Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit59fc243

Browse files
author
Felipe Zimmerle
committed
Adds the `crypto' option to SecRemoteRules directive
Originally the SecRemoteRules fetch the rules from an remote server in anspecific format, using cryptography. This patch adds the possibility toload rules in plain/text format.
1 parentc54bb74 commit59fc243

File tree

3 files changed

+47
-13
lines changed

3 files changed

+47
-13
lines changed

‎apache2/apache2_config.c‎

Lines changed: 27 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2240,18 +2240,37 @@ static const char *cmd_remote_rules_fail(cmd_parms *cmd, void *_dcfg, const char
22402240
}
22412241

22422242
staticconstchar*cmd_remote_rules(cmd_parms*cmd,void*_dcfg,constchar*p1,
2243-
constchar*p2)
2243+
constchar*p2,constchar*p3)
22442244
{
22452245
char*error_msg=NULL;
22462246
directory_config*dcfg= (directory_config*)_dcfg;
2247+
#ifdefWITH_REMOTE_RULES_SUPPORT
2248+
intcrypto=0;
2249+
constchar*uri=p2;
2250+
constchar*key=p1;
2251+
#endif
2252+
22472253
if (dcfg==NULL)returnNULL;
22482254

22492255
#ifdefWITH_REMOTE_RULES_SUPPORT
2256+
if (strncasecmp(p1,"crypto",6)==0)
2257+
{
2258+
uri=p3;
2259+
key=p2;
2260+
crypto=1;
2261+
}
2262+
2263+
if (uri==NULL||key==NULL)
2264+
{
2265+
returnapr_psprintf(cmd->pool,"ModSecurity: Use SecRemoteRule with " \
2266+
"Key and URI");
2267+
}
2268+
22502269
// FIXME: make it https only.
22512270
// if (strncasecmp(p1, "https", 5) != 0) {
2252-
if (strncasecmp(p2,"http",4)!=0) {
2253-
returnapr_psprintf(cmd->pool,"ModSecurity: Invalidvalue for" \
2254-
" %s, expected an HTTPS address.",p2);
2271+
if (strncasecmp(uri,"http",4)!=0) {
2272+
returnapr_psprintf(cmd->pool,"ModSecurity: InvalidURI:" \
2273+
" %s, expected an HTTPS address.",uri);
22552274
}
22562275

22572276
// FIXME: Should we handle more then one server at once?
@@ -2270,9 +2289,10 @@ static const char *cmd_remote_rules(cmd_parms *cmd, void *_dcfg, const char *p1,
22702289

22712290
remote_rules_server->context=dcfg;
22722291
remote_rules_server->context_label=apr_pstrdup(cmd->pool,"Unkwon context");
2273-
remote_rules_server->key=p1;
2274-
remote_rules_server->uri=p2;
2292+
remote_rules_server->key=key;
2293+
remote_rules_server->uri=uri;
22752294
remote_rules_server->amount_of_rules=0;
2295+
remote_rules_server->crypto=crypto;
22762296

22772297
msc_remote_add_rules_from_uri(cmd,remote_rules_server,&error_msg);
22782298
if (error_msg!=NULL)
@@ -3575,7 +3595,7 @@ const command_rec module_directives[] = {
35753595
"On or Off"
35763596
),
35773597

3578-
AP_INIT_TAKE2 (
3598+
AP_INIT_TAKE23 (
35793599
"SecRemoteRules",
35803600
cmd_remote_rules,
35813601
NULL,

‎apache2/msc_remote_rules.c‎

Lines changed: 19 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -607,17 +607,25 @@ int msc_remote_add_rules_from_uri(cmd_parms *orig_parms,
607607
returnres;
608608
}
609609

610-
msc_remote_decrypt(mp,remote_rules_server->key,&chunk_encrypted,
610+
if (remote_rules_server->crypto==1)
611+
{
612+
msc_remote_decrypt(mp,remote_rules_server->key,&chunk_encrypted,
611613
&plain_text,
612614
&plain_text_len,
613615
error_msg);
614-
if (*error_msg!=NULL)
616+
if (*error_msg!=NULL)
617+
{
618+
return-1;
619+
}
620+
621+
msc_remote_clean_chunk(&chunk_encrypted);
622+
}
623+
else
615624
{
616-
return-1;
625+
plain_text=chunk_encrypted.memory;
626+
plain_text_len=strlen(plain_text);
617627
}
618628

619-
msc_remote_clean_chunk(&chunk_encrypted);
620-
621629
len=0;
622630
plain_text_len=strlen(plain_text);
623631
while (len<plain_text_len)
@@ -679,7 +687,7 @@ int msc_remote_add_rules_from_uri(cmd_parms *orig_parms,
679687
}
680688
__except(EXCEPTION_EXECUTE_HANDLER)
681689
{
682-
error_msg="Command failed to execute (check file/folder" \
690+
*error_msg="Command failed to execute (check file/folder" \
683691
"permissions, syntax, etc.).";
684692
return-1;
685693
}
@@ -692,6 +700,11 @@ int msc_remote_add_rules_from_uri(cmd_parms *orig_parms,
692700
}
693701

694702
remote_rules_server->amount_of_rules=added_rules;
703+
704+
if (remote_rules_server->crypto==1)
705+
{
706+
msc_remote_clean_chunk(&chunk_encrypted);
707+
}
695708
}
696709

697710

‎apache2/msc_remote_rules.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ struct msc_remote_rules_server {
4545
constchar*uri;
4646
constchar*key;
4747
intamount_of_rules;
48+
intcrypto;
4849
};
4950

5051
constchar*msc_remote_invoke_cmd(constcommand_rec*cmd,cmd_parms*parms,

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp