mirror of
https://github.com/owasp-modsecurity/ModSecurity.git
synced 2025-08-13 21:36:00 +03:00
Added mlogc source.
This commit is contained in:
brectanus
parent
2818e66a95
commit
20cc395510
4
CHANGES
4
CHANGES
@ -1,6 +1,8 @@
|
||||
31 Jul 2008 - trunk
|
||||
02 Sep 2008 - trunk
|
||||
-------------------
|
||||
|
||||
* Integrate mlogc source.
|
||||
|
||||
* Allow for disabling request body limit checks in phase:1.
|
||||
|
||||
* Added transformations for processing parity for legacy protocols ported
|
||||
|
||||
@ -3,16 +3,16 @@
|
||||
MOD_SECURITY2 = mod_security2 apache2_config apache2_io apache2_util \
|
||||
re re_operators re_actions re_tfns re_variables \
|
||||
msc_logging msc_xml msc_multipart modsecurity msc_parsers msc_util msc_pcre \
|
||||
persist_dbm msc_reqbody pdf_protect msc_geo acmp msc_lua
|
||||
persist_dbm msc_reqbody pdf_protect msc_geo acmp msc_lua msc_release
|
||||
|
||||
MSC_TEST = re re_operators re_actions re_tfns re_variables \
|
||||
msc_logging msc_xml msc_multipart modsecurity \
|
||||
msc_parsers msc_util msc_pcre persist_dbm \
|
||||
msc_reqbody msc_geo acmp msc_lua
|
||||
msc_reqbody msc_geo acmp msc_lua msc_release
|
||||
|
||||
MOD_SECURITY2_H = re.h modsecurity.h msc_logging.h msc_multipart.h msc_parsers.h \
|
||||
msc_pcre.h msc_util.h msc_xml.h persist_dbm.h apache2.h pdf_protect.h \
|
||||
msc_geo.h acmp.h utf8tables.h msc_lua.h
|
||||
msc_geo.h acmp.h utf8tables.h msc_lua.h msc_release.h
|
||||
|
||||
CC = @APXS_CC@
|
||||
LIBTOOL = @APXS_LIBTOOL@
|
||||
@ -70,7 +70,7 @@ clean-extras:
|
||||
$(MAKE) -C $$dir clean; \
|
||||
fi; \
|
||||
done
|
||||
@rm -rf ../tools/mlogc ../tools/mlogc-static
|
||||
@rm -rf ../tools/mlogc ../tools/mlogc-batch-load.pl
|
||||
|
||||
clean: clean-extras
|
||||
@rm -rf *.la *.lo *.o *.slo .libs msc_test msc-test-debug.log
|
||||
@ -99,19 +99,12 @@ mod_security2.la: $(MOD_SECURITY2_H) *.c
|
||||
mlogc:
|
||||
@$(MAKE) -C mlogc-src mlogc \
|
||||
&& cp -p mlogc-src/mlogc ../tools \
|
||||
&& cp -p mlogc-src/mlogc-batch-load.pl ../tools \
|
||||
&& echo \
|
||||
&& echo "Successfully built \"mlogc\" in ../tools." \
|
||||
&& echo "See: mlogc-src/INSTALL" \
|
||||
&& echo
|
||||
|
||||
mlogc-static:
|
||||
@$(MAKE) -C mlogc-src static \
|
||||
&& cp -p mlogc-src/mlogc ../tools/mlogc-static \
|
||||
&& echo \
|
||||
&& echo "Successfully built \"mlogc-static\" in ../tools." \
|
||||
&& echo "See: mlogc-src/INSTALL" \
|
||||
&& echo
|
||||
|
||||
### Experimental Test Framework (*NIX only right now)
|
||||
msc_test.lo: msc_test.c
|
||||
$(LIBTOOL) --mode=compile $(CC) $(APXS_INCLUDES) $(APXS_CFLAGS) $(EXTRA_CFLAGS) $(MODSEC_EXTRA_CFLAGS) $(CPPFLAGS) $(APR_CFLAGS) $(APU_CFLAGS) -o msc_test.lo -c msc_test.c
|
||||
|
||||
@ -45,7 +45,8 @@ OBJS = mod_security2.obj apache2_config.obj apache2_io.obj apache2_util.obj \
|
||||
re.obj re_operators.obj re_actions.obj re_tfns.obj re_variables.obj \
|
||||
msc_logging.obj msc_xml.obj msc_multipart.obj modsecurity.obj \
|
||||
msc_parsers.obj msc_util.obj msc_pcre.obj persist_dbm.obj \
|
||||
msc_reqbody.obj pdf_protect.obj msc_geo.obj acmp.obj msc_lua.obj
|
||||
msc_reqbody.obj pdf_protect.obj msc_geo.obj acmp.obj msc_lua.obj \
|
||||
msc_release.obj
|
||||
|
||||
all: $(DLL)
|
||||
|
||||
|
||||
4
apache2/configure
vendored
4
apache2/configure
vendored
@ -5831,6 +5831,8 @@ ac_config_files="$ac_config_files Makefile"
|
||||
ac_config_files="$ac_config_files build/apxs-wrapper"
|
||||
|
||||
if test -e "$PERL"; then
|
||||
ac_config_files="$ac_config_files mlogc-src/mlogc-batch-load.pl"
|
||||
|
||||
ac_config_files="$ac_config_files t/run-unit-tests.pl"
|
||||
|
||||
ac_config_files="$ac_config_files t/run-regression-tests.pl"
|
||||
@ -6407,6 +6409,7 @@ do
|
||||
"mod_security2_config.h") CONFIG_HEADERS="$CONFIG_HEADERS mod_security2_config.h" ;;
|
||||
"Makefile") CONFIG_FILES="$CONFIG_FILES Makefile" ;;
|
||||
"build/apxs-wrapper") CONFIG_FILES="$CONFIG_FILES build/apxs-wrapper" ;;
|
||||
"mlogc-src/mlogc-batch-load.pl") CONFIG_FILES="$CONFIG_FILES mlogc-src/mlogc-batch-load.pl" ;;
|
||||
"t/run-unit-tests.pl") CONFIG_FILES="$CONFIG_FILES t/run-unit-tests.pl" ;;
|
||||
"t/run-regression-tests.pl") CONFIG_FILES="$CONFIG_FILES t/run-regression-tests.pl" ;;
|
||||
"t/gen_rx-pm.pl") CONFIG_FILES="$CONFIG_FILES t/gen_rx-pm.pl" ;;
|
||||
@ -7022,6 +7025,7 @@ echo "$as_me: $ac_file is unchanged" >&6;}
|
||||
|
||||
case $ac_file$ac_mode in
|
||||
"build/apxs-wrapper":F) chmod +x build/apxs-wrapper ;;
|
||||
"mlogc-src/mlogc-batch-load.pl":F) chmod +x mlogc-src/mlogc-batch-load.pl ;;
|
||||
"t/run-unit-tests.pl":F) chmod +x t/run-unit-tests.pl ;;
|
||||
"t/run-regression-tests.pl":F) chmod +x t/run-regression-tests.pl ;;
|
||||
"t/gen_rx-pm.pl":F) chmod +x t/gen_rx-pm.pl ;;
|
||||
|
||||
@ -327,6 +327,7 @@ CHECK_CURL()
|
||||
AC_CONFIG_FILES([Makefile])
|
||||
AC_CONFIG_FILES([build/apxs-wrapper], [chmod +x build/apxs-wrapper])
|
||||
if test -e "$PERL"; then
|
||||
AC_CONFIG_FILES([mlogc-src/mlogc-batch-load.pl], [chmod +x mlogc-src/mlogc-batch-load.pl])
|
||||
AC_CONFIG_FILES([t/run-unit-tests.pl], [chmod +x t/run-unit-tests.pl])
|
||||
AC_CONFIG_FILES([t/run-regression-tests.pl], [chmod +x t/run-regression-tests.pl])
|
||||
AC_CONFIG_FILES([t/gen_rx-pm.pl], [chmod +x t/gen_rx-pm.pl])
|
||||
|
||||
76
apache2/mlogc-src/INSTALL
Normal file
76
apache2/mlogc-src/INSTALL
Normal file
@ -0,0 +1,76 @@
|
||||
ModSecurity Audit Log Collector (mlogc)
|
||||
|
||||
Mlogc is used to connect a ModSecurity sensor to the central
|
||||
audit log repository.
|
||||
|
||||
To Install:
|
||||
===========
|
||||
|
||||
1) Copy the mlogc executable to an appropriate location.
|
||||
|
||||
A good location might be /usr/local/bin, /opt/mlogc/bin, etc.
|
||||
|
||||
2) Create sensor in the central audit log repository. Note the
|
||||
username and the password (SENSOR_USERNAME, SENSOR_PASSWORD).
|
||||
Also note the IP address central repository listens on
|
||||
(CONSOLE_IP_ADDRESS).
|
||||
|
||||
3) Configure the ModSecurity sensor to use mlogc
|
||||
|
||||
# Use ReleventOnly auditing
|
||||
SecAuditEngine RelevantOnly
|
||||
|
||||
# Must use concurrent logging
|
||||
SecAuditLogType Concurrent
|
||||
|
||||
# Send all audit log parts
|
||||
SecAuditLogParts ABIDEFGHZ
|
||||
|
||||
# Use the same /CollectorRoot/LogStorageDir as in mlogc.conf
|
||||
SecAuditLogStorageDir /var/log/mlogc/data
|
||||
|
||||
# Pipe audit log to mlogc with your configuration
|
||||
SecAuditLog "|/usr/local/bin/mlogc /etc/mlogc.conf"
|
||||
|
||||
4) Using the mlogc-default.conf as a template, configure the logger.
|
||||
|
||||
Typically these are the only directives that will need to be modified
|
||||
to conform to your site:
|
||||
|
||||
# Points to the root of the installation. All relative
|
||||
# paths configured in this file will be resolved with the
|
||||
# help of this path (LogStorageDir, TransactionLog, etc.)
|
||||
#
|
||||
# Typically, this will be the parent directory that is configured
|
||||
# in ModSecurity for the SecAuditLogStorageDirectory. So, if
|
||||
# your SecAuditLogStorageDirectory is set to /var/log/mlogc/data,
|
||||
# then set this to /var/log/mlogc.
|
||||
CollectorRoot "/var/log/mlogc"
|
||||
|
||||
# ModSecurity Console receiving URI. You can change the host
|
||||
# and the port parts but leave everything else as is.
|
||||
ConsoleURI https://CONSOLE_IP_ADDRESS:8886/rpc/auditLogReceiver
|
||||
|
||||
# Sensor credentials
|
||||
SensorUsername "SENSOR_USERNAME"
|
||||
SensorPassword "SENSOR_PASSWORD"
|
||||
|
||||
# Base directory where the audit logs are stored. This can be specified
|
||||
# as a path relative to the CollectorRoot, or a full path. It should
|
||||
# resolve to the same path as ModSecurity's SecAuditLogStorageDirectory.
|
||||
LogStorageDir "data"
|
||||
|
||||
See the mlogc-default.conf configuration file for details on other
|
||||
configuration directives.
|
||||
|
||||
5) Restart the ModSecurity sensor.
|
||||
|
||||
From now on every audit log generated will go to the repository. Make
|
||||
sure you create an alert. Transactions without alerts will be recorded
|
||||
but not displayed on the home page.
|
||||
|
||||
To troubleshoot, generate alerts and observe file "mlogc-error.log".
|
||||
|
||||
If mlogc fails to connect to the server it will pause for a period
|
||||
of time (60 seconds by default) before it will try again.
|
||||
|
||||
70
apache2/mlogc-src/Makefile.in
Executable file
70
apache2/mlogc-src/Makefile.in
Executable file
@ -0,0 +1,70 @@
|
||||
# Generated Makefile for ModSecurity Log Collector (mlogc)
|
||||
|
||||
CC = @CC@
|
||||
EXTRA_CFLAGS = @EXTRA_CFLAGS@
|
||||
|
||||
srcdir = .
|
||||
modsecsrcdir = $(srcdir)/..
|
||||
srclibdir = $(srcdir)/srclib
|
||||
|
||||
MLOGC_VERSION = `grep '^\#define *VERSION ' mlogc.c | sed 's/.*VERSION *"\([^"]*\)"/\1/'`
|
||||
|
||||
APR_FLAGS = @APR_CFLAGS@
|
||||
APR_LIBS = @APR_LINK_LD@
|
||||
|
||||
CURL_FLAGS = @CURL_CFLAGS@
|
||||
CURL_LIBS = @CURL_LIBS@
|
||||
|
||||
PCRE_FLAGS = @PCRE_CFLAGS@
|
||||
PCRE_LIBS = @PCRE_LIBS@
|
||||
|
||||
APR_S_FLAGS = `$(srclibdir)/install/apr/bin/apr-1-config --includes --cppflags --cflags`
|
||||
APR_S_LIBS = `$(srclibdir)/install/apr/bin/apr-1-config --link-ld`
|
||||
|
||||
CURL_S_FLAGS = `$(srclibdir)/install/curl/bin/curl-config --cflags`
|
||||
CURL_S_LIBS = `$(srclibdir)/install/curl/bin/curl-config --libs`
|
||||
|
||||
PCRE_S_FLAGS = `$(srclibdir)/install/pcre/bin/pcre-config --cflags`
|
||||
PCRE_S_LIBS = `$(srclibdir)/install/pcre/bin/pcre-config --libs`
|
||||
|
||||
all: mlogc
|
||||
|
||||
mlogc: mlogc.c
|
||||
@echo; \
|
||||
echo "Building dynamically linked mlogc..."; \
|
||||
$(CC) $(CFLAGS) -o mlogc mlogc.c \
|
||||
-I$(modsecsrcdir) \
|
||||
$(APR_FLAGS) $(CURL_FLAGS) $(PCRE_FLAGS) \
|
||||
$(APR_LIBS) $(CURL_LIBS) $(PCRE_LIBS); \
|
||||
chmod 755 mlogc; \
|
||||
echo; \
|
||||
echo "Build finished. Please follow the INSTALL instructions to complete the install."; \
|
||||
echo
|
||||
|
||||
.archives-ok:
|
||||
@if [ -n "$(MLOGC_NOVERIFY)" -a "$(MLOGC_NOVERIFY)" = "1" ]; then \
|
||||
touch .archives-ok; \
|
||||
else \
|
||||
$(srclibdir)/archives.sh && touch .archives-ok; \
|
||||
fi
|
||||
|
||||
.support-libs-ok:
|
||||
$(srclibdir)/build.sh && touch .support-libs-ok
|
||||
|
||||
archives: .archives-ok
|
||||
|
||||
support-libs: .support-libs-ok
|
||||
|
||||
clean-build:
|
||||
@rm -rf $(srclibdir)/build
|
||||
|
||||
clean-install:
|
||||
@rm -rf $(srclibdir)/install
|
||||
|
||||
clean-mlogc:
|
||||
@rm -rf core mlogc *~ *.o *.so *.lo *.la *.slo
|
||||
|
||||
distclean: clean
|
||||
|
||||
clean: clean-build clean-install clean-mlogc
|
||||
|
||||
151
apache2/mlogc-src/mlogc-batch-load.pl.in
Executable file
151
apache2/mlogc-src/mlogc-batch-load.pl.in
Executable file
@ -0,0 +1,151 @@
|
||||
#!@PERL@
|
||||
#
|
||||
# ModSecurity for Apache 2.x, http://www.modsecurity.org/
|
||||
# Copyright (c) 2004-2008 Breach Security, Inc. (http://www.breach.com/)
|
||||
#
|
||||
# This product is released under the terms of the General Public Licence,
|
||||
# version 2 (GPLv2). Please refer to the file LICENSE (included with this
|
||||
# distribution) which contains the complete text of the licence.
|
||||
#
|
||||
# There are special exceptions to the terms and conditions of the GPL
|
||||
# as it is applied to this software. View the full text of the exception in
|
||||
# file MODSECURITY_LICENSING_EXCEPTION in the directory of this software
|
||||
# distribution.
|
||||
#
|
||||
# If any of the files related to licensing are missing or if you have any
|
||||
# other questions related to licensing please contact Breach Security, Inc.
|
||||
# directly using the email address support@breach.com.
|
||||
#
|
||||
|
||||
use strict;
|
||||
use File::Find qw(find);
|
||||
use File::Spec::Functions qw(catfile);
|
||||
use Sys::Hostname qw(hostname);
|
||||
use Digest::MD5 qw(md5_hex);
|
||||
|
||||
my $ROOTDIR = $ARGV[0] || '';
|
||||
my $MLOGC = $ARGV[1] || '';
|
||||
my $MLOGCCONF = $ARGV[2] || '';
|
||||
my @AUDIT = ();
|
||||
|
||||
if ($ROOTDIR eq '' or ! -e $MLOGC or ! -e $MLOGCCONF) {
|
||||
printf STDERR "\nUsage: $0 <rootdir> </path/to/mlogc> <mlogc_config>\n\n";
|
||||
exit 1;
|
||||
}
|
||||
|
||||
open(MLOGC, "|$MLOGC -f $MLOGCCONF") or die "ERROR: could not open '$MLOGC' - $!\n";
|
||||
|
||||
find(
|
||||
{
|
||||
wanted => sub {
|
||||
my($fn,$dev,$ino,$mode,$nlink,$uid,$gid,$rdev,$size);
|
||||
|
||||
(($dev,$ino,$mode,$nlink,$uid,$gid,$rdev,$size) = stat($_)) &&
|
||||
-f _ &&
|
||||
/^\d{8}-\d+-\w{24}$/s
|
||||
&& (($fn = $File::Find::name) =~ s/^\Q$ROOTDIR\E//)
|
||||
&& push(@AUDIT, [$fn, $size]);
|
||||
},
|
||||
follow => 1,
|
||||
},
|
||||
$ROOTDIR
|
||||
);
|
||||
|
||||
for my $audit (@AUDIT) {
|
||||
my $fn = $audit->[0];
|
||||
my $line = "";
|
||||
my $err = 0;
|
||||
my $ln = 0;
|
||||
my $sln = 0;
|
||||
my $sect = "";
|
||||
my $data = "";
|
||||
my %data = (
|
||||
hostname => hostname(),
|
||||
remote_addr => "-",
|
||||
remote_user => "-",
|
||||
local_user => "-",
|
||||
logtime => "-",
|
||||
request => "-",
|
||||
response_status => "-",
|
||||
bytes_sent => "-",
|
||||
referer => "-",
|
||||
user_agent => "-",
|
||||
uniqueid => "-",
|
||||
sessionid => "-",
|
||||
audit_file => $fn,
|
||||
extra => "0",
|
||||
audit_size => $audit->[1],
|
||||
md5 => "-",
|
||||
);
|
||||
|
||||
### Parse the audit file in an attempt to recreate the original log line
|
||||
open (AUDIT, "<".catfile($ROOTDIR,$fn)) or $err = 1;
|
||||
if ($err == 1) {
|
||||
print STDERR "ERROR: could not open '$fn' - $!\n";
|
||||
next;
|
||||
}
|
||||
|
||||
while($line = <AUDIT>) {
|
||||
$data .= $line;
|
||||
chop $line;
|
||||
$ln++;
|
||||
$sln++;
|
||||
if ($line =~ m%^--[0-9A-Fa-f]{8}-([A-Z])--$%) {
|
||||
$sect = $1;
|
||||
$sln = 0;
|
||||
next;
|
||||
};
|
||||
if ($sect eq 'A') {
|
||||
if ($line =~ m%^(\[[-\d/: a-zA-Z]{27}\]) (\S+) (\S+) (\d+) (\S+) (\d+)%) {
|
||||
$data{logtime} = $1;
|
||||
$data{uniqueid} = $2;
|
||||
$data{remote_addr} = $3;
|
||||
}
|
||||
next;
|
||||
}
|
||||
elsif ($sect eq 'B') {
|
||||
if ($sln == 1) {
|
||||
$data{request} = $line;
|
||||
}
|
||||
elsif ($line =~ m%^User=Agent: (.*)%i) {
|
||||
$data{user_agent} = $1;
|
||||
}
|
||||
elsif ($line =~ m%^Referer: (.*)%i) {
|
||||
$data{referer} = $1;
|
||||
}
|
||||
next;
|
||||
}
|
||||
elsif ($sect eq 'F') {
|
||||
if ($sln == 1 and $line =~ m%^\S+ (\d{3})\D?.*%) {
|
||||
$data{response_status} = $1;
|
||||
}
|
||||
elsif ($line =~ m%^Content-Length: (\d+)%i) {
|
||||
$data{bytes_sent} = $1;
|
||||
}
|
||||
next;
|
||||
}
|
||||
}
|
||||
$data{md5} = md5_hex($data);
|
||||
|
||||
printf MLOGC (
|
||||
"%s %s %s %s %s \"%s\" %s %s \"%s\" \"%s\" %s \"%s\" %s %s %s md5:%s\n",
|
||||
$data{hostname},
|
||||
$data{remote_addr},
|
||||
$data{remote_user},
|
||||
$data{local_user},
|
||||
$data{logtime},
|
||||
$data{request},
|
||||
$data{response_status},
|
||||
$data{bytes_sent},
|
||||
$data{referer},
|
||||
$data{user_agent},
|
||||
$data{uniqueid},
|
||||
$data{sessionid},
|
||||
$data{audit_file},
|
||||
$data{extra},
|
||||
$data{audit_size},
|
||||
$data{md5},
|
||||
);
|
||||
|
||||
}
|
||||
|
||||
91
apache2/mlogc-src/mlogc-default.conf
Normal file
91
apache2/mlogc-src/mlogc-default.conf
Normal file
@ -0,0 +1,91 @@
|
||||
##########################################################################
|
||||
# Required configuration
|
||||
# At a minimum, the items in this section will need to be adjusted to
|
||||
# fit your environment. The remaining options are optional.
|
||||
##########################################################################
|
||||
|
||||
# Points to the root of the installation. All relative
|
||||
# paths will be resolved with the help of this path.
|
||||
CollectorRoot "/var/log/mlogc"
|
||||
|
||||
# ModSecurity Console receiving URI. You can change the host
|
||||
# and the port parts but leave everything else as is.
|
||||
ConsoleURI "https://CONSOLE_IP_ADDRESS:8888/rpc/auditLogReceiver"
|
||||
|
||||
# Sensor credentials
|
||||
SensorUsername "SENSOR_USERNAME"
|
||||
SensorPassword "SENSOR_PASSWORD"
|
||||
|
||||
# Base directory where the audit logs are stored. This can be specified
|
||||
# as a path relative to the CollectorRoot, or a full path.
|
||||
LogStorageDir "data"
|
||||
|
||||
# Transaction log will contain the information on all log collector
|
||||
# activities that happen between checkpoints. The transaction log
|
||||
# is used to recover data in case of a crash (or if Apache kills
|
||||
# the process).
|
||||
TransactionLog "mlogc-transaction.log"
|
||||
|
||||
# The file where the pending audit log entry data is kept. This file
|
||||
# is updated on every checkpoint.
|
||||
QueuePath "mlogc-queue.log"
|
||||
|
||||
# The location of the error log.
|
||||
ErrorLog "mlogc-error.log"
|
||||
|
||||
# The location of the lock file.
|
||||
LockFile "mlogc.lck"
|
||||
|
||||
# Keep audit log entries after sending? (0=false 1=true)
|
||||
# NOTE: This is required to be set in SecAuditLog mlogc config if you
|
||||
# are going to use a secondary console via SecAuditLog2.
|
||||
KeepEntries 0
|
||||
|
||||
|
||||
##########################################################################
|
||||
# Optional configuration
|
||||
##########################################################################
|
||||
|
||||
# The error log level controls how much detail there
|
||||
# will be in the error log. The levels are as follows:
|
||||
# 0 - NONE
|
||||
# 1 - ERROR
|
||||
# 2 - WARNING
|
||||
# 3 - NOTICE
|
||||
# 4 - DEBUG
|
||||
# 5 - DEBUG2
|
||||
#
|
||||
ErrorLogLevel 3
|
||||
|
||||
# How many concurrent connections to the server
|
||||
# are we allowed to open at the same time? Log collector uses
|
||||
# multiple connections in order to speed up audit log transfer.
|
||||
# This is especially needed when the communication takes place
|
||||
# over a slow link (e.g. not over a LAN).
|
||||
MaxConnections 10
|
||||
|
||||
# The time each connection will sit idle before being reused,
|
||||
# in milliseconds. Increase if you don't want ModSecurity Console
|
||||
# to be hit with too many log collector requests.
|
||||
TransactionDelay 50
|
||||
|
||||
# The time to wait before initialization on startup in milliseconds.
|
||||
# Increase if mlogc is starting faster then termination when the
|
||||
# sensor is reloaded.
|
||||
StartupDelay 1000
|
||||
|
||||
# How often is the pending audit log entry data going to be written
|
||||
# to a file. The default is 15 seconds.
|
||||
CheckpointInterval 15
|
||||
|
||||
# If the server fails all threads will back down until the
|
||||
# problem is sorted. The management thread will periodically
|
||||
# launch a thread to test the server. The default is to test
|
||||
# once in 60 seconds.
|
||||
ServerErrorTimeout 60
|
||||
|
||||
# The following two parameters are not used yet, but
|
||||
# reserved for future expansion.
|
||||
# KeepAlive 150
|
||||
# KeepAliveTimeout 300
|
||||
|
||||
1865
apache2/mlogc-src/mlogc.c
Normal file
1865
apache2/mlogc-src/mlogc.c
Normal file
File diff suppressed because it is too large
Load Diff
@ -25,6 +25,7 @@
|
||||
#include "apache2.h"
|
||||
#include "http_main.h"
|
||||
#include "pdf_protect.h"
|
||||
|
||||
#include "msc_logging.h"
|
||||
#include "msc_util.h"
|
||||
|
||||
@ -520,7 +521,7 @@ static int hook_post_config(apr_pool_t *mp, apr_pool_t *mp_log, apr_pool_t *mp_t
|
||||
/* Log our presence to the error log. */
|
||||
if (first_time) {
|
||||
ap_log_error(APLOG_MARK, APLOG_NOTICE | APLOG_NOERRNO, 0, s,
|
||||
"%s configured.", MODULE_NAME_FULL);
|
||||
"%s configured.", MODSEC_MODULE_NAME_FULL);
|
||||
|
||||
/* If we've changed the server signature make note of the original. */
|
||||
if (new_server_signature != NULL) {
|
||||
|
||||
@ -25,15 +25,6 @@
|
||||
#include "msc_util.h"
|
||||
#include "msc_xml.h"
|
||||
|
||||
modsec_build_type_rec DSOLOCAL modsec_build_type[] = {
|
||||
{ "-dev", 1 }, /* Development build */
|
||||
{ "-rc", 3 }, /* Release Candidate build */
|
||||
{ "", 9 }, /* Production build */
|
||||
{ "-breach", 9 }, /* Breach build */
|
||||
{ "-trunk", 9 }, /* Trunk build */
|
||||
{ NULL, -1 } /* terminator */
|
||||
};
|
||||
|
||||
/**
|
||||
* Log an alert message to the log, adding the rule metadata at the end.
|
||||
*/
|
||||
|
||||
@ -32,23 +32,7 @@ typedef struct msc_data_chunk msc_data_chunk;
|
||||
typedef struct msc_arg msc_arg;
|
||||
typedef struct msc_string msc_string;
|
||||
|
||||
#if !(defined(WIN32) || defined(CYGWIN) || defined(NETWARE) || defined(SOLARIS2))
|
||||
#define DSOLOCAL __attribute__((visibility("hidden")))
|
||||
#else
|
||||
#define DSOLOCAL
|
||||
#endif
|
||||
|
||||
#if defined(DEBUG_MEM)
|
||||
/* Nothing Yet */
|
||||
#endif
|
||||
|
||||
/* For GNU C, tell the compiler to check printf like formatters */
|
||||
#if (defined(__GNUC__) && !defined(SOLARIS2))
|
||||
#define PRINTF_ATTRIBUTE(a,b) __attribute__((format (printf, a, b)))
|
||||
#else
|
||||
#define PRINTF_ATTRIBUTE(a,b)
|
||||
#endif
|
||||
|
||||
#include "msc_release.h"
|
||||
#include "msc_logging.h"
|
||||
#include "msc_multipart.h"
|
||||
#include "msc_pcre.h"
|
||||
@ -66,27 +50,6 @@ typedef struct msc_string msc_string;
|
||||
#include "http_log.h"
|
||||
#include "http_protocol.h"
|
||||
|
||||
typedef struct modsec_build_type_rec {
|
||||
const char * name;
|
||||
int val;
|
||||
} modsec_build_type_rec;
|
||||
extern DSOLOCAL modsec_build_type_rec modsec_build_type[];
|
||||
|
||||
#define MODSEC_VERSION_MAJOR "2"
|
||||
#define MODSEC_VERSION_MINOR "6"
|
||||
#define MODSEC_VERSION_MAINT "0"
|
||||
#define MODSEC_VERSION_TYPE "-trunk"
|
||||
#define MODSEC_VERSION_RELEASE ""
|
||||
|
||||
#define MODULE_NAME "ModSecurity for Apache"
|
||||
|
||||
#define MODSEC_VERSION_SUFFIX MODSEC_VERSION_TYPE MODSEC_VERSION_RELEASE
|
||||
#define MODULE_RELEASE \
|
||||
MODSEC_VERSION_MAJOR "." MODSEC_VERSION_MINOR "." MODSEC_VERSION_MAINT \
|
||||
MODSEC_VERSION_SUFFIX
|
||||
|
||||
#define MODULE_NAME_FULL MODULE_NAME "/" MODULE_RELEASE " (http://www.modsecurity.org/)"
|
||||
|
||||
#define PHASE_REQUEST_HEADERS 1
|
||||
#define PHASE_REQUEST_BODY 2
|
||||
#define PHASE_RESPONSE_HEADERS 3
|
||||
|
||||
@ -343,14 +343,14 @@ static void sec_auditlog_write_producer_header(modsec_rec *msr) {
|
||||
|
||||
/* Try to write everything in one go. */
|
||||
if (msr->txcfg->component_signatures->nelts == 0) {
|
||||
text = apr_psprintf(msr->mp, "Producer: %s.\n", MODULE_NAME_FULL);
|
||||
text = apr_psprintf(msr->mp, "Producer: %s.\n", MODSEC_MODULE_NAME_FULL);
|
||||
sec_auditlog_write(msr, text, strlen(text));
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
/* Start with the ModSecurity signature. */
|
||||
text = apr_psprintf(msr->mp, "Producer: %s", MODULE_NAME_FULL);
|
||||
text = apr_psprintf(msr->mp, "Producer: %s", MODSEC_MODULE_NAME_FULL);
|
||||
sec_auditlog_write(msr, text, strlen(text));
|
||||
|
||||
|
||||
|
||||
42
apache2/msc_release.c
Normal file
42
apache2/msc_release.c
Normal file
@ -0,0 +1,42 @@
|
||||
/*
|
||||
* ModSecurity for Apache 2.x, http://www.modsecurity.org/
|
||||
* Copyright (c) 2004-2008 Breach Security, Inc. (http://www.breach.com/)
|
||||
*
|
||||
* This product is released under the terms of the General Public Licence,
|
||||
* version 2 (GPLv2). Please refer to the file LICENSE (included with this
|
||||
* distribution) which contains the complete text of the licence.
|
||||
*
|
||||
* There are special exceptions to the terms and conditions of the GPL
|
||||
* as it is applied to this software. View the full text of the exception in
|
||||
* file MODSECURITY_LICENSING_EXCEPTION in the directory of this software
|
||||
* distribution.
|
||||
*
|
||||
* If any of the files related to licensing are missing or if you have any
|
||||
* other questions related to licensing please contact Breach Security, Inc.
|
||||
* directly using the email address support@breach.com.
|
||||
*
|
||||
*/
|
||||
|
||||
#include "msc_release.h"
|
||||
|
||||
modsec_build_type_rec modsec_build_type[] = {
|
||||
{ "-dev", 1 }, /* Development build */
|
||||
{ "-rc", 3 }, /* Release Candidate build */
|
||||
{ "", 9 }, /* Production build */
|
||||
{ "-breach", 9 }, /* Breach build */
|
||||
{ "-trunk", 9 }, /* Trunk build */
|
||||
{ NULL, -1 } /* terminator */
|
||||
};
|
||||
|
||||
int get_modsec_build_type(const char *name)
|
||||
{
|
||||
int i;
|
||||
|
||||
for (i = 0; modsec_build_type[i].name != NULL; i++) {
|
||||
if (strcmp(((name == NULL) ? MODSEC_VERSION_TYPE : name), modsec_build_type[i].name) == 0) {
|
||||
return modsec_build_type[i].val;
|
||||
}
|
||||
}
|
||||
|
||||
return 9; /* so no warning */
|
||||
}
|
||||
67
apache2/msc_release.h
Normal file
67
apache2/msc_release.h
Normal file
@ -0,0 +1,67 @@
|
||||
/*
|
||||
* ModSecurity for Apache 2.x, http://www.modsecurity.org/
|
||||
* Copyright (c) 2004-2008 Breach Security, Inc. (http://www.breach.com/)
|
||||
*
|
||||
* This product is released under the terms of the General Public Licence,
|
||||
* version 2 (GPLv2). Please refer to the file LICENSE (included with this
|
||||
* distribution) which contains the complete text of the licence.
|
||||
*
|
||||
* There are special exceptions to the terms and conditions of the GPL
|
||||
* as it is applied to this software. View the full text of the exception in
|
||||
* file MODSECURITY_LICENSING_EXCEPTION in the directory of this software
|
||||
* distribution.
|
||||
*
|
||||
* If any of the files related to licensing are missing or if you have any
|
||||
* other questions related to licensing please contact Breach Security, Inc.
|
||||
* directly using the email address support@breach.com.
|
||||
*
|
||||
*/
|
||||
#ifndef _MSC_RELEASE_H_
|
||||
#define _MSC_RELEASE_H_
|
||||
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
#if !(defined(WIN32) || defined(CYGWIN) || defined(NETWARE) || defined(SOLARIS2))
|
||||
#define DSOLOCAL __attribute__((visibility("hidden")))
|
||||
#else
|
||||
#define DSOLOCAL
|
||||
#endif
|
||||
|
||||
#if defined(DEBUG_MEM)
|
||||
/* Nothing Yet */
|
||||
#endif
|
||||
|
||||
/* For GNU C, tell the compiler to check printf like formatters */
|
||||
#if (defined(__GNUC__) && !defined(SOLARIS2))
|
||||
#define PRINTF_ATTRIBUTE(a,b) __attribute__((format (printf, a, b)))
|
||||
#else
|
||||
#define PRINTF_ATTRIBUTE(a,b)
|
||||
#endif
|
||||
|
||||
typedef struct modsec_build_type_rec {
|
||||
const char * name;
|
||||
int val;
|
||||
} modsec_build_type_rec;
|
||||
extern DSOLOCAL modsec_build_type_rec modsec_build_type[];
|
||||
|
||||
#define MODSEC_VERSION_MAJOR "2"
|
||||
#define MODSEC_VERSION_MINOR "6"
|
||||
#define MODSEC_VERSION_MAINT "0"
|
||||
#define MODSEC_VERSION_TYPE "-trunk"
|
||||
#define MODSEC_VERSION_RELEASE ""
|
||||
|
||||
#define MODSEC_VERSION_SUFFIX MODSEC_VERSION_TYPE MODSEC_VERSION_RELEASE
|
||||
|
||||
#define MODSEC_VERSION \
|
||||
MODSEC_VERSION_MAJOR "." MODSEC_VERSION_MINOR "." MODSEC_VERSION_MAINT \
|
||||
MODSEC_VERSION_SUFFIX
|
||||
|
||||
/* Apache Module Defines */
|
||||
#define MODSEC_MODULE_NAME "ModSecurity for Apache"
|
||||
#define MODSEC_MODULE_VERSION MODSEC_VERSION
|
||||
#define MODSEC_MODULE_NAME_FULL MODSEC_MODULE_NAME "/" MODSEC_MODULE_VERSION " (http://www.modsecurity.org/)"
|
||||
|
||||
int DSOLOCAL get_modsec_build_type(const char *name);
|
||||
|
||||
#endif /* _MSC_RELEASE_H_ */
|
||||
@ -533,7 +533,7 @@ static void init_msr() {
|
||||
* Usage text.
|
||||
*/
|
||||
static void usage() {
|
||||
fprintf(stderr, "ModSecurity Unit Tester v%s\n", MODULE_RELEASE);
|
||||
fprintf(stderr, "ModSecurity Unit Tester v%s\n", MODSEC_VERSION);
|
||||
fprintf(stderr, " Usage: msc_test [options]\n");
|
||||
fprintf(stderr, "\n");
|
||||
fprintf(stderr, " Options:\n");
|
||||
|
||||
@ -16,6 +16,7 @@
|
||||
* directly using the email address support@breach.com.
|
||||
*
|
||||
*/
|
||||
#include "msc_release.h"
|
||||
#include "msc_util.h"
|
||||
|
||||
#include <ctype.h>
|
||||
@ -1169,21 +1170,11 @@ int normalise_path_inplace(unsigned char *input, int input_len, int win, int *ch
|
||||
}
|
||||
|
||||
char *modsec_build(apr_pool_t *mp) {
|
||||
int build_type = 0;
|
||||
int i;
|
||||
|
||||
for (i = 0; modsec_build_type[i].name != NULL; i++) {
|
||||
if (strcmp(MODSEC_VERSION_TYPE, modsec_build_type[i].name) == 0) {
|
||||
build_type = modsec_build_type[i].val;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
return apr_psprintf(mp, "%02i%02i%02i%1i%02i",
|
||||
atoi(MODSEC_VERSION_MAJOR),
|
||||
atoi(MODSEC_VERSION_MINOR),
|
||||
atoi(MODSEC_VERSION_MAINT),
|
||||
build_type,
|
||||
get_modsec_build_type(NULL),
|
||||
atoi(MODSEC_VERSION_RELEASE));
|
||||
}
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user