Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit9fe72b7

Browse files
author
Felipe Zimmerle
committed
Improves the CA validation
On IIS CA validation was not working as libcurl on windows does not look for acertificate store, unless it is specified. The resource downloads are nowrespecting the SecRemoteRulesFailAction.
1 parentb02256c commit9fe72b7

File tree

9 files changed

+3969
-12
lines changed

9 files changed

+3969
-12
lines changed

‎apache2/apache2_config.c‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2217,7 +2217,6 @@ static const char *cmd_remote_rules_fail(cmd_parms *cmd, void *_dcfg, const char
22172217
{
22182218
directory_config*dcfg= (directory_config*)_dcfg;
22192219
if (dcfg==NULL)returnNULL;
2220-
#ifdefWITH_REMOTE_RULES_SUPPORT
22212220
if (strncasecmp(p1,"warn",4)==0)
22222221
{
22232222
remote_rules_fail_action=REMOTE_RULES_WARN_ON_FAIL;
@@ -2231,10 +2230,6 @@ static const char *cmd_remote_rules_fail(cmd_parms *cmd, void *_dcfg, const char
22312230
returnapr_psprintf(cmd->pool,"ModSecurity: Invalid value for " \
22322231
"SecRemoteRulesFailAction, expected: Abort or Warn.");
22332232
}
2234-
#else
2235-
returnapr_psprintf(cmd->pool,"ModSecurity: " \
2236-
"SecRemoteRules: ModSecurity was not compiled with such functionality.");
2237-
#endif
22382233

22392234
returnNULL;
22402235
}

‎apache2/mod_security2.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,8 +70,8 @@ unsigned long int DSOLOCAL msc_pcre_match_limit_recursion = 0;
7070

7171
#ifdefWITH_REMOTE_RULES_SUPPORT
7272
msc_remote_rules_serverDSOLOCAL*remote_rules_server=NULL;
73-
intDSOLOCALremote_rules_fail_action=REMOTE_RULES_ABORT_ON_FAIL;
7473
#endif
74+
intDSOLOCALremote_rules_fail_action=REMOTE_RULES_ABORT_ON_FAIL;
7575

7676
intDSOLOCALstatus_engine_state=STATUS_ENGINE_DISABLED;
7777

‎apache2/modsecurity.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -148,8 +148,8 @@ extern DSOLOCAL unsigned long int msc_pcre_match_limit_recursion;
148148

149149
#ifdefWITH_REMOTE_RULES_SUPPORT
150150
externDSOLOCALmsc_remote_rules_server*remote_rules_server;
151-
externDSOLOCALintremote_rules_fail_action;
152151
#endif
152+
externDSOLOCALintremote_rules_fail_action;
153153

154154
externDSOLOCALintstatus_engine_state;
155155

‎apache2/msc_remote_rules.c‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -274,6 +274,11 @@ int msc_remote_grab_content(apr_pool_t *mp, const char *uri, const char *key,
274274
if (curl)
275275
{
276276
structcurl_slist*headers_chunk=NULL;
277+
#ifdefWIN32
278+
char*buf=malloc(sizeof(TCHAR)* (2048+1));
279+
char*ptr=NULL;
280+
DWORDres_len;
281+
#endif
277282
curl_easy_setopt(curl,CURLOPT_URL,remote_rules_server->uri);
278283

279284
headers_chunk=curl_slist_append(headers_chunk,apr_id);
@@ -286,6 +291,14 @@ int msc_remote_grab_content(apr_pool_t *mp, const char *uri, const char *key,
286291
/* Make it TLS 1.x only. */
287292
curl_easy_setopt(curl,CURLOPT_SSLVERSION,CURL_SSLVERSION_TLSv1);
288293

294+
#ifdefWIN32
295+
res_len=SearchPathA(NULL,"curl-ca-bundle.crt",NULL, (2048+1),buf,&ptr);
296+
if (res_len>0) {
297+
curl_easy_setopt(curl,CURLOPT_CAINFO,strdup(buf));
298+
}
299+
free(buf);
300+
#endif
301+
289302
/* those are the default options, but lets make sure */
290303
curl_easy_setopt(curl,CURLOPT_SSL_VERIFYPEER,1);
291304
curl_easy_setopt(curl,CURLOPT_SSL_VERIFYHOST,1);

‎apache2/msc_util.c‎

Lines changed: 28 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2673,6 +2673,11 @@ int ip_tree_from_uri(TreeRoot **rtree, char *uri,
26732673

26742674
if (curl) {
26752675
structcurl_slist*headers_chunk=NULL;
2676+
#ifdefWIN32
2677+
char*buf=malloc(sizeof(TCHAR)* (2048+1));
2678+
char*ptr=NULL;
2679+
DWORDres_len;
2680+
#endif
26762681
curl_easy_setopt(curl,CURLOPT_URL,uri);
26772682

26782683
headers_chunk=curl_slist_append(headers_chunk,apr_id);
@@ -2687,7 +2692,15 @@ int ip_tree_from_uri(TreeRoot **rtree, char *uri,
26872692
/* Make it TLS 1.x only. */
26882693
curl_easy_setopt(curl,CURLOPT_SSLVERSION,CURL_SSLVERSION_TLSv1);
26892694

2690-
/* those are the default options, but lets make sure */
2695+
#ifdefWIN32
2696+
res_len=SearchPathA(NULL,"curl-ca-bundle.crt",NULL, (2048+1),buf,&ptr);
2697+
if (res_len>0) {
2698+
curl_easy_setopt(curl,CURLOPT_CAINFO,strdup(buf));
2699+
}
2700+
free(buf);
2701+
#endif
2702+
2703+
/* thoseeare the default options, but lets make sure */
26912704
curl_easy_setopt(curl,CURLOPT_SSL_VERIFYPEER,1);
26922705
curl_easy_setopt(curl,CURLOPT_SSL_VERIFYHOST,1);
26932706

@@ -2700,8 +2713,20 @@ int ip_tree_from_uri(TreeRoot **rtree, char *uri,
27002713

27012714
if (res!=CURLE_OK)
27022715
{
2703-
*error_msg=apr_psprintf(mp,"Failed to fetch \"%s\" error: %s ",uri,curl_easy_strerror(res));
2704-
return-1;
2716+
if (remote_rules_fail_action==REMOTE_RULES_WARN_ON_FAIL)
2717+
{
2718+
ap_log_error(APLOG_MARK,APLOG_NOTICE,0,NULL,
2719+
"Failed to fetch \"%s\" error: %s ",
2720+
uri,curl_easy_strerror(res));
2721+
return0;
2722+
}
2723+
else
2724+
{
2725+
*error_msg=apr_psprintf(mp,"Failed to fetch \"%s\" " \
2726+
"error: %s ",uri,
2727+
curl_easy_strerror(res));
2728+
return-1;
2729+
}
27052730
}
27062731

27072732
curl_easy_cleanup(curl);

‎apache2/re_operators.c‎

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
* directly using the email address security@modsecurity.org.
1313
*/
1414

15+
#include"modsecurity.h"
1516
#include"re.h"
1617
#include"msc_pcre.h"
1718
#include"msc_geo.h"
@@ -1307,6 +1308,11 @@ static int msre_op_pmFromFile_param_init(msre_rule *rule, char **error_msg) {
13071308

13081309
if (curl) {
13091310
structcurl_slist*headers_chunk=NULL;
1311+
#ifdefWIN32
1312+
char*buf=malloc(sizeof(TCHAR)* (2048+1));
1313+
char*ptr=NULL;
1314+
DWORDres_len;
1315+
#endif
13101316
curl_easy_setopt(curl,CURLOPT_URL,fn);
13111317

13121318
headers_chunk=curl_slist_append(headers_chunk,apr_id);
@@ -1321,6 +1327,14 @@ static int msre_op_pmFromFile_param_init(msre_rule *rule, char **error_msg) {
13211327
/* Make it TLS 1.x only. */
13221328
curl_easy_setopt(curl,CURLOPT_SSLVERSION,CURL_SSLVERSION_TLSv1);
13231329

1330+
#ifdefWIN32
1331+
res_len=SearchPathA(NULL,"curl-ca-bundle.crt",NULL, (2048+1),buf,&ptr);
1332+
if (res_len>0) {
1333+
curl_easy_setopt(curl,CURLOPT_CAINFO,strdup(buf));
1334+
}
1335+
free(buf);
1336+
#endif
1337+
13241338
/* those are the default options, but lets make sure */
13251339
curl_easy_setopt(curl,CURLOPT_SSL_VERIFYPEER,1);
13261340
curl_easy_setopt(curl,CURLOPT_SSL_VERIFYHOST,1);
@@ -1333,7 +1347,22 @@ static int msre_op_pmFromFile_param_init(msre_rule *rule, char **error_msg) {
13331347
res=curl_easy_perform(curl);
13341348

13351349
if (res!=CURLE_OK)
1336-
fprintf(stderr,"curl_easy_perform() failed: %s\n",curl_easy_strerror(res));
1350+
{
1351+
if (remote_rules_fail_action==REMOTE_RULES_WARN_ON_FAIL)
1352+
{
1353+
ap_log_error(APLOG_MARK,APLOG_NOTICE,0,NULL,
1354+
"Failed to fetch \"%s\" error: %s ",fn,
1355+
curl_easy_strerror(res));
1356+
return1;
1357+
}
1358+
else
1359+
{
1360+
*error_msg=apr_psprintf(rule->ruleset->mp,
1361+
"Failed to fetch \"%s\" error: %s ",fn,
1362+
curl_easy_strerror(res));
1363+
return0;
1364+
}
1365+
}
13371366

13381367
curl_easy_cleanup(curl);
13391368
curl_slist_free_all(headers_chunk);

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp