Commit7a39b4b

p0pr0ck5

authored and

Felipe Zimmerle

committed

Make JSON audit logging a configurable option

Remove compile-time setting for generating audit logsas JSON, creating a new config option (SecAuditLogFormat).sec_audit_logger is now a wrapper for sec_audit_logger_jsonor sec_audit_logger_native. This has the disadvantage ofmaking the audit log generation code harder to maintain,but the logger function itself now is no longer pepperwith binary branches.

1 parentdd79bea commit7a39b4bCopy full SHA for 7a39b4b

File tree

5 files changed

+819

-348

lines changed

apache2
configure.ac

5 files changed

+819

-348

lines changed

`‎apache2/apache2_config.c‎`

Lines changed: 27 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -73,6 +73,7 @@ void create_directory_config(apr_pool_t mp, char *path)`
`73`	`73`	`/* audit log variables */`
`74`	`74`	`dcfg->auditlog_flag=NOT_SET;`
`75`	`75`	`dcfg->auditlog_type=NOT_SET;`
	`76`	`+dcfg->auditlog_format=NOT_SET;`
`76`	`77`	`dcfg->max_rule_time=NOT_SET;`
`77`	`78`	`dcfg->auditlog_dirperms=NOT_SET;`
`78`	`79`	`dcfg->auditlog_fileperms=NOT_SET;`
`@@ -503,6 +504,8 @@ void merge_directory_configs(apr_pool_t mp, void _parent, void _child)`
`503`	`504`	`merged->auditlog2_fd=parent->auditlog2_fd;`
`504`	`505`	`merged->auditlog2_name=parent->auditlog2_name;`
`505`	`506`	`}`
	`507`	`+merged->auditlog_format= (child->auditlog_format==NOT_SET`
	`508`	`+ ?parent->auditlog_format :child->auditlog_format);`
`506`	`509`	`merged->auditlog_storage_dir= (child->auditlog_storage_dir==NOT_SET_P`
`507`	`510`	`?parent->auditlog_storage_dir :child->auditlog_storage_dir);`
`508`	`511`	`merged->auditlog_parts= (child->auditlog_parts==NOT_SET_P`
`@@ -667,6 +670,7 @@ void init_directory_config(directory_config *dcfg)`
`667`	`670`	`/* audit log variables */`
`668`	`671`	`if (dcfg->auditlog_flag==NOT_SET)dcfg->auditlog_flag=0;`
`669`	`672`	`if (dcfg->auditlog_type==NOT_SET)dcfg->auditlog_type=AUDITLOG_SERIAL;`
	`673`	`+if (dcfg->auditlog_format==NOT_SET)dcfg->auditlog_format=AUDITLOGFORMAT_NATIVE;`
`670`	`674`	`if (dcfg->max_rule_time==NOT_SET)dcfg->max_rule_time=0;`
`671`	`675`	`if (dcfg->auditlog_dirperms==NOT_SET)dcfg->auditlog_dirperms=CREATEMODE_DIR;`
`672`	`676`	`if (dcfg->auditlog_fileperms==NOT_SET)dcfg->auditlog_fileperms=CREATEMODE;`
`@@ -1291,6 +1295,21 @@ static const char cmd_audit_log_type(cmd_parms cmd, void *_dcfg,`
`1291`	`1295`	`returnNULL;`
`1292`	`1296`	`}`
`1293`	`1297`
	`1298`	`+staticconstcharcmd_audit_log_mode(cmd_parmscmd,void*_dcfg,`
	`1299`	`+constchar*p1)`
	`1300`	`+{`
	`1301`	`+directory_config*dcfg=_dcfg;`
	`1302`	`+`
	`1303`	`+if (strcasecmp(p1,"JSON")==0)dcfg->auditlog_format=AUDITLOGFORMAT_JSON;`
	`1304`	`+else`
	`1305`	`+if (strcasecmp(p1,"Native")==0)dcfg->auditlog_format=AUDITLOGFORMAT_NATIVE;`
	`1306`	`+else`
	`1307`	`+return (constchar*)apr_psprintf(cmd->pool,`
	`1308`	`+"ModSecurity: Unrecognised parameter value for SecAuditLogFormat: %s",p1);`
	`1309`	`+`
	`1310`	`+returnNULL;`
	`1311`	`+}`
	`1312`	`+`
`1294`	`1313`	`staticconstcharcmd_audit_log_dirmode(cmd_parmscmd,void*_dcfg,`
`1295`	`1314`	`constchar*p1)`
`1296`	`1315`	`{`
`@@ -3232,6 +3251,14 @@ const command_rec module_directives[] = {`
`3232`	`3251`	`"whether to use the old audit log format (Serial) or new (Concurrent)"`
`3233`	`3252`	`),`
`3234`	`3253`
	`3254`	`+AP_INIT_TAKE1 (`
	`3255`	`+"SecAuditLogFormat",`
	`3256`	`+cmd_audit_log_mode,`
	`3257`	`+NULL,`
	`3258`	`+CMD_SCOPE_ANY,`
	`3259`	`+"whether to emit audit log data in native format or JSON"`
	`3260`	`+ ),`
	`3261`	`+`
`3235`	`3262`	`AP_INIT_TAKE1 (`
`3236`	`3263`	`"SecAuditLogStorageDir",`
`3237`	`3264`	`cmd_audit_log_storage_dir,`

`‎apache2/modsecurity.h‎`

Lines changed: 3 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -519,6 +519,9 @@ struct directory_config {`
`519`	`519`	`/* AUDITLOG_SERIAL (single file) or AUDITLOG_CONCURRENT (multiple files) */`
`520`	`520`	`intauditlog_type;`
`521`	`521`
	`522`	`+/* AUDITLOGFORMAT_NATIVE or AUDITLOGFORMAT_JSON */`
	`523`	`+intauditlog_format;`
	`524`	`+`
`522`	`525`	`/* Mode for audit log directories and files */`
`523`	`526`	`apr_fileperms_tauditlog_dirperms;`
`524`	`527`	`apr_fileperms_tauditlog_fileperms;`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit7a39b4b

File tree

5 files changed

5 files changed

`‎apache2/apache2_config.c‎`

`‎apache2/modsecurity.h‎`

0 commit comments