Commita2eb4c8

authored and

Felipe Zimmerle

committed

Don't update the scoreboard ourself (fixesowasp-modsecurity#1337)

This is unsafe, and messes up the scoreboard on Apache >= 2.4.25 with Event MPM

1 parent53edb25 commita2eb4c8Copy full SHA for a2eb4c8

File tree

+13

-1

lines changed

+13

-1

lines changed

Lines changed: 13 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -1452,7 +1452,19 @@ static int hook_connection_early(conn_rec *conn)`
`1452`	`1452`	`if (ws_record==NULL)`
`1453`	`1453`	`returnDECLINED;`
`1454`	`1454`
`1455`		`-apr_cpystrn(ws_record->client,client_ip,sizeof(ws_record->client));`
	`1455`	`+/* If ws_record does not have correct ip yet, we count it already */`
	`1456`	`+if (strcmp(client_ip,ws_record->client)!=0) {`
	`1457`	`+switch (ws_record->status) {`
	`1458`	`+caseSERVER_BUSY_READ:`
	`1459`	`+ip_count_r++;`
	`1460`	`+break;`
	`1461`	`+caseSERVER_BUSY_WRITE:`
	`1462`	`+ip_count_w++;`
	`1463`	`+break;`
	`1464`	`+default:`
	`1465`	`+break;`
	`1466`	`+ }`
	`1467`	`+ }`
`1456`	`1468`
`1457`	`1469`	`ap_log_cerror(APLOG_MARK,APLOG_TRACE3,0,conn,`
`1458`	`1470`	`"ModSecurity: going to loop through %d servers with %d threads",`

Comments

(0)