(*idx),
            get_section(*idx, rinfo),
            profile.ignore_alphanum,
            &mut omit,
        )?;
    }

    let kept = profile.active.union(&profile.report).cloned().collect::<HashSet<_>>();
    let test_xss = LIBINJECTION_XSS_TAGS.intersection(&profile.ignore).next().is_none()
        && LIBINJECTION_XSS_TAGS.intersection(&kept).next().is_some();
    let test_sqli = LIBINJECTION_SQLI_TAGS.intersection(&profile.ignore).next().is_none()
        && LIBINJECTION_SQLI_TAGS.intersection(&kept).next().is_some();

    let mut hca_keys: HashMap<String, (SectionIdx, String)> = HashMap::new();

    // list of non whitelisted entries
    for idx in &[Path, Headers, Cookies, Args] {
        let section_content = get_section(*idx, rinfo)
            .iter()
            .filter(|(name, _)| !omit.entries.get(*idx).contains(*name))
            .map(|(name, value)| (value.to_string(), (*idx, name.to_string())));
        hca_keys.extend(section_content);
    }

    injection_check(tags, &hca_keys, &omit, test_xss, test_sqli);

    let mut specific_tags = Tags::default();

    // finally, hyperscan check
    match mhsdb {
        Some(hsdb) => {
            if let Err(rr) = hyperscan(
                logs,
                tags,
                &mut specific_tags,
                hca_keys,
                hsdb,
                &kept,
                &profile.ignore,
                &omit.exclusions,
            ) {
                logs.error(|| rr.to_string())
            }
        }
        None => {
            logs.warning(||format!("no hsdb found for profile {}, it probably means that no rules were matched by the active/report/ignore", profile.id));
        }
    }

    let sactive = specific_tags.intersect(&profile.active);
    let sreport = specific_tags.intersect(&profile.report);
    tags.extend(specific_tags);

    if !sactive.is_empty() {
        return Err(ContentFilterBlock::Block(sactive));
    }
    if !sreport.is_empty() {
        return Err(ContentFilterBlock::Monitor(sreport));
    }

    let active = tags.intersect(&profile.active);
    if !active.is_empty() {
        return Err(ContentFilterBlock::Block(active));
    }

    let report = tags.intersect(&profile.report);
    if !report.is_empty() {
        return Err(ContentFilterBlock::Monitor(report));
    }

    Ok(())
}
/// Runs the Content Filter part of curiefense
Runs the Content Filter part of curiefense
Runs the Content Filter part of curiefense
pub fn content_filter_check(
    logs: &mut Logs,
    tags: &mut Tags,
    rinfo: &RequestInfo,
    profile: &ContentFilterProfile,
    mhsdb: Option<&ContentFilterRules>,
) -> Result<(), ContentFilterBlock> {
    use SectionIdx::*;
    let mut omit = Default::default();
    // directly exit if omitted profile
    if tags.has_intersection(&profile.ignore) {
        logs.debug("content filter bypass because of global ignore");
        return Ok(());
    }
    // check section profiles
    for idx in &[Path, Headers, Cookies, Args] {
        section_check(
            logs,
            tags,
            *idx,
            profile.sections.get(*idx),
            get_section(*idx, rinfo),
            profile.ignore_alphanum,
            &mut omit,
        )?;
    }
    let kept = profile.active.union(&profile.report).cloned().collect::<HashSet<_>>();
    let test_xss = LIBINJECTION_XSS_TAGS.intersection(&profile.ignore).next().is_none()
        && LIBINJECTION_XSS_TAGS.intersection(&kept).next().is_some();
    let test_sqli = LIBINJECTION_SQLI_TAGS.intersection(&profile.ignore).next().is_none()
        && LIBINJECTION_SQLI_TAGS.intersection(&kept).next().is_some();
    let mut hca_keys: HashMap<String, (SectionIdx, String)> = HashMap::new();
    // list of non whitelisted entries
    for idx in &[Path, Headers, Cookies, Args] {
        let section_content = get_section(*idx, rinfo)
            .iter()
            .filter(|(name, _)| !omit.entries.get(*idx).contains(*name))
            .map(|(name, value)| (value.to_string(), (*idx, name.to_string())));
        hca_keys.extend(section_content);
    }
    injection_check(tags, &hca_keys, &omit, test_xss, test_sqli);
    let mut specific_tags = Tags::default();
    // finally, hyperscan check
    match mhsdb {
        Some(hsdb) => {
            if let Err(rr) = hyperscan(
                logs,
                tags,
                &mut specific_tags,
                hca_keys,
                hsdb,
                &kept,
                &profile.ignore,
                &omit.exclusions,
            ) {
                logs.error(|| rr.to_string())
            }
        }
        None => {
            logs.warning(||format!("no hsdb found for profile {}, it probably means that no rules were matched by the active/report/ignore", profile.id));
        }
    }
    let sactive = specific_tags.intersect(&profile.active);
    let sreport = specific_tags.intersect(&profile.report);
    tags.extend(specific_tags);
    if !sactive.is_empty() {
        return Err(ContentFilterBlock::Block(sactive));
    }
    if !sreport.is_empty() {
        return Err(ContentFilterBlock::Monitor(sreport));
    }
    let active = tags.intersect(&profile.active);
    if !active.is_empty() {
        return Err(ContentFilterBlock::Block(active));
    }
    let report = tags.intersect(&profile.report);
    if !report.is_empty() {
        return Err(ContentFilterBlock::Monitor(report));
    }
    Ok(())
}
pub fn content_filter_check ( logs : & mut Logs , tags : & mut Tags , rinfo : & RequestInfo , profile : & ContentFilterProfile , mhsdb : Option < & ContentFilterRules > , ) -> Result < ( ) , ContentFilterBlock > { use SectionIdx :: * ; let mut omit = Default :: default ( ) ; // directly exit if omitted profile if tags . has_intersection ( & profile . ignore ) { logs . debug ( " " ) ; return Ok ( ( ) ) ; } // check section profiles for idx in & [ Path , Headers , Cookies , Args ] { section_check ( logs , tags , * idx , profile . sections . get ( * idx ) , get_section ( * idx , rinfo ) , profile . ignore_alphanum , & mut omit , ) ? ; } let kept = profile . active . union ( & profile . report ) . cloned ( ) . collect :: < HashSet < _ > > ( ) ; let test_xss = LIBINJECTION_XSS_TAGS . intersection ( & profile . ignore ) . next ( ) . is_none ( ) && LIBINJECTION_XSS_TAGS . intersection ( & kept ) . next ( ) . is_some ( ) ; let test_sqli = LIBINJECTION_SQLI_TAGS . intersection ( & profile . ignore ) . next ( ) . is_none ( ) && LIBINJECTION_SQLI_TAGS . intersection ( & kept ) . next ( ) . is_some ( ) ; let mut hca_keys : HashMap < String , ( SectionIdx , String ) > = HashMap :: new ( ) ; // list of non whitelisted entries for idx in & [ Path , Headers , Cookies , Args ] { let section_content = get_section ( * idx , rinfo ) . iter ( ) . filter ( | ( name , _ ) | ! omit . entries . get ( * idx ) . contains ( * name ) ) . map ( | ( name , value ) | ( value . to_string ( ) , ( * idx , name . to_string ( ) ) ) ) ; hca_keys . extend ( section_content ) ; } injection_check ( tags , & hca_keys , & omit , test_xss , test_sqli ) ; let mut specific_tags = Tags :: default ( ) ; // finally, hyperscan check match mhsdb { Some ( hsdb ) => { if let Err ( rr ) = hyperscan ( logs , tags , & mut specific_tags , hca_keys , hsdb , & kept , & profile . ignore , & omit . exclusions , ) { logs . error ( | | rr . to_string ( ) ) } } None => { logs . warning ( | | format ! ( " " profile id ) ) ; } } let sactive = specific_tags . intersect ( & profile . active ) ; let sreport = specific_tags . intersect ( & profile . report ) ; tags . extend ( specific_tags ) ; if ! sactive . is_empty ( ) { return Err ( ContentFilterBlock :: Block ( sactive ) ) ; } if ! sreport . is_empty ( ) { return Err ( ContentFilterBlock :: Monitor ( sreport ) ) ; } let active = tags . intersect ( & profile . active ) ; if ! active . is_empty ( ) { return Err ( ContentFilterBlock :: Block ( active ) ) ; } let report = tags . intersect ( & profile . report ) ; if ! report . is_empty ( ) { return Err ( ContentFilterBlock :: Monitor ( report ) ) ; } Ok ( ( ) ) }
Runs the Content Filter part of curiefense
Runs the Content Filter part of curiefense
logs
&mut Logs
tags
&mut Tags
rinfo
&RequestInfo
profile
&ContentFilterProfile
mhsdb
Option<&ContentFilterRules>