Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit1694a0c

Browse files
author
Felipe Zimmerle
committed
Merge branch 'nginx_regression'
2 parents93c5b8c +f043ba3 commit1694a0c

24 files changed

+544
-89
lines changed

‎Makefile.am‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,10 @@ test: check
3535
test-regression:
3636
(cd tests&&$(MAKE) test-regression)
3737

38+
test-regression-nginx:
39+
(cd tests&&$(MAKE) test-regression-nginx)
40+
41+
3842
cppcheck:
3943
cppcheck. --enable=all --force2>&1| sed's/^/warning: /g'1>&2;
4044

‎apache2/mod_security2.c‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -195,6 +195,7 @@ int perform_interception(modsec_rec *msr) {
195195
break;
196196

197197
caseACTION_PROXY :
198+
#if !(defined(VERSION_IIS))&& !(defined(VERSION_NGINX))&& !(defined(VERSION_STANDALONE))
198199
if (msr->phase<3) {
199200
if (ap_find_linked_module("mod_proxy.c")==NULL) {
200201
log_level=1;
@@ -219,6 +220,15 @@ int perform_interception(modsec_rec *msr) {
219220
"(Configuration Error: Proxy action requested but it does not work in output phases).",
220221
phase_text);
221222
}
223+
#else
224+
log_level=1;
225+
status=HTTP_INTERNAL_SERVER_ERROR;
226+
message=apr_psprintf(msr->mp,"Access denied with code 500%s "
227+
"(Configuration Error: Proxy action to %s requested but "
228+
"proxy is only available in Apache version).",
229+
phase_text,
230+
log_escape_nq(msr->mp,actionset->intercept_uri));
231+
#endif
222232
break;
223233

224234
caseACTION_DROP :
@@ -537,6 +547,11 @@ static modsec_rec *create_tx_context(request_rec *r) {
537547
staticapr_status_tchange_server_signature(server_rec*s) {
538548
char*server_version=NULL;
539549

550+
/* This is a very particular way to handle the server banner. It is Apache
551+
* only. Stanalone and descendants should address that in its specifics
552+
* implementations, e.g. Nginx module.
553+
*/
554+
#if !(defined(VERSION_IIS))&& !(defined(VERSION_NGINX))&& !(defined(VERSION_STANDALONE))
540555
if (new_server_signature==NULL)return0;
541556

542557
server_version= (char*)apache_get_server_version();
@@ -568,7 +583,7 @@ static apr_status_t change_server_signature(server_rec *s) {
568583
else {
569584
ap_log_error(APLOG_MARK,APLOG_DEBUG |APLOG_NOERRNO,0,s,"SecServerSignature: Changed server signature to \"%s\".",server_version);
570585
}
571-
586+
#endif
572587
return1;
573588
}
574589

‎build/find_lua.m4‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ LUA_LDADD=""
1717
LUA_LDFLAGS=""
1818
LUA_CONFIG=${PKG_CONFIG}
1919
LUA_PKGNAMES="lua5.1 lua-5.1 lua_5.1 lua-51 lua_51 lua51 lua5 lua"
20-
LUA_SONAMES="so la sl dll dylib"
20+
LUA_SONAMES="so la sl dll dylib a"
2121
2222
AC_ARG_WITH(
2323
lua,

‎configure.ac‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -618,6 +618,7 @@ VERSION_OK
618618
APXS_PROGNAME="`$APXS -q PROGNAME`"
619619
if test "$verbose_output" -eq 1; thenAC_MSG_NOTICE(apxsPROGNAME:$APXS_PROGNAME); fi
620620
APXS_LIBEXECDIR="`$APXS -q LIBEXECDIR`"
621+
if test "xx$APXS_LIBEXECDIR" = "xx"; then APXS_LIBEXECDIR="`$APXS -q LIBDIR`/modules"; fi
621622
if test "$verbose_output" -eq 1; thenAC_MSG_NOTICE(apxsLIBEXECDIR:$APXS_LIBEXECDIR); fi
622623
APXS_MODULES=$APXS_LIBEXECDIR
623624
if test "$verbose_output" -eq 1; thenAC_MSG_NOTICE(apxsMODULES:$APXS_MODULES); fi

‎nginx/modsecurity/ngx_http_modsecurity.c‎

Lines changed: 12 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -719,6 +719,14 @@ ngx_http_modsecurity_save_headers_out(ngx_http_request_t *r)
719719
upstream=r->upstream;
720720
r->upstream=&ngx_http_modsecurity_upstream;
721721

722+
/* case SecServerSignature was used, the "Server: ..." header is added
723+
* here, overwriting the default header supplied by nginx.
724+
*/
725+
if (modsecIsServerSignatureAvailale()!=NULL) {
726+
apr_table_add(ctx->req->headers_out,"Server",
727+
modsecIsServerSignatureAvailale());
728+
}
729+
722730
if (apr_table_do(ngx_http_modsecurity_save_headers_out_visitor,
723731
r,ctx->req->headers_out,NULL)==0) {
724732

@@ -1019,6 +1027,10 @@ ngx_http_modsecurity_handler(ngx_http_request_t *r)
10191027
returnrc;
10201028
}
10211029

1030+
if (modsecContextState(ctx->req)==MODSEC_DISABLED) {
1031+
returnNGX_DECLINED;
1032+
}
1033+
10221034
if (r->method==NGX_HTTP_POST
10231035
&&modsecIsRequestBodyAccessEnabled(ctx->req) ) {
10241036

@@ -1074,8 +1086,6 @@ ngx_http_modsecurity_header_filter(ngx_http_request_t *r) {
10741086
ngx_http_modsecurity_ctx_t*ctx;
10751087
constchar*location;
10761088
ngx_table_elt_t*h;
1077-
ngx_int_trc;
1078-
10791089

10801090
cf=ngx_http_get_module_loc_conf(r,ngx_http_modsecurity);
10811091
ctx=ngx_http_get_module_ctx(r,ngx_http_modsecurity);
@@ -1112,36 +1122,6 @@ ngx_http_modsecurity_header_filter(ngx_http_request_t *r) {
11121122

11131123
ngx_log_debug0(NGX_LOG_DEBUG_HTTP,r->connection->log,0,"modSecurity: header filter");
11141124

1115-
/* header only or SecResponseBodyAccess off */
1116-
if (r->header_only|| (!modsecIsResponseBodyAccessEnabled(ctx->req)) ) {
1117-
1118-
ctx->complete=1;
1119-
1120-
if (ngx_http_modsecurity_load_headers_in(r)!=NGX_OK
1121-
||ngx_http_modsecurity_load_headers_out(r)!=NGX_OK) {
1122-
1123-
returnNGX_HTTP_INTERNAL_SERVER_ERROR;
1124-
}
1125-
1126-
rc=ngx_http_modsecurity_status(r,modsecProcessResponse(ctx->req));
1127-
1128-
if (rc!=NGX_DECLINED) {
1129-
returnngx_http_filter_finalize_request(r,&ngx_http_modsecurity,rc);
1130-
}
1131-
1132-
if (ngx_http_modsecurity_save_headers_in(r)!=NGX_OK
1133-
||ngx_http_modsecurity_save_headers_out(r)!=NGX_OK) {
1134-
returnngx_http_filter_finalize_request(r,&ngx_http_modsecurity,NGX_HTTP_INTERNAL_SERVER_ERROR);
1135-
}
1136-
1137-
returnngx_http_next_header_filter(r);
1138-
}
1139-
1140-
/* SecResponseBodyAccess on, process rules in body filter */
1141-
1142-
/* pretend we are ngx_http_header_filter */
1143-
r->header_sent=1;
1144-
11451125
r->filter_need_in_memory=1;
11461126
returnNGX_OK;
11471127
}

‎standalone/api.c‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -500,6 +500,16 @@ void modsecSetConfigForIISRequestBody(request_rec *r)
500500
msr->txcfg->stream_inbody_inspection=1;
501501
}
502502

503+
intmodsecContextState(request_rec*r)
504+
{
505+
modsec_rec*msr=retrieve_msr(r);
506+
507+
if(msr==NULL||msr->txcfg==NULL)
508+
returnNOT_SET;
509+
510+
returnmsr->txcfg->is_enabled;
511+
}
512+
503513
intmodsecIsRequestBodyAccessEnabled(request_rec*r)
504514
{
505515
modsec_rec*msr=retrieve_msr(r);
@@ -673,3 +683,12 @@ void modsecSetWriteResponse(apr_status_t (*func)(request_rec *r, char *buf, unsi
673683
voidmodsecSetDropAction(int (*func)(request_rec*r)) {
674684
modsecDropAction=func;
675685
}
686+
687+
/*
688+
* Case SecServerSignature was used, this function returns the banner that
689+
* should be used, otherwise it returns NULL.
690+
*/
691+
constchar*modsecIsServerSignatureAvailale(void) {
692+
returnnew_server_signature;
693+
}
694+

‎standalone/api.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,8 +112,12 @@ void modsecSetDropAction(int (*func)(request_rec *r));
112112
intmodsecIsResponseBodyAccessEnabled(request_rec*r);
113113
intmodsecIsRequestBodyAccessEnabled(request_rec*r);
114114

115+
intmodsecContextState(request_rec*r);
116+
115117
voidmodsecSetConfigForIISRequestBody(request_rec*r);
116118

119+
constchar*modsecIsServerSignatureAvailale(void);
120+
117121
#ifdef__cplusplus
118122
}
119123
#endif

‎tests/Makefile.am‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,4 +60,7 @@ test: check
6060
test-regression: run-regression-tests.pl
6161
$(PERL) run-regression-tests.pl
6262

63+
test-regression-nginx: run-regression-tests-nginx.pl
64+
$(PERL) run-regression-tests-nginx.pl
65+
6366
.PHONY: test test-regression

‎tests/regression/action/00-disruptive-actions.t‎

Lines changed: 41 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -454,12 +454,22 @@
454454
SecRule REQUEST_URI"\@streq /test2.txt""phase:1,proxy:'http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt',id:500005"
455455
),
456456
match_log=> {
457-
error=> [ qr/ModSecurity: Access denied using proxyto \(phase1\)/,1 ],
457+
error=> {
458+
apache=> [qr/ModSecurity: Access denied using proxyto \(phase1\)/,1],
459+
nginx=> [qr/ModSecurity: Access deniedwith code500 \(phase1\) \(Configuration Error:Proxy actionto.* requestedbut proxyisonlyavailable in Apache version\)./,1],
460+
},
458461
},
459462
match_response=> {
460-
status=> qr/^200$/,
461-
content=> qr/^TEST$/,
463+
status=> {
464+
apache=> qr/^200$/,
465+
nginx=> qr/^500$/,
466+
},
467+
content=> {
468+
apache=> qr/^TEST$/,
469+
nginx=> qr/^*$/,
470+
},
462471
},
472+
463473
request=>new HTTP::Request(
464474
GET=>"http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test2.txt",
465475
),
@@ -475,11 +485,20 @@
475485
SecRule REQUEST_URI"\@streq /test2.txt""phase:2,proxy:'http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt',id:500006"
476486
),
477487
match_log=> {
478-
error=> [ qr/ModSecurity: Access denied using proxyto \(phase2\)/,1 ],
488+
error=> {
489+
apache=> [qr/ModSecurity: Access denied using proxyto \(phase2\)/,1],
490+
nginx=> [qr/ModSecurity: Access deniedwith code500 \(phase2\) \(Configuration Error:Proxy actionto.* requestedbut proxyisonlyavailable in Apache version\)./,1],
491+
},
479492
},
480493
match_response=> {
481-
status=> qr/^200$/,
482-
content=> qr/^TEST$/,
494+
status=> {
495+
apache=> qr/^200$/,
496+
nginx=> qr/^500$/,
497+
},
498+
content=> {
499+
apache=> qr/^TEST$/,
500+
nginx=> qr/^*$/,
501+
},
483502
},
484503
request=>new HTTP::Request(
485504
GET=>"http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test2.txt",
@@ -498,10 +517,16 @@
498517
SecRule REQUEST_URI"\@streq /test2.txt""phase:3,proxy:'http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt',id:500007"
499518
),
500519
match_log=> {
501-
error=> [ qr/ModSecurity: Access deniedwith code500 \(phase3\) \(Configuration Error:Proxy action requestedbut itdoesnot work in output phases\)./,1 ],
520+
error=> {
521+
apache=> [qr/ModSecurity: Access deniedwith code500 \(phase3\) \(Configuration Error:Proxy action requestedbut itdoesnot work in output phases\)./,1],
522+
nginx=> [qr/ModSecurity: Access deniedwith code500 \(phase3\) \(Configuration Error:Proxy actionto.* requestedbut proxyisonlyavailable in Apache version\)./,1],
523+
}
502524
},
503525
match_response=> {
504-
status=> qr/^500$/,
526+
status=> {
527+
apache=> qr/^500$/,
528+
nginx=> qr/^500$/,
529+
},
505530
},
506531
request=>new HTTP::Request(
507532
GET=>"http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test2.txt",
@@ -520,10 +545,16 @@
520545
SecRule REQUEST_URI"\@streq /test2.txt""phase:4,proxy:'http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test.txt',id:500008"
521546
),
522547
match_log=> {
523-
error=> [ qr/ModSecurity: Access deniedwith code500 \(phase4\) \(Configuration Error:Proxy action requestedbut itdoesnot work in output phases\)./,1 ],
548+
error=> {
549+
apache=> [qr/ModSecurity: Access deniedwith code500 \(phase4\) \(Configuration Error:Proxy action requestedbut itdoesnot work in output phases\)./,1],
550+
nginx=> [qr/ModSecurity: Access deniedwith code500 \(phase4\) \(Configuration Error:Proxy actionto.* requestedbut proxyisonlyavailable in Apache version\)./,1],
551+
}
524552
},
525553
match_response=> {
526-
status=> qr/^500$/,
554+
status=> {
555+
apache=> qr/^500$/,
556+
nginx=> qr/^500$/,
557+
},
527558
},
528559
request=>new HTTP::Request(
529560
GET=>"http://$ENV{SERVER_NAME}:$ENV{SERVER_PORT}/test2.txt",

‎tests/regression/config/00-load-modsec.t‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,10 @@
22
type=>"config",
33
comment=>"module loaded",
44
match_log=> {
5-
error=> [ qr/ModSecurityfor Apache.* configured\./,10 ],
5+
error=> {
6+
apache=> [ qr/ModSecurityfor Apache.* configured\./,10 ],
7+
nginx=> [ qr/ModSecurityfor nginx.* configured\./,10 ],
8+
},
69
},
710
},
811
{
@@ -18,6 +21,9 @@
1821
return$conf;
1922
},
2023
match_log=> {
21-
error=> [ qr/ModSecurityfor Apache.* configured\./,10 ],
24+
error=> {
25+
apache=> [ qr/ModSecurityfor Apache.* configured\./,10 ],
26+
nginx=> [ qr/ModSecurityfor nginx.* configured\./,10 ],
27+
},
2228
},
2329
},

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp