Send monitor as event action instead of block (#188)

Send monitor as event action instead of block

---------

Co-authored-by: Anil Mahtani <929854+Anilm3@users.noreply.github.com>

src/event.cpp

@@ -101,11 +101,13 @@ void event_serializer::serialize(const memory::vector<event> &events, ddwaf_resu
  if (!actions.empty()) {
  ddwaf_object actions_array;
  ddwaf_object_array(&actions_array);
- for (const auto &action : actions) {
- if (!event.skip_actions) {
+ if (!event.skip_actions) {
+ for (const auto &action : actions) {
  all_actions.emplace(action);
+ ddwaf_object_array_add(&actions_array, to_object(tmp, action));
  }
- ddwaf_object_array_add(&actions_array, to_object(tmp, action));
+ } else {
+ ddwaf_object_array_add(&actions_array, to_object(tmp, "monitor"));
  }
  ddwaf_object_map_add(&rule_map, "on_match", &actions_array);
  }

tests/rule_filter_test.cpp

@@ -800,7 +800,40 @@ TEST(TestRuleFilter, MonitorSingleRule)
  EXPECT_EVENTS(out, {.id = "1",
  .name = "rule1",
  .tags = {{"type", "type1"}, {"category", "category"}},
- .actions = {"block"},
+ .actions = {"monitor"},
+ .matches = {{.op = "ip_match",
+ .address = "http.client_ip",
+ .value = "192.168.0.1",
+ .highlight = "192.168.0.1"}}});
+ EXPECT_THAT(out.actions, WithActions({}));
+ ddwaf_result_free(&out);
+ ddwaf_context_destroy(context);
+ ddwaf_destroy(handle);
+}
+
+TEST(TestRuleFilter, AvoidHavingTwoMonitorOnActions)
+{
+ auto rule = readFile("multiple_monitor_on_match.yaml");
+ ASSERT_TRUE(rule.type != DDWAF_OBJ_INVALID);
+
+ ddwaf_handle handle = ddwaf_init(&rule, nullptr, nullptr);
+ ASSERT_NE(handle, nullptr);
+ ddwaf_object_free(&rule);
+
+ ddwaf_context context = ddwaf_context_init(handle);
+ ASSERT_NE(context, nullptr);
+
+ ddwaf_object root;
+ ddwaf_object tmp;
+ ddwaf_object_map(&root);
+ ddwaf_object_map_add(&root, "http.client_ip", ddwaf_object_string(&tmp, "192.168.0.1"));
+
+ ddwaf_result out;
+ EXPECT_EQ(ddwaf_run(context, &root, &out, LONG_TIME), DDWAF_MATCH);
+ EXPECT_EVENTS(out, {.id = "1",
+ .name = "rule1",
+ .tags = {{"type", "type1"}, {"category", "category"}},
+ .actions = {"monitor"},
  .matches = {{.op = "ip_match",
  .address = "http.client_ip",
  .value = "192.168.0.1",

tests/yaml/multiple_monitor_on_match.yaml

@@ -0,0 +1,20 @@
+version: '2.1'
+exclusions:
+ - id: 1
+ rules_target:
+ - rule_id: 1
+ on_match: monitor
+rules:
+ - id: 1
+ name: rule1
+ tags:
+ type: type1
+ category: category
+ conditions:
+ - operator: ip_match
+ parameters:
+ inputs:
+ - address: http.client_ip
+ list:
+ - 192.168.0.1
+ on_match: [ monitor, block ]

validator/runner.cpp

@@ -177,6 +177,10 @@ void test_runner::validate_rule(const YAML::Node &expected, const YAML::Node &ob
  auto expected_actions = expected["on_match"];
  auto obtained_actions = obtained["on_match"];
 
+ if (obtained_actions.size() == 1 && obtained_actions[0].as<std::string>() == "monitor") {
+ return;
+ }
+
  expect(true, obtained_actions.IsDefined());
  expect(expected_actions.size(), obtained_actions.size());