zentinel-modsec 0.1.2

Pure Rust ModSecurity implementation with full OWASP CRS compatibility
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134

//! Network operators (@ipMatch).

use super::traits::{Operator, OperatorResult};
use crate::error::{Error, Result};
use ipnetwork::IpNetwork;
use std::net::IpAddr;

/// IP match operator (@ipMatch).
pub struct IpMatchOperator {
    networks: Vec<IpNetwork>,
}

impl IpMatchOperator {
    /// Create from space-separated IP/CIDR list.
    pub fn new(ips: &str) -> Result<Self> {
        let networks = ips
            .split_whitespace()
            .map(|s| s.trim())
            .filter(|s| !s.is_empty())
            .map(|s| {
                // Handle bare IPs (add /32 or /128)
                if s.contains('/') {
                    s.parse::<IpNetwork>()
                } else {
                    // Try as IP address first
                    if let Ok(ip) = s.parse::<IpAddr>() {
                        match ip {
                            IpAddr::V4(v4) => Ok(IpNetwork::V4(
                                ipnetwork::Ipv4Network::new(v4, 32).unwrap(),
                            )),
                            IpAddr::V6(v6) => Ok(IpNetwork::V6(
                                ipnetwork::Ipv6Network::new(v6, 128).unwrap(),
                            )),
                        }
                    } else {
                        s.parse::<IpNetwork>()
                    }
                }
            })
            .collect::<std::result::Result<Vec<_>, _>>()
            .map_err(|e| Error::InvalidIp {
                value: ips.to_string(),
                message: e.to_string(),
            })?;

        Ok(Self { networks })
    }

    /// Create from a file containing IPs/CIDRs.
    pub fn from_file(path: &str) -> Result<Self> {
        let content = std::fs::read_to_string(path).map_err(|e| Error::RuleFileLoad {
            path: path.into(),
            source: e,
        })?;

        let networks = content
            .lines()
            .map(|l| l.trim())
            .filter(|l| !l.is_empty() && !l.starts_with('#'))
            .map(|s| {
                if s.contains('/') {
                    s.parse::<IpNetwork>()
                } else {
                    if let Ok(ip) = s.parse::<IpAddr>() {
                        match ip {
                            IpAddr::V4(v4) => Ok(IpNetwork::V4(
                                ipnetwork::Ipv4Network::new(v4, 32).unwrap(),
                            )),
                            IpAddr::V6(v6) => Ok(IpNetwork::V6(
                                ipnetwork::Ipv6Network::new(v6, 128).unwrap(),
                            )),
                        }
                    } else {
                        s.parse::<IpNetwork>()
                    }
                }
            })
            .collect::<std::result::Result<Vec<_>, _>>()
            .map_err(|e| Error::InvalidIp {
                value: path.to_string(),
                message: e.to_string(),
            })?;

        Ok(Self { networks })
    }

    /// Check if an IP is in any of the networks.
    fn contains(&self, ip: &IpAddr) -> bool {
        self.networks.iter().any(|net| net.contains(*ip))
    }
}

impl Operator for IpMatchOperator {
    fn execute(&self, value: &str) -> OperatorResult {
        if let Ok(ip) = value.parse::<IpAddr>() {
            if self.contains(&ip) {
                return OperatorResult::matched(value.to_string());
            }
        }
        OperatorResult::no_match()
    }

    fn name(&self) -> &'static str {
        "ipMatch"
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_ip_match_single() {
        let op = IpMatchOperator::new("192.168.1.1").unwrap();
        assert!(op.execute("192.168.1.1").matched);
        assert!(!op.execute("192.168.1.2").matched);
    }

    #[test]
    fn test_ip_match_cidr() {
        let op = IpMatchOperator::new("192.168.1.0/24").unwrap();
        assert!(op.execute("192.168.1.1").matched);
        assert!(op.execute("192.168.1.255").matched);
        assert!(!op.execute("192.168.2.1").matched);
    }

    #[test]
    fn test_ip_match_multiple() {
        let op = IpMatchOperator::new("10.0.0.0/8 192.168.0.0/16").unwrap();
        assert!(op.execute("10.1.2.3").matched);
        assert!(op.execute("192.168.1.1").matched);
        assert!(!op.execute("172.16.0.1").matched);
    }
}