Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit9b836b6

Browse files
author
Felipe Zimmerle
committed
Initial support to load rules from a remote server
New directive `SecRemoteRules' was added. It allows the user to load aset of rules from a given HTTP server.
1 parent899ee0c commit9b836b6

File tree

12 files changed

+902
-7
lines changed

12 files changed

+902
-7
lines changed

‎apache2/Makefile.am‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ mod_security2_la_SOURCES = acmp.c \
2121
msc_parsers.c\
2222
msc_pcre.c\
2323
msc_release.c\
24+
msc_remote_rules.c\
2425
msc_reqbody.c\
2526
msc_tree.c\
2627
msc_unicode.c\

‎apache2/Makefile.win‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ OBJS = mod_security2.obj apache2_config.obj apache2_io.obj apache2_util.obj \
5858
msc_reqbody.obj msc_geo.obj msc_gsb.obj msc_crypt.obj msc_tree.obj msc_unicode.obj acmp.obj msc_lua.obj \
5959
msc_release.obj \
6060
msc_status_engine.obj \
61+
msc_remote_rules.obj \
6162
msc_json.obj \
6263
libinjection/libinjection_html5.obj \
6364
libinjection/libinjection_sqli.obj \

‎apache2/apache2_config.c‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2213,6 +2213,50 @@ static const char *cmd_rule_engine(cmd_parms *cmd, void *_dcfg, const char *p1)
22132213
returnNULL;
22142214
}
22152215

2216+
staticconstchar*cmd_remote_rules(cmd_parms*cmd,void*_dcfg,constchar*p1,
2217+
constchar*p2)
2218+
{
2219+
char*error_msg=NULL;
2220+
directory_config*dcfg= (directory_config*)_dcfg;
2221+
if (dcfg==NULL)returnNULL;
2222+
2223+
// FIXME: make it https only.
2224+
// if (strncasecmp(p1, "https", 5) != 0) {
2225+
if (strncasecmp(p2,"http",4)!=0) {
2226+
returnapr_psprintf(cmd->pool,"ModSecurity: Invalid value for " \
2227+
" %s, expected an HTTPS address.",p2);
2228+
}
2229+
2230+
// FIXME: Should we handle more then one server at once?
2231+
if (remote_rules_server!=NULL)
2232+
{
2233+
returnapr_psprintf(cmd->pool,"ModSecurity: " \
2234+
"SecRemoteRules cannot be used more than once.");
2235+
}
2236+
2237+
remote_rules_server=apr_pcalloc(cmd->pool,sizeof(msc_remote_rules_server));
2238+
if (remote_rules_server==NULL)
2239+
{
2240+
returnapr_psprintf(cmd->pool,"ModSecurity: " \
2241+
"SecRemoteRules: Internal failure. Not enougth memory.");
2242+
}
2243+
2244+
remote_rules_server->context=dcfg;
2245+
remote_rules_server->context_label=apr_pstrdup(cmd->pool,"Unkwon context");
2246+
remote_rules_server->key=p1;
2247+
remote_rules_server->uri=p2;
2248+
remote_rules_server->amount_of_rules=0;
2249+
2250+
msc_remote_add_rules_from_uri(cmd,remote_rules_server,&error_msg);
2251+
if (error_msg!=NULL)
2252+
{
2253+
returnerror_msg;
2254+
}
2255+
2256+
returnNULL;
2257+
}
2258+
2259+
22162260
staticconstchar*cmd_status_engine(cmd_parms*cmd,void*_dcfg,constchar*p1)
22172261
{
22182262
if (strcasecmp(p1,"on")==0) {
@@ -3500,6 +3544,14 @@ const command_rec module_directives[] = {
35003544
"On or Off"
35013545
),
35023546

3547+
AP_INIT_TAKE2 (
3548+
"SecRemoteRules",
3549+
cmd_remote_rules,
3550+
NULL,
3551+
CMD_SCOPE_ANY,
3552+
"key and URI to the remote rules"
3553+
),
3554+
35033555
AP_INIT_TAKE1 (
35043556
"SecXmlExternalEntity",
35053557
cmd_xml_external_entity,

‎apache2/mod_security2.c‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@
3333

3434
#include"apr_version.h"
3535

36+
#include"msc_remote_rules.h"
37+
3638
#if defined(WITH_LUA)
3739
#include"msc_lua.h"
3840
#endif
@@ -66,6 +68,8 @@ unsigned long int DSOLOCAL msc_pcre_match_limit = 0;
6668

6769
unsigned longintDSOLOCALmsc_pcre_match_limit_recursion=0;
6870

71+
msc_remote_rules_serverDSOLOCAL*remote_rules_server=NULL;
72+
6973
intDSOLOCALstatus_engine_state=STATUS_ENGINE_DISABLED;
7074

7175
intDSOLOCALconn_limits_filter_state=MODSEC_DISABLED;
@@ -752,6 +756,24 @@ static int hook_post_config(apr_pool_t *mp, apr_pool_t *mp_log, apr_pool_t *mp_t
752756
"SecStatusEngine to On.");
753757
}
754758
#endif
759+
760+
if (remote_rules_server!=NULL)
761+
{
762+
if (remote_rules_server->amount_of_rules==1)
763+
{
764+
ap_log_error(APLOG_MARK,APLOG_NOTICE,0,NULL,
765+
"ModSecurity: Loaded %d rule from: '%s'.",
766+
remote_rules_server->amount_of_rules,
767+
remote_rules_server->uri);
768+
}
769+
else
770+
{
771+
ap_log_error(APLOG_MARK,APLOG_NOTICE,0,NULL,
772+
"ModSecurity: Loaded %d rule from: '%s'.",
773+
remote_rules_server->amount_of_rules,
774+
remote_rules_server->uri);
775+
}
776+
}
755777
}
756778

757779
srand((unsignedint)(time(NULL)*getpid()));

‎apache2/modsecurity.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -536,7 +536,7 @@ static apr_status_t modsecurity_process_phase_request_body(modsec_rec *msr) {
536536
apr_time_ttime_before;
537537
apr_status_trc=0;
538538

539-
539+
540540
if ((msr->allow_scope==ACTION_ALLOW_REQUEST)||(msr->allow_scope==ACTION_ALLOW)) {
541541
if (msr->txcfg->debuglog_level >=4) {
542542
msr_log(msr,4,"Skipping phase REQUEST_BODY (allow used).");
@@ -626,7 +626,7 @@ static apr_status_t modsecurity_process_phase_response_body(modsec_rec *msr) {
626626
*/
627627
staticapr_status_tmodsecurity_process_phase_logging(modsec_rec*msr) {
628628
apr_time_ttime_before,time_after;
629-
629+
630630
if (msr->txcfg->debuglog_level >=4) {
631631
msr_log(msr,4,"Starting phase LOGGING.");
632632
}

‎apache2/modsecurity.h‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ typedef struct msc_arg msc_arg;
3333
typedefstructmsc_stringmsc_string;
3434
typedefstructmsc_parmmsc_parm;
3535

36+
#include"msc_remote_rules.h"
3637
#include"msc_release.h"
3738
#include"msc_logging.h"
3839
#include"msc_multipart.h"
@@ -144,6 +145,8 @@ extern DSOLOCAL unsigned long int msc_pcre_match_limit;
144145

145146
externDSOLOCAL unsigned longintmsc_pcre_match_limit_recursion;
146147

148+
externDSOLOCALmsc_remote_rules_server*remote_rules_server;
149+
147150
externDSOLOCALintstatus_engine_state;
148151

149152
externDSOLOCALintconn_limits_filter_state;
@@ -619,6 +622,14 @@ struct directory_config {
619622

620623
/* xml */
621624
intxml_external_entity;
625+
626+
/* This will be used whenever ModSecurity will be ready
627+
* to ask the server for newer rules.
628+
*/
629+
#if0
630+
msc_remote_rules_server*remote_rules;
631+
intremote_timeout;
632+
#endif
622633
};
623634

624635
structerror_message_t {

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp