CC: owasp-modsecurity#2304

This code was written by: @brandonpayton

Co-authored-by: @brandonpayton

Author: akama-aka

headers/modsecurity/audit_log.h

@@ -167,6 +167,7 @@ class AuditLog {
     bool setType(AuditLogType audit_type);
 
     bool init(std::string *error);
+    bool reopen(std::string *error);
     virtual bool close();
 
     bool saveIfRelevant(Transaction *transaction);

headers/modsecurity/rules_set.h

@@ -102,6 +102,7 @@ int msc_rules_add_file(RulesSet *rules, const char *file, const char **error);
 int msc_rules_add(RulesSet *rules, const char *plain_rules, const char **error);
 void msc_rules_error_cleanup(const char *error);
 int msc_rules_cleanup(RulesSet *rules);
+int msc_rules_reopen_audit_log(RulesSet *rules, const char **error);
 
 #ifdef __cplusplus
 }

src/audit_log/audit_log.cc

@@ -369,6 +369,12 @@ bool AuditLog::merge(AuditLog *from, std::string *error) {
     return init(error);
 }
 
+bool AuditLog::reopen(std::string *error) {
+    if (m_writer != NULL) {
+        return m_writer->reopen(error);
+    }
+    return true;
+}
 
 }  // namespace audit_log
 }  // namespace modsecurity

src/audit_log/writer/https.h

@@ -42,6 +42,9 @@ class Https : public Writer {
     bool init(std::string *error) override;
     bool write(Transaction *transaction, int parts,
         std::string *error) override;
+    bool reopen(std::string *error) override {
+        return true;
+    }
 };
 
 }  // namespace writer

src/audit_log/writer/parallel.cc

@@ -195,6 +195,34 @@ bool Parallel::write(Transaction *transaction, int parts, std::string *error) {
     return true;
 }
 
+bool Parallel::reopen(std::string *error) {
+  bool success1 = true;
+  bool success2 = true;
+  std::string error1;
+  std::string error2;
+
+  if(!m_audit->m_path1.empty()) {
+    success1 = utils::SharedFiles::getInstance().reopen(m_audit->m_path1, &error1);
+  }
+  if (!m_audit->m_path2.empty()) {
+      success2 = utils::SharedFiles::getInstance().reopen(m_audit->m_path2, &error2);
+  }
+  std::stringstream errorStream;
+  if (!success1 || !success2) {
+    errorStream << "There was an error reopening parallel audit logs.";
+
+    if (!success1 && !error1.empty()) {
+        errorStream << " " << error1;
+    }
+    if (!success2 && !error2.empty()) {
+        errorStream << " " << error2;
+    }
+
+    *error = errorStream.str();
+  }
+  return success1 && success2;
+}
+
 }  // namespace writer
 }  // namespace audit_log
 }  // namespace modsecurity

src/audit_log/writer/serial.cc

@@ -49,6 +49,19 @@ bool Serial::write(Transaction *transaction, int parts, std::string *error) {
         error);
 }
 
+bool Serial::reopen(std::string *error) {
+    bool success;
+
+    std::string errorDetail;
+    success = utils::SharedFiles::getInstance().reopen(m_audit->m_path1, &errorDetail);
+    if (!success) {
+        *error = "There was an error reopening the serial audit log. ";
+        error->append(errorDetail);
+    }
+
+    return success;
+}
+
 }  // namespace writer
 }  // namespace audit_log
 }  // namespace modsecurity

src/audit_log/writer/serial.h

@@ -47,6 +47,7 @@ class Serial : public Writer {
     bool init(std::string *error) override;
     bool write(Transaction *transaction, int parts,
         std::string *error) override;
+    bool reopen(std::string *error) override;
 };
 
 }  // namespace writer

src/audit_log/writer/writer.h

@@ -51,6 +51,7 @@ class Writer {
     virtual bool init(std::string *error) = 0;
     virtual bool write(Transaction *transaction, int parts,
         std::string *error) = 0;
+    virtual bool reopen(std::string *error) = 0;
 
     static void generateBoundary(std::string *boundary);
 

src/utils/shared_files.h

@@ -33,6 +33,7 @@ namespace utils {
 class SharedFiles {
 public:
     bool open(const std::string& fileName, std::string *error);
+    bool reopen(const std::string& filename, std::string *error);
     void close(const std::string& fileName);
     bool write(const std::string& fileName, const std::string &msg,
         std::string *error);

test/cppcheck_suppressions.txt

@@ -21,7 +21,12 @@ shiftNegative:src/utils/msc_tree.cc
 
 // 
 // ModSecurity v3 code...
-// 
+//
+
+functionConst:src/utils/shared_files.h:60
+useInitializationList:src/utils/shared_files.h:88
+
+
 variableScope:src/operators/rx.cc
 variableScope:src/operators/rx_global.cc