Starting to extract blacklist logic
Adds historical blacklisting.

Once an actor is blacklisted and goes away for the expire period, their
records are removed. It is nice to be able to keep a list of actors who
have been blacklisted. If the actor returns and triggers any ModSecurity
rule even once, they are blacklisted again based on this list.

Signed-off-by: Aaron Bedra <aaron@aaronbedra.com>
Make the threshold check more efficient.

Instead of calling ZSCORE for each actor, simply add the WITHSCORES
option to the ZRANGE call and do the comparison. This saves (n - m) calls to
Redis where n is the number of offenders and m is the number of
historically blacklisted actors.

Signed-off-by: Aaron Bedra <aaron@aaronbedra.com>
Fully extracting blacklist_and_expire()

Since the OFDP blacklisting uses the same methods for expiry and should
also add to the historical blacklist entries, the blacklist_and_expire
function was pulled out to a common place for reuse.

Some minor formatting cleanup was done as well.

Signed-off-by: Aaron Bedra <aaron@aaronbedra.com>
Version bump
Adds better OFDP response validation. Closes #13.

If wafsec.com returns either invalid JSON or a JSON repsonse that
does not contain "score", the program would segfault.

Signed-off-by: Aaron Bedra <aaron@aaronbedra.com>
Version bump
Refactoring
Refactoring. Moving to score/report/analyze

An overall theme for top level options has developed. It has turned into
score, report, and analyze. This commit does some refactoring to put
that in place. The analyze option has not yet been implemented. The
original cli options will remain in tact for one more release and have
been marked as deprecated.

Signed-off-by: Aaron Bedra <aaron@aaronbedra.com>
Move from upstream to publish as a concept

Signed-off-by: Aaron Bedra <aaron@aaronbedra.com>
Implements analyze

This commit removes the old blacklist and ofdp options and any
additional unused options in favor of a single analyze routine. As time
goes on additional analyzers will be added to this routine. Finer
grained controls around the analyze function will eventually be made,
but isn't in scope for now.

Signed-off-by: Aaron Bedra <aaron@aaronbedra.com>
Adding definition for analyze.h

Signed-off-by: Aaron Bedra <aaron@aaronbedra.com>
test total_offenses

Signed-off-by: Aaron Bedra <aaron@aaronbedra.com>
Fixing silly copy/paste error
Fix usage string options
Version bump
Merge commit '2.0.0' into redhat