Skip to content

Commit adf7d24

Browse files
allanrboallanrbo
committed
Merge remote-tracking branch 'upstream/v2/master' into v2/master
2 parents c4e682a + 4ee1d9c commit adf7d24

15 files changed

+169
-44
lines changed

‎CHANGES

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,26 @@
1+
DD MMM YYYY - 2.9.3 - To be released
2+
------------------------------------
3+
4+
* Optionally preallocates memory when SecStreamInBodyInspection is on
5+
[Issue #1366 - @allanbomsft, @zimmerle]
6+
* Fixed typo in build_yajl.bat
7+
[Issue #1366 - @allanbomsft]
8+
* Fixes SecConnWriteStateLimit
9+
[Issue #1545 - @nicjansma]
10+
* Added "empy chunk" check
11+
[Issue #1347, #1446 - @gravagli, @bostrt, @zimmerle]
12+
* Add capture action to @detectXSS operator
13+
[Issue #1488, #1482 - @victorhora]
14+
* Fix for wildcard operator when loading conf files on Nginx / IIS
15+
[Issue #1486, #1285 - @victorhora and @thierry-f-78]
16+
* Set of fixies to make windows build workable with the buildbots
17+
[Commit 94fe3 - @zimmerle]
18+
* Uses LOG_NO_STOPWATCH instead of DLOG_NO_STOPWATCH
19+
[Issue #1510 - @marcstern]
20+
* Adds missing headers
21+
[Issue #1454 - @devnexen]
22+
23+
124
18 Jul 2017 - 2.9.2
225
-------------------
326

‎apache2/apache2_io.c

Lines changed: 30 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -85,10 +85,11 @@ apr_status_t input_filter(ap_filter_t *f, apr_bucket_brigade *bb_out,
8585
return APR_EGENERAL;
8686
}
8787

88-
if (chunk && (!msr->txcfg->stream_inbody_inspection || (msr->txcfg->stream_inbody_inspection && msr->if_stream_changed == 0))) {
89-
/* Copy the data we received in the chunk */
90-
bucket = apr_bucket_heap_create(chunk->data, chunk->length, NULL,
91-
f->r->connection->bucket_alloc);
88+
if (chunk && chunk->length > 0) {
89+
if (chunk && (!msr->txcfg->stream_inbody_inspection || (msr->txcfg->stream_inbody_inspection && msr->if_stream_changed == 0))) {
90+
/* Copy the data we received in the chunk */
91+
bucket = apr_bucket_heap_create(chunk->data, chunk->length, NULL,
92+
f->r->connection->bucket_alloc);
9293

9394
#if 0
9495

@@ -107,33 +108,34 @@ apr_status_t input_filter(ap_filter_t *f, apr_bucket_brigade *bb_out,
107108

108109
#endif
109110

110-
if (bucket == NULL) return APR_EGENERAL;
111-
APR_BRIGADE_INSERT_TAIL(bb_out, bucket);
111+
if (bucket == NULL) return APR_EGENERAL;
112+
APR_BRIGADE_INSERT_TAIL(bb_out, bucket);
112113

113-
if (msr->txcfg->debuglog_level >= 4) {
114-
msr_log(msr, 4, "Input filter: Forwarded %" APR_SIZE_T_FMT " bytes.", chunk->length);
115-
}
116-
} else if (msr->stream_input_data != NULL) {
114+
if (msr->txcfg->debuglog_level >= 4) {
115+
msr_log(msr, 4, "Input filter: Forwarded %" APR_SIZE_T_FMT " bytes.", chunk->length);
116+
}
117+
} else if (msr->stream_input_data != NULL) {
117118

118-
msr->if_stream_changed = 0;
119+
msr->if_stream_changed = 0;
119120

120-
bucket = apr_bucket_heap_create(msr->stream_input_data, msr->stream_input_length, NULL,
121-
f->r->connection->bucket_alloc);
121+
bucket = apr_bucket_heap_create(msr->stream_input_data, msr->stream_input_length, NULL,
122+
f->r->connection->bucket_alloc);
122123

123-
if (msr->txcfg->stream_inbody_inspection) {
124-
if(msr->stream_input_data != NULL) {
125-
free(msr->stream_input_data);
126-
msr->stream_input_data = NULL;
124+
if (msr->txcfg->stream_inbody_inspection) {
125+
if(msr->stream_input_data != NULL) {
126+
free(msr->stream_input_data);
127+
msr->stream_input_data = NULL;
128+
}
127129
}
128-
}
129130

130-
if (bucket == NULL) return APR_EGENERAL;
131-
APR_BRIGADE_INSERT_TAIL(bb_out, bucket);
131+
if (bucket == NULL) return APR_EGENERAL;
132+
APR_BRIGADE_INSERT_TAIL(bb_out, bucket);
132133

133-
if (msr->txcfg->debuglog_level >= 4) {
134-
msr_log(msr, 4, "Input stream filter: Forwarded %" APR_SIZE_T_FMT " bytes.", msr->stream_input_length);
135-
}
134+
if (msr->txcfg->debuglog_level >= 4) {
135+
msr_log(msr, 4, "Input stream filter: Forwarded %" APR_SIZE_T_FMT " bytes.", msr->stream_input_length);
136+
}
136137

138+
}
137139
}
138140

139141
if (rc == 0) {
@@ -190,7 +192,6 @@ apr_status_t read_request_body(modsec_rec *msr, char **error_msg) {
190192
if (msr->txcfg->debuglog_level >= 4) {
191193
msr_log(msr, 4, "Input filter: Reading request body.");
192194
}
193-
194195
if (modsecurity_request_body_start(msr, error_msg) < 0) {
195196
return -1;
196197
}
@@ -281,9 +282,14 @@ apr_status_t read_request_body(modsec_rec *msr, char **error_msg) {
281282
}
282283

283284
if (msr->txcfg->stream_inbody_inspection == 1) {
285+
#ifndef MSC_LARGE_STREAM_INPUT
286+
msr->stream_input_length+=buflen;
287+
modsecurity_request_body_to_stream(msr, buf, buflen, error_msg);
288+
#else
284289
if (modsecurity_request_body_to_stream(msr, buf, buflen, error_msg) < 0) {
285290
return -1;
286291
}
292+
#endif
287293
}
288294

289295
msr->reqbody_length += buflen;

‎apache2/mod_security2.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1597,7 +1597,7 @@ static int hook_connection_early(conn_rec *conn)
15971597
"Possible DoS Consumption Attack [Rejected]", ip_count_w,
15981598
conn_write_state_limit, client_ip);
15991599

1600-
if (!conn_limits_filter_state == MODSEC_ENABLED)
1600+
if (conn_limits_filter_state == MODSEC_ENABLED)
16011601
return OK;
16021602
}
16031603
}

‎apache2/modsecurity.h

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -287,7 +287,10 @@ struct modsec_rec {
287287
unsigned int resbody_contains_html;
288288

289289
apr_size_t stream_input_length;
290+
#ifdef MSC_LARGE_STREAM_INPUT
290291
apr_size_t stream_input_allocated_length;
292+
#endif
293+
291294
char *stream_input_data;
292295
apr_size_t stream_output_length;
293296
char *stream_output_data;

‎apache2/msc_logging.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1165,7 +1165,7 @@ void sec_audit_logger_json(modsec_rec *msr) {
11651165

11661166

11671167
/* Stopwatch2 */
1168-
#ifdef DLOG_NO_STOPWATCH
1168+
#ifdef LOG_NO_STOPWATCH
11691169
if (msr->txcfg->debuglog_level >= 9)
11701170
#endif
11711171
format_performance_variables_json(msr, g);
@@ -1998,7 +1998,7 @@ void sec_audit_logger_native(modsec_rec *msr) {
19981998
}
19991999

20002000
/* Stopwatch; left in for compatibility reasons */
2001-
#ifdef DLOG_NO_STOPWATCH
2001+
#ifdef LOG_NO_STOPWATCH
20022002
if (msr->txcfg->debuglog_level >= 9) {
20032003
#endif
20042004
text = apr_psprintf(msr->mp, "Stopwatch: %" APR_TIME_T_FMT " %" APR_TIME_T_FMT " (- - -)\n",
@@ -2013,7 +2013,7 @@ void sec_audit_logger_native(modsec_rec *msr) {
20132013
"; %s\n", msr->request_time, (now - msr->request_time), perf_all);
20142014
sec_auditlog_write(msr, text, strlen(text));
20152015
}
2016-
#ifdef DLOG_NO_STOPWATCH
2016+
#ifdef LOG_NO_STOPWATCH
20172017
}
20182018
#endif
20192019

‎apache2/msc_reqbody.c

Lines changed: 51 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -428,9 +428,59 @@ apr_status_t modsecurity_request_body_store(modsec_rec *msr,
428428
}
429429

430430
apr_status_t modsecurity_request_body_to_stream(modsec_rec *msr, const char *buffer, int buflen, char **error_msg) {
431+
#ifndef MSC_LARGE_STREAM_INPUT
432+
char *stream_input_body = NULL;
433+
char *data = NULL;
434+
int first_pkt = 0;
435+
#else
431436
apr_size_t allocate_length = 0;
432437
char* allocated = NULL;
438+
#endif
439+
440+
#ifndef MSC_LARGE_STREAM_INPUT
441+
if(msr->stream_input_data == NULL) {
442+
msr->stream_input_data = (char *)calloc(sizeof(char), msr->stream_input_length + 1);
443+
first_pkt = 1;
444+
}
445+
else {
446+
447+
data = (char *)malloc(msr->stream_input_length + 1 - buflen);
448+
449+
if(data == NULL)
450+
return -1;
451+
452+
memset(data, 0, msr->stream_input_length + 1 - buflen);
453+
memcpy(data, msr->stream_input_data, msr->stream_input_length - buflen);
454+
455+
stream_input_body = (char *)realloc(msr->stream_input_data, msr->stream_input_length + 1);
456+
457+
msr->stream_input_data = (char *)stream_input_body;
458+
}
459+
460+
if (msr->stream_input_data == NULL) {
461+
if(data) {
462+
free(data);
463+
data = NULL;
464+
}
465+
*error_msg = apr_psprintf(msr->mp, "Unable to allocate memory to hold request body on stream. Asked for %" APR_SIZE_T_FMT " bytes.",
466+
msr->stream_input_length + 1);
467+
return -1;
468+
}
469+
470+
memset(msr->stream_input_data, 0, msr->stream_input_length+1);
471+
472+
if(first_pkt) {
473+
memcpy(msr->stream_input_data, buffer, msr->stream_input_length);
474+
} else {
475+
memcpy(msr->stream_input_data, data, msr->stream_input_length - buflen);
476+
memcpy(msr->stream_input_data+(msr->stream_input_length - buflen), buffer, buflen);
477+
}
433478

479+
if(data) {
480+
free(data);
481+
data = NULL;
482+
}
483+
#else
434484
if (msr->stream_input_data == NULL) {
435485
// Is the request body length known beforehand? (requests that are not Transfer-Encoding: chunked)
436486
if (msr->request_content_length > 0) {
@@ -458,7 +508,6 @@ apr_status_t modsecurity_request_body_to_stream(modsec_rec *msr, const char *buf
458508
else {
459509
// Do we need to expand the space we have previously allocated?
460510
if ((msr->stream_input_length + buflen) > msr->stream_input_allocated_length) {
461-
462511
// If this becomes a hotspot again, consider increasing by some percent extra each time, for fewer reallocs
463512
allocate_length = msr->stream_input_length + buflen;
464513

@@ -480,10 +529,10 @@ apr_status_t modsecurity_request_body_to_stream(modsec_rec *msr, const char *buf
480529
}
481530
}
482531
}
483-
484532
// Append buffer to msr->stream_input_data
485533
memcpy(msr->stream_input_data + msr->stream_input_length, buffer, buflen);
486534
msr->stream_input_length += buflen;
535+
#endif
487536

488537
return 1;
489538
}

‎apache2/msc_status_engine.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@
1919
#ifdef WIN32
2020
#include <winsock2.h>
2121
#include <iphlpapi.h>
22+
#else
23+
#include <sys/ioctl.h>
24+
#include <netdb.h>
2225
#endif
2326

2427
#ifdef DARWIN

‎apache2/msc_tree.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414

1515
#include <stdio.h>
1616
#include <stdlib.h>
17+
#include <apr.h>
1718
#if APR_HAVE_STDINT_H
1819
#include <stdint.h>
1920
#endif

‎apache2/msc_util.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,10 @@
2222
#include "msc_release.h"
2323
#include "msc_util.h"
2424

25+
#include <apr.h>
26+
#if APR_HAVE_ARPA_INET_H
27+
#include <arpa/inet.h>
28+
#endif
2529
#include <apr_lib.h>
2630
#include <apr_sha1.h>
2731
#include "modsecurity_config.h"

‎apache2/re_operators.c

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -634,18 +634,25 @@ static int msre_op_rsub_execute(modsec_rec *msr, msre_rule *rule, msre_var *var,
634634
free(msr->stream_input_data);
635635
msr->stream_input_data = NULL;
636636
msr->stream_input_length = 0;
637+
#ifdef MSC_LARGE_STREAM_INPUT
637638
msr->stream_input_allocated_length = 0;
638639

639640
msr->stream_input_data = (char *)malloc(size);
641+
#else
642+
msr->stream_input_data = (char *)malloc(size+1);
643+
#endif
640644

641645
if(msr->stream_input_data == NULL) {
642646
return -1;
643647
}
644648

645649
msr->stream_input_length = size;
650+
#ifdef MSC_LARGE_STREAM_INPUT
646651
msr->stream_input_allocated_length = size;
647652
memset(msr->stream_input_data, 0x0, size);
648-
653+
#else
654+
memset(msr->stream_input_data, 0x0, size+1);
655+
#endif
649656
msr->if_stream_changed = 1;
650657

651658
memcpy(msr->stream_input_data, data, size);
@@ -2160,12 +2167,14 @@ static int msre_op_detectSQLi_execute(modsec_rec *msr, msre_rule *rule, msre_var
21602167
*/
21612168
static int msre_op_detectXSS_execute(modsec_rec *msr, msre_rule *rule, msre_var *var,
21622169
char **error_msg) {
2163-
2170+
int capture;
21642171
int is_xss;
21652172

21662173
is_xss = libinjection_xss(var->value, var->value_len);
2174+
capture = apr_table_get(rule->actionset->actions, "capture") ? 1 : 0;
21672175

21682176
if (is_xss) {
2177+
set_match_to_tx(msr, capture, var->value, 0);
21692178
*error_msg = apr_psprintf(msr->mp, "detected XSS using libinjection.");
21702179

21712180
if (msr->txcfg->debuglog_level >= 9) {

0 commit comments

Comments
 (0)