Merging 2.7.2 into master

2025-08-14 05:45:59 +03:00 · 2013-01-20 18:09:49 -04:00 · 2013-01-20 18:09:49 -04:00 · 49c505156b
commit 49c505156b
parent 0e2b07b00e
35 changed files with 9433 additions and 2607 deletions
--- a/apache2/Makefile.am
+++ b/apache2/Makefile.am
@ -66,6 +66,7 @@ mod_security2_la_LDFLAGS = -no-undefined -module -avoid-version \
                           @PCRE_LDFLAGS@ @LIBXML2_LDFLAGS@ @LUA_LDFLAGS@
 endif

+if LINUX
 install-exec-hook: $(pkglib_LTLIBRARIES)
 	@echo "Removing unused static libraries..."; \
 	for m in $(pkglib_LTLIBRARIES); do \
@ -73,3 +74,12 @@ install-exec-hook: $(pkglib_LTLIBRARIES)
 	  rm -f $(DESTDIR)$(pkglibdir)/$$base.*a; \
 	  install -D -m444 $(DESTDIR)$(pkglibdir)/$$base.so $(DESTDIR)$(APXS_MODULES); \
 	done
+else
+install-exec-hook: $(pkglib_LTLIBRARIES)
+	@echo "Removing unused static libraries..."; \
+	for m in $(pkglib_LTLIBRARIES); do \
+	  base=`echo $$m | sed 's/\..*//'`; \
+	  rm -f $(DESTDIR)$(pkglibdir)/$$base.*a; \
+	  cp -p $(DESTDIR)$(pkglibdir)/$$base.so $(DESTDIR)$(APXS_MODULES); \
+	done
+endif
--- a/apache2/Makefile.win
+++ b/apache2/Makefile.win
@ -52,16 +52,13 @@ all: $(DLL)

 dll: $(DLL)

-mod_security2_config.h: mod_security2_config.hw
-        @type mod_security2_config.hw > modsecurity_config.h
-
 .c.obj:
        $(CC) $(CFLAGS) -c $< -Fo$@

 .cpp.obj:
        $(CC) $(CFLAGS) -c $< -Fo$@

-$(DLL): mod_security2_config.h $(OBJS)
+$(DLL): $(OBJS)
        $(CC) $(CFLAGS) $(LDFLAGS) -LD $(OBJS) -Fe$(DLL) $(LIBS) /link
        IF EXIST $(DLL).manifest $(MT) -manifest $(DLL).manifest -outputresource:$(DLL);2

@ -69,4 +66,4 @@ install: $(DLL)
        copy /Y $(DLL) $(APACHE)\modules

 clean:
-        del $(OBJS) $(DLL) *.dll *.lib *.pdb *.idb *.ilk *.exp *.res *.rc *.bin mod_security2_config.h *.manifest
+        del $(OBJS) $(DLL) *.dll *.lib *.pdb *.idb *.ilk *.exp *.res *.rc *.bin *.manifest
--- a/apache2/apache2_util.c
+++ b/apache2/apache2_util.c
@ -265,7 +265,7 @@ static void internal_log_ex(request_rec *r, directory_config *dcfg, modsec_rec *

 #if AP_SERVER_MAJORVERSION_NUMBER > 1 && AP_SERVER_MINORVERSION_NUMBER > 2
        ap_log_error(APLOG_MARK, APLOG_ERR | APLOG_NOERRNO, 0, r->server,
-            "[client %s] ModSecurity: %s%s [uri \"%s\"]%s", r->connection->client_ip, str1,
+            "[client %s] ModSecurity: %s%s [uri \"%s\"]%s", r->useragent_ip ? r->useragent_ip : r->connection->client_ip, str1,
            hostname, log_escape(msr->mp, r->uri), unique_id);
 #else
        ap_log_error(APLOG_MARK, APLOG_ERR | APLOG_NOERRNO, 0, r->server,
--- a/apache2/mod_security2.c
+++ b/apache2/mod_security2.c
@ -64,6 +64,9 @@ unsigned long int DSOLOCAL conn_read_state_limit = 0;

 unsigned long int DSOLOCAL conn_write_state_limit = 0;

+#if defined(WIN32) || defined(VERSION_NGINX)
+int (*modsecDropAction)(request_rec *r) = NULL;
+#endif
 static int server_limit, thread_limit;

 typedef struct {
@ -250,11 +253,25 @@ int perform_interception(modsec_rec *msr) {
                }
            }
            #else
-            log_level = 1;
-            status = HTTP_INTERNAL_SERVER_ERROR;
-            message = apr_psprintf(msr->mp, "Access denied with code 500%s "
-                "(Error: Connection drop not implemented on this platform).",
-                phase_text);
+            {
+                if (modsecDropAction == NULL) {
+                    log_level = 1;
+                    status = HTTP_INTERNAL_SERVER_ERROR;
+                    message = apr_psprintf(msr->mp, "Access denied with code 500%s "
+                        "(Error: Connection drop not implemented on this platform.",
+                        phase_text);
+                } else if (modsecDropAction(msr->r) == 0) {
+                    status = HTTP_FORBIDDEN;
+                    message = apr_psprintf(msr->mp, "Access denied with connection close%s.",
+                        phase_text);
+                } else {
+                    log_level = 1;
+                    status = HTTP_INTERNAL_SERVER_ERROR;
+                    message = apr_psprintf(msr->mp, "Access denied with code 500%s "
+                        "(Error: Connection drop request failed.",
+                        phase_text);
+                }
+            }
            #endif
            break;

--- a/apache2/modsecurity.c
+++ b/apache2/modsecurity.c
@ -276,7 +276,8 @@ static apr_status_t modsecurity_tx_cleanup(void *data) {
 apr_status_t modsecurity_tx_init(modsec_rec *msr) {
    const char *s = NULL;
    const apr_array_header_t *arr;
-    char *_cookies = NULL;
+    char *semicolon = NULL;
+    char *comma = NULL;
    apr_table_entry_t *te;
    int i;

@ -402,12 +403,27 @@ apr_status_t modsecurity_tx_init(modsec_rec *msr) {
    for (i = 0; i < arr->nelts; i++) {
        if (strcasecmp(te[i].key, "Cookie") == 0) {
            if (msr->txcfg->cookie_format == COOKIES_V0) {
-                _cookies = apr_pstrdup(msr->mp, te[i].val);
-                while((*_cookies != 0)&&(*_cookies != ',')&&(*_cookies != ';')) _cookies++;
-                if(*_cookies == ',')
-                    parse_cookies_v0(msr, te[i].val, msr->request_cookies, ",");
-                else
+                semicolon = apr_pstrdup(msr->mp, te[i].val);
+                while((*semicolon != 0)&&(*semicolon != ';')) semicolon++;
+                if(*semicolon == ';')    {
                    parse_cookies_v0(msr, te[i].val, msr->request_cookies, ";");
+                } else  {
+                    comma = apr_pstrdup(msr->mp, te[i].val);
+                    while((*comma != 0)&&(*comma != ',')) comma++;
+                    if(*comma == ',')    {
+                        comma++;
+                        if(*comma == 0x20)   {// looks like comma is the separator
+                            if (msr->txcfg->debuglog_level >= 5) {
+                                msr_log(msr, 5, "Cookie v0 parser: Using comma as a separator. Semi-colon was not identified!");
+                            }
+                            parse_cookies_v0(msr, te[i].val, msr->request_cookies, ",");
+                        } else {
+                            parse_cookies_v0(msr, te[i].val, msr->request_cookies, ";");
+                        }
+                    } else  {
+                        parse_cookies_v0(msr, te[i].val, msr->request_cookies, ";");
+                    }
+                }
            } else {
                parse_cookies_v1(msr, te[i].val, msr->request_cookies);
            }
--- a/apache2/modsecurity_config.h
+++ b/apache2/modsecurity_config.h
@ -1 +1,28 @@
-/* This file is left empty for building on Windows. */
+/* Some APR files define PACKAGE* constants, which may conflict
+ * so this is here to prevent that by removing them.
+ */
+
+#ifndef	WIN32
+
+/* Undefine all these so there are no conflicts */
+#undef PACKAGE
+#undef PACKAGE_BUGREPORT
+#undef PACKAGE_NAME
+#undef PACKAGE_STRING
+#undef PACKAGE_TARNAME
+#undef PACKAGE_URL
+#undef PACKAGE_VERSION
+
+/* Include the real autoconf header */
+#include "modsecurity_config_auto.h"
+
+/* Undefine all these (again) so there are no conflicts */
+#undef PACKAGE
+#undef PACKAGE_BUGREPORT
+#undef PACKAGE_NAME
+#undef PACKAGE_STRING
+#undef PACKAGE_TARNAME
+#undef PACKAGE_URL
+#undef PACKAGE_VERSION
+
+#endif
--- a/apache2/msc_lua.c
+++ b/apache2/msc_lua.c
@ -79,7 +79,11 @@ static int lua_restore(lua_State *L, msc_script *script) {
    dumpr.script = script;
    dumpr.index = 0;

+#if LUA_VERSION_NUM > 501
+    return lua_load(L, dump_reader, &dumpr, script->name, NULL);
+#else
    return lua_load(L, dump_reader, &dumpr, script->name);
+#endif
 }

 /**
--- a/apache2/msc_release.h
+++ b/apache2/msc_release.h
@ -38,7 +38,7 @@

 #define MODSEC_VERSION_MAJOR       "2"
 #define MODSEC_VERSION_MINOR       "7"
-#define MODSEC_VERSION_MAINT       "1"
+#define MODSEC_VERSION_MAINT       "2"
 #define MODSEC_VERSION_TYPE        ""
 #define MODSEC_VERSION_RELEASE     ""

@ -50,7 +50,7 @@

 /* Apache Module Defines */
 #ifdef	VERSION_IIS
-#define MODSEC_MODULE_NAME "ModSecurity for IIS (Beta)"
+#define MODSEC_MODULE_NAME "ModSecurity for IIS (STABLE)"
 #else
 #ifdef	VERSION_NGINX
 #define MODSEC_MODULE_NAME "ModSecurity for nginx (Beta)"
--- a/apache2/msc_tree.c
+++ b/apache2/msc_tree.c
@ -14,10 +14,14 @@

 #include <stdio.h>
 #include <stdlib.h>
+#if APR_HAVE_STDINT_H
 #include <stdint.h>
+#endif
 #include <string.h>
-#if !defined(WIN32) || !defined(WINNT)
+#if APR_HAVE_NETINET_IN_H
 #include <netinet/in.h>
+#endif
+#if APR_HAVE_ARPA_INET_H
 #include <arpa/inet.h>
 #endif
 #include "apr_lib.h"
--- a/apache2/msc_util.c
+++ b/apache2/msc_util.c
@ -834,7 +834,9 @@ char *m_strcasestr(const char *haystack, const char *needle) {
 int inet_pton(int family, const char *src, void *dst)   {
    struct addrinfo addr;
    struct sockaddr_in *in = NULL;
+#if APR_HAVE_IPV6
    struct sockaddr_in6 *in6 = NULL;
+#endif
    struct addrinfo *addr_info = NULL;

    memset(&addr, 0, sizeof(struct addrinfo));
@ -849,11 +851,13 @@ int inet_pton(int family, const char *src, void *dst)   {
            if(in != NULL)
                memcpy(dst, &in->sin_addr, 4);
        }
+#if APR_HAVE_IPV6
        else if (addr_info->ai_family == AF_INET6) {
            in6 = (struct sockaddr_in6*)addr_info->ai_addr;
            if(in6 != NULL)
                memcpy(dst, &in6->sin6_addr, 16);
        }
+#endif
        else {
            freeaddrinfo(addr_info);
            return -1;
@ -1202,7 +1206,26 @@ char *log_escape(apr_pool_t *mp, const char *text) {
 }

 char *log_escape_nq(apr_pool_t *mp, const char *text) {
+#ifdef VERSION_IIS
+	int l = 0;
+
+	// this is a workaround for unknown bug that causes 'text' sometimes to lack zero-termination
+	//
+	__try
+	{
+		l = text ? strlen(text) : 0;
+	}
+	__except(EXCEPTION_EXECUTE_HANDLER)
+	{
+		l = -1;
+	}
+	if(l < 0)
+	    return _log_escape(mp, "BUG: see log_escape_nq()", 24, 0, 0, 0);
+
+	return _log_escape(mp, (const unsigned char *)text, l, 0, 0, 0);
+#else
    return _log_escape(mp, (const unsigned char *)text, text ? strlen(text) : 0, 0, 0, 0);
+#endif
 }

 char *log_escape_ex(apr_pool_t *mp, const char *text, unsigned long int text_length) {
--- a/apache2/re_operators.c
+++ b/apache2/re_operators.c
@ -23,7 +23,7 @@
 #include "msc_tree.h"
 #include "msc_crypt.h"

-#if !defined(WIN32) || !defined(WINNT)
+#if APR_HAVE_ARPA_INET_H
 #include <arpa/inet.h>
 #endif

@ -305,7 +305,9 @@ static int msre_op_ipmatchFromFile_param_init(msre_rule *rule, char **error_msg)
 static int msre_op_ipmatchFromFile_execute(modsec_rec *msr, msre_rule *rule, msre_var *var, char **error_msg) {
    TreeRoot *rtree = rule->op_param_data;
    struct in_addr in;
+#if APR_HAVE_IPV6
    struct in6_addr in6;
+#endif

    if (error_msg == NULL)
        return -1;
@ -336,6 +338,7 @@ static int msre_op_ipmatchFromFile_execute(modsec_rec *msr, msre_rule *rule, msr
            return 1;
        }
    }
+#if APR_HAVE_IPV6
    else {
        if (inet_pton(AF_INET6, var->value, &in6) <= 0) {
            if (msr->txcfg->debuglog_level >= 9) {
@ -350,6 +353,7 @@ static int msre_op_ipmatchFromFile_execute(modsec_rec *msr, msre_rule *rule, msr
            return 1;
        }
    }
+#endif

    return 0;
 }
@ -760,7 +764,8 @@ static int msre_op_validateHash_param_init(msre_rule *rule, char **error_msg) {
                    "Rule %pp [id \"%s\"][file \"%s\"][line \"%d\"] - "
                    "Execution error - "
                    "Does not support JIT (%d)",
-                    rule,((rule->actionset != NULL)&&(rule->actionset->id != NULL)) ? rule->actionset->id : "-",
+                    rule,((rule->actionset != NULL)&&((rule->actionset->id != NULL)&&
+                            (rule->actionset->id != NOT_SET_P))) ? rule->actionset->id : "-",
                    rule->filename != NULL ? rule->filename : "-",
                    rule->line_num,rc);
        }
@ -850,7 +855,8 @@ static int msre_op_validateHash_execute(modsec_rec *msr, msre_rule *rule, msre_v
                            "Rule %pp [id \"%s\"][file \"%s\"][line \"%d\"] - "
                            "Execution error - "
                            "Does not support JIT (%d)",
-                            rule,((rule->actionset != NULL)&&(rule->actionset->id != NULL)) ? rule->actionset->id : "-",
+                            rule,((rule->actionset != NULL)&&((rule->actionset->id != NULL)&&
+                                    (rule->actionset->id != NOT_SET_P))) ? rule->actionset->id : "-",
                            rule->filename != NULL ? rule->filename : "-",
                            rule->line_num,rc);
                    msr_log(msr, 4, "%s.", *error_msg);
@ -1001,7 +1007,8 @@ static int msre_op_rx_param_init(msre_rule *rule, char **error_msg) {
                    "Rule %pp [id \"%s\"][file \"%s\"][line \"%d\"] - "
                    "Execution error - "
                    "Does not support JIT (%d)",
-                    rule,((rule->actionset != NULL)&&(rule->actionset->id != NULL)) ? rule->actionset->id : "-",
+                    rule,((rule->actionset != NULL)&&((rule->actionset->id != NULL)&&
+                            (rule->actionset->id != NOT_SET_P))) ? rule->actionset->id : "-",
                    rule->filename != NULL ? rule->filename : "-",
                    rule->line_num,rc);
        }
@ -1081,7 +1088,8 @@ static int msre_op_rx_execute(modsec_rec *msr, msre_rule *rule, msre_var *var, c
                            "Rule %pp [id \"%s\"][file \"%s\"][line \"%d\"] - "
                            "Execution error - "
                            "Does not support JIT (%d)",
-                            rule,((rule->actionset != NULL)&&(rule->actionset->id != NULL)) ? rule->actionset->id : "-",
+                            rule,((rule->actionset != NULL)&&((rule->actionset->id != NULL)&&
+                                    (rule->actionset->id != NOT_SET_P))) ? rule->actionset->id : "-",
                            rule->filename != NULL ? rule->filename : "-",
                            rule->line_num,rc);
                    msr_log(msr, 4, "%s.", *error_msg);
@ -2708,7 +2716,8 @@ static int msre_op_verifyCC_execute(modsec_rec *msr, msre_rule *rule, msre_var *
                    "Rule %pp [id \"%s\"][file \"%s\"][line \"%d\"] - "
                    "Execution error - "
                    "Does not support JIT (%d)",
-                    rule,((rule->actionset != NULL)&&(rule->actionset->id != NULL)) ? rule->actionset->id : "-",
+                    rule,((rule->actionset != NULL)&&((rule->actionset->id != NULL)&&
+                            (rule->actionset->id != NOT_SET_P))) ? rule->actionset->id : "-",
                    rule->filename != NULL ? rule->filename : "-",
                    rule->line_num,rc);
            msr_log(msr, 4, "%s.", *error_msg);
@ -2874,7 +2883,7 @@ static int cpf_verify(const char *cpfnumber, int len) {
        "88888888888",
        "99999999999"};

-    while((*cpfnumber != '\0') && ( var_len >= 0))  {
+    while((*cpfnumber != '\0') && ( var_len > 0))  {

        if(*cpfnumber != '-' || *cpfnumber != '.') {
            if(i < cpf_len && isdigit(*cpfnumber))  {
@ -2888,7 +2897,7 @@ static int cpf_verify(const char *cpfnumber, int len) {
    }


-    if (strlen(s_cpf) != cpf_len || i != cpf_len-1)
+    if (i != cpf_len)
        return 0;
    else {
        for(i = 0; i< cpf_len; i++)   {
@ -3016,7 +3025,8 @@ static int msre_op_verifyCPF_execute(modsec_rec *msr, msre_rule *rule, msre_var
                    "Rule %pp [id \"%s\"][file \"%s\"][line \"%d\"] - "
                    "Execution error - "
                    "Does not support JIT (%d)",
-                    rule,((rule->actionset != NULL)&&(rule->actionset->id != NULL)) ? rule->actionset->id : "-",
+                    rule,((rule->actionset != NULL)&&((rule->actionset->id != NULL)&&
+                            (rule->actionset->id != NOT_SET_P))) ? rule->actionset->id : "-",
                    rule->filename != NULL ? rule->filename : "-",
                    rule->line_num,rc);
            msr_log(msr, 4, "%s.", *error_msg);
@ -3307,7 +3317,8 @@ static int msre_op_verifySSN_execute(modsec_rec *msr, msre_rule *rule, msre_var
                    "Rule %pp [id \"%s\"][file \"%s\"][line \"%d\"] - "
                    "Execution error - "
                    "Does not support JIT (%d)",
-                    rule,((rule->actionset != NULL)&&(rule->actionset->id != NULL)) ? rule->actionset->id : "-",
+                    rule,((rule->actionset != NULL)&&((rule->actionset->id != NULL)&&
+                            (rule->actionset->id != NOT_SET_P))) ? rule->actionset->id : "-",
                    rule->filename != NULL ? rule->filename : "-",
                    rule->line_num,rc);
            msr_log(msr, 4, "%s.", *error_msg);
--- a/build/find_pcre.m4
+++ b/build/find_pcre.m4
@ -66,7 +66,7 @@ if test -n "${pcre_path}"; then
    if test "$verbose_output" -eq 1; then AC_MSG_NOTICE(pcre CFLAGS: $PCRE_CFLAGS); fi
    PCRE_LDADD="`${PCRE_CONFIG} --libs`"
    if test "$verbose_output" -eq 1; then AC_MSG_NOTICE(pcre LDADD: $PCRE_LDADD); fi
-    PCRE_LD_PATH="/`${PCRE_CONFIG} --libs | cut -d"/" -f2,3,4,5,6 | cut -d " " -f1`"
+    PCRE_LD_PATH="/`${PCRE_CONFIG} --libs | cut -d'/' -f2,3,4,5,6 | cut -d ' ' -f1`"
    if test "$verbose_output" -eq 1; then AC_MSG_NOTICE(pcre PCRE_LD_PATH: $PCRE_LD_PATH); fi
 else
    AC_MSG_RESULT([no])
--- a/configure.ac
+++ b/configure.ac
@ -14,7 +14,8 @@ AC_CONFIG_HEADERS([apache2/modsecurity_config_auto.h])
 AC_CONFIG_AUX_DIR([build])
 AC_PREFIX_DEFAULT([/usr/local/modsecurity])

-AM_INIT_AUTOMAKE([-Wall -Werror foreign])
+AM_INIT_AUTOMAKE([-Wall foreign])
+m4_ifdef([AM_PROG_AR], [AM_PROG_AR])

 LT_PREREQ([2.2])
 LT_INIT([dlopen])
--- a/iis/Makefile.win
+++ b/iis/Makefile.win
@ -57,9 +57,6 @@ all: $(DLL)

 dll: $(DLL)

-..\apache2\mod_security2_config.h: ..\apache2\mod_security2_config.hw
-        @type ..\apache2\mod_security2_config.hw > ..\apache2\modsecurity_config.h
-
 $(OBJS1): ..\apache2\$*.c
        $(CC) $(CFLAGS) -c ..\apache2\$*.c -Fo$@

@ -69,7 +66,7 @@ $(OBJS2): ..\standalone\$*.c
 .cpp.obj:
        $(CC) $(CFLAGS) -c $< -Fo$@

-$(DLL): ..\apache2\mod_security2_config.h $(OBJS1) $(OBJS2) $(OBJS3)
+$(DLL): $(OBJS1) $(OBJS2) $(OBJS3)
        $(LINK) $(LDFLAGS) $(OBJS1) $(OBJS2) $(OBJS3) $(LIBS)
        IF EXIST $(DLL).manifest $(MT) -manifest $(DLL).manifest -outputresource:$(DLL);#1

--- a/iis/ModSecurityIIS/Installer/Installer.cpp
+++ b/iis/ModSecurityIIS/Installer/Installer.cpp
--- a/iis/ModSecurityIIS/Installer/Installer.vcxproj
+++ b/iis/ModSecurityIIS/Installer/Installer.vcxproj
@ -0,0 +1,96 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{990BB195-6716-4DE3-B5E4-DCFCB1BD7D9C}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>Installer</RootNamespace>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+    <UseOfMfc>Static</UseOfMfc>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <PrecompiledHeader>Use</PrecompiledHeader>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <AdditionalDependencies>ole32.lib;oleaut32.lib;advapi32.lib</AdditionalDependencies>
+      <UACExecutionLevel>RequireAdministrator</UACExecutionLevel>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <None Include="ReadMe.txt" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="stdafx.h" />
+    <ClInclude Include="targetver.h" />
+    <ClInclude Include="XUnzip.h" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="Installer.cpp" />
+    <ClCompile Include="stdafx.cpp">
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Create</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Create</PrecompiledHeader>
+    </ClCompile>
+    <ClCompile Include="XUnzip.cpp" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
--- a/iis/ModSecurityIIS/Installer/Installer.vcxproj.filters
+++ b/iis/ModSecurityIIS/Installer/Installer.vcxproj.filters
@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="ReadMe.txt" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="stdafx.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="targetver.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="XUnzip.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="stdafx.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="Installer.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="XUnzip.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>
--- a/iis/ModSecurityIIS/Installer/Installer.vcxproj.user
+++ b/iis/ModSecurityIIS/Installer/Installer.vcxproj.user
@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LocalDebuggerCommandArguments>"c:\Program Files (x86)\ModSecurity IIS" </LocalDebuggerCommandArguments>
+    <DebuggerFlavor>WindowsLocalDebugger</DebuggerFlavor>
+  </PropertyGroup>
+</Project>
--- a/iis/ModSecurityIIS/Installer/ReadMe.txt
+++ b/iis/ModSecurityIIS/Installer/ReadMe.txt
@ -0,0 +1,40 @@
+========================================================================
+    CONSOLE APPLICATION : Installer Project Overview
+========================================================================
+
+AppWizard has created this Installer application for you.
+
+This file contains a summary of what you will find in each of the files that
+make up your Installer application.
+
+
+Installer.vcxproj
+    This is the main project file for VC++ projects generated using an Application Wizard.
+    It contains information about the version of Visual C++ that generated the file, and
+    information about the platforms, configurations, and project features selected with the
+    Application Wizard.
+
+Installer.vcxproj.filters
+    This is the filters file for VC++ projects generated using an Application Wizard. 
+    It contains information about the association between the files in your project 
+    and the filters. This association is used in the IDE to show grouping of files with
+    similar extensions under a specific node (for e.g. ".cpp" files are associated with the
+    "Source Files" filter).
+
+Installer.cpp
+    This is the main application source file.
+
+/////////////////////////////////////////////////////////////////////////////
+Other standard files:
+
+StdAfx.h, StdAfx.cpp
+    These files are used to build a precompiled header (PCH) file
+    named Installer.pch and a precompiled types file named StdAfx.obj.
+
+/////////////////////////////////////////////////////////////////////////////
+Other notes:
+
+AppWizard uses "TODO:" comments to indicate parts of the source code you
+should add to or customize.
+
+/////////////////////////////////////////////////////////////////////////////
--- a/iis/ModSecurityIIS/Installer/XUnzip.cpp
+++ b/iis/ModSecurityIIS/Installer/XUnzip.cpp
--- a/iis/ModSecurityIIS/Installer/XUnzip.h
+++ b/iis/ModSecurityIIS/Installer/XUnzip.h
@ -0,0 +1,382 @@
+// XUnzip.h  Version 1.3
+//
+// Authors:      Mark Adler et al. (see below)
+//
+// Modified by:  Lucian Wischik
+//               lu@wischik.com
+//
+// Version 1.0   - Turned C files into just a single CPP file
+//               - Made them compile cleanly as C++ files
+//               - Gave them simpler APIs
+//               - Added the ability to zip/unzip directly in memory without 
+//                 any intermediate files
+// 
+// Modified by:  Hans Dietrich
+//               hdietrich@gmail.com
+//
+///////////////////////////////////////////////////////////////////////////////
+//
+// Lucian Wischik's comments:
+// --------------------------
+// THIS FILE is almost entirely based upon code by info-zip.
+// It has been modified by Lucian Wischik.
+// The original code may be found at http://www.info-zip.org
+// The original copyright text follows.
+//
+///////////////////////////////////////////////////////////////////////////////
+//
+// Original authors' comments:
+// ---------------------------
+// This is version 2002-Feb-16 of the Info-ZIP copyright and license. The 
+// definitive version of this document should be available at 
+// ftp://ftp.info-zip.org/pub/infozip/license.html indefinitely.
+// 
+// Copyright (c) 1990-2002 Info-ZIP.  All rights reserved.
+//
+// For the purposes of this copyright and license, "Info-ZIP" is defined as
+// the following set of individuals:
+//
+//   Mark Adler, John Bush, Karl Davis, Harald Denker, Jean-Michel Dubois,
+//   Jean-loup Gailly, Hunter Goatley, Ian Gorman, Chris Herborth, Dirk Haase,
+//   Greg Hartwig, Robert Heath, Jonathan Hudson, Paul Kienitz, 
+//   David Kirschbaum, Johnny Lee, Onno van der Linden, Igor Mandrichenko, 
+//   Steve P. Miller, Sergio Monesi, Keith Owens, George Petrov, Greg Roelofs, 
+//   Kai Uwe Rommel, Steve Salisbury, Dave Smith, Christian Spieler, 
+//   Antoine Verheijen, Paul von Behren, Rich Wales, Mike White
+//
+// This software is provided "as is", without warranty of any kind, express
+// or implied.  In no event shall Info-ZIP or its contributors be held liable
+// for any direct, indirect, incidental, special or consequential damages
+// arising out of the use of or inability to use this software.
+//
+// Permission is granted to anyone to use this software for any purpose,
+// including commercial applications, and to alter it and redistribute it
+// freely, subject to the following restrictions:
+//
+//    1. Redistributions of source code must retain the above copyright notice,
+//       definition, disclaimer, and this list of conditions.
+//
+//    2. Redistributions in binary form (compiled executables) must reproduce 
+//       the above copyright notice, definition, disclaimer, and this list of 
+//       conditions in documentation and/or other materials provided with the 
+//       distribution. The sole exception to this condition is redistribution 
+//       of a standard UnZipSFX binary as part of a self-extracting archive; 
+//       that is permitted without inclusion of this license, as long as the 
+//       normal UnZipSFX banner has not been removed from the binary or disabled.
+//
+//    3. Altered versions--including, but not limited to, ports to new 
+//       operating systems, existing ports with new graphical interfaces, and 
+//       dynamic, shared, or static library versions--must be plainly marked 
+//       as such and must not be misrepresented as being the original source.  
+//       Such altered versions also must not be misrepresented as being 
+//       Info-ZIP releases--including, but not limited to, labeling of the 
+//       altered versions with the names "Info-ZIP" (or any variation thereof, 
+//       including, but not limited to, different capitalizations), 
+//       "Pocket UnZip", "WiZ" or "MacZip" without the explicit permission of 
+//       Info-ZIP.  Such altered versions are further prohibited from 
+//       misrepresentative use of the Zip-Bugs or Info-ZIP e-mail addresses or 
+//       of the Info-ZIP URL(s).
+//
+//    4. Info-ZIP retains the right to use the names "Info-ZIP", "Zip", "UnZip",
+//       "UnZipSFX", "WiZ", "Pocket UnZip", "Pocket Zip", and "MacZip" for its 
+//       own source and binary releases.
+//
+///////////////////////////////////////////////////////////////////////////////
+
+#ifndef XUNZIP_H
+#define XUNZIP_H
+
+
+#ifndef XZIP_H
+DECLARE_HANDLE(HZIP);	// An HZIP identifies a zip file that has been opened
+#endif
+
+typedef DWORD ZRESULT;
+// return codes from any of the zip functions. Listed later.
+
+#define ZIP_HANDLE   1
+#define ZIP_FILENAME 2
+#define ZIP_MEMORY   3
+
+typedef struct
+{ int index;                 // index of this file within the zip
+  char name[MAX_PATH];       // filename within the zip
+  DWORD attr;                // attributes, as in GetFileAttributes.
+  FILETIME atime,ctime,mtime;// access, create, modify filetimes
+  long comp_size;            // sizes of item, compressed and uncompressed. These
+  long unc_size;             // may be -1 if not yet known (e.g. being streamed in)
+} ZIPENTRY;
+
+typedef struct
+{ int index;                 // index of this file within the zip
+  TCHAR name[MAX_PATH];      // filename within the zip
+  DWORD attr;                // attributes, as in GetFileAttributes.
+  FILETIME atime,ctime,mtime;// access, create, modify filetimes
+  long comp_size;            // sizes of item, compressed and uncompressed. These
+  long unc_size;             // may be -1 if not yet known (e.g. being streamed in)
+} ZIPENTRYW;
+
+
+///////////////////////////////////////////////////////////////////////////////
+//
+// OpenZip()
+//
+// Purpose:     Open an existing zip archive file
+//
+// Parameters:  z      - archive file name if flags is ZIP_FILENAME;  for other
+//                       uses see below
+//              len    - for memory (ZIP_MEMORY) should be the buffer size;
+//                       for other uses, should be 0
+//              flags  - indicates usage, see below;  for files, this will be
+//                       ZIP_FILENAME
+//
+// Returns:     HZIP   - non-zero if zip archive opened ok, otherwise 0
+//
+HZIP OpenZip(void *rd, void *z, unsigned int len, DWORD flags);
+// OpenZip - opens a zip file and returns a handle with which you can
+// subsequently examine its contents. You can open a zip file from:
+// from a pipe:             OpenZip(hpipe_read,0, ZIP_HANDLE);
+// from a file (by handle): OpenZip(hfile,0,      ZIP_HANDLE);
+// from a file (by name):   OpenZip("c:\\test.zip",0, ZIP_FILENAME);
+// from a memory block:     OpenZip(bufstart, buflen, ZIP_MEMORY);
+// If the file is opened through a pipe, then items may only be
+// accessed in increasing order, and an item may only be unzipped once,
+// although GetZipItem can be called immediately before and after unzipping
+// it. If it's opened i	n any other way, then full random access is possible.
+// Note: pipe input is not yet implemented.
+
+
+///////////////////////////////////////////////////////////////////////////////
+//
+// GetZipItem()
+//
+// Purpose:     Get information about an item in an open zip archive
+//
+// Parameters:  hz      - handle of open zip archive
+//              index   - index number (0 based) of item in zip 
+//              ze      - pointer to a ZIPENTRY (if ANSI) or ZIPENTRYW struct
+//                        (if Unicode)
+//
+// Returns:     ZRESULT - ZR_OK if success, otherwise some other value
+//
+
+#ifdef _UNICODE
+#define GetZipItem GetZipItemW
+#else
+#define GetZipItem GetZipItemA
+#endif
+
+ZRESULT GetZipItemA(HZIP hz, int index, ZIPENTRY *ze);
+ZRESULT GetZipItemW(HZIP hz, int index, ZIPENTRYW *ze);
+// GetZipItem - call this to get information about an item in the zip.
+// If index is -1 and the file wasn't opened through a pipe,
+// then it returns information about the whole zipfile
+// (and in particular ze.index returns the number of index items).
+// Note: the item might be a directory (ze.attr & FILE_ATTRIBUTE_DIRECTORY)
+// See below for notes on what happens when you unzip such an item.
+// Note: if you are opening the zip through a pipe, then random access
+// is not possible and GetZipItem(-1) fails and you can't discover the number
+// of items except by calling GetZipItem on each one of them in turn,
+// starting at 0, until eventually the call fails. Also, in the event that
+// you are opening through a pipe and the zip was itself created into a pipe,
+// then then comp_size and sometimes unc_size as well may not be known until
+// after the item has been unzipped.
+
+
+///////////////////////////////////////////////////////////////////////////////
+//
+// FindZipItem()
+//
+// Purpose:     Find item by name and return information about it
+//
+// Parameters:  hz      - handle of open zip archive
+//              name    - name of file to look for inside zip archive
+//              ic      - TRUE = case insensitive
+//              index   - pointer to index number returned, or -1
+//              ze      - pointer to a ZIPENTRY (if ANSI) or ZIPENTRYW struct
+//                        (if Unicode)
+//
+// Returns:     ZRESULT - ZR_OK if success, otherwise some other value
+//
+
+#ifdef _UNICODE
+#define FindZipItem FindZipItemW
+#else
+#define FindZipItem FindZipItemA
+#endif
+
+ZRESULT FindZipItemA(HZIP hz, const TCHAR *name, bool ic, int *index, ZIPENTRY *ze);
+ZRESULT FindZipItemW(HZIP hz, const TCHAR *name, bool ic, int *index, ZIPENTRYW *ze);
+// FindZipItem - finds an item by name. ic means 'insensitive to case'.
+// It returns the index of the item, and returns information about it.
+// If nothing was found, then index is set to -1 and the function returns
+// an error code.
+
+
+///////////////////////////////////////////////////////////////////////////////
+//
+// UnzipItem()
+//
+// Purpose:     Find item by index and unzip it
+//
+// Parameters:  hz      - handle of open zip archive
+//              index   - index number of file to unzip
+//              dst     - target file name of unzipped file
+//              len     - for memory (ZIP_MEMORY. length of buffer;
+//                        otherwise 0
+//              flags   - indicates usage, see below;  for files, this will be
+//                        ZIP_FILENAME
+//
+// Returns:     ZRESULT - ZR_OK if success, otherwise some other value
+//
+
+ZRESULT UnzipItem(HZIP hz, int index, void *dst, unsigned int len, DWORD flags);
+// UnzipItem - given an index to an item, unzips it. You can unzip to:
+// to a pipe:             UnzipItem(hz,i, hpipe_write,0,ZIP_HANDLE);
+// to a file (by handle): UnzipItem(hz,i, hfile,0,ZIP_HANDLE);
+// to a file (by name):   UnzipItem(hz,i, ze.name,0,ZIP_FILENAME);
+// to a memory block:     UnzipItem(hz,i, buf,buflen,ZIP_MEMORY);
+// In the final case, if the buffer isn't large enough to hold it all,
+// then the return code indicates that more is yet to come. If it was
+// large enough, and you want to know precisely how big, GetZipItem.
+// Note: zip files are normally stored with relative pathnames. If you
+// unzip with ZIP_FILENAME a relative pathname then the item gets created
+// relative to the current directory - it first ensures that all necessary
+// subdirectories have been created. Also, the item may itself be a directory.
+// If you unzip a directory with ZIP_FILENAME, then the directory gets created.
+// If you unzip it to a handle or a memory block, then nothing gets created
+// and it emits 0 bytes.
+
+
+///////////////////////////////////////////////////////////////////////////////
+//
+// CloseZip()
+//
+// Purpose:     Close an open zip archive
+//
+// Parameters:  hz      - handle to an open zip archive
+//
+// Returns:     ZRESULT - ZR_OK if success, otherwise some other value
+//
+ZRESULT CloseZip(HZIP hz);
+// CloseZip - the zip handle must be closed with this function.
+
+unsigned int FormatZipMessage(ZRESULT code, char *buf,unsigned int len);
+// FormatZipMessage - given an error code, formats it as a string.
+// It returns the length of the error message. If buf/len points
+// to a real buffer, then it also writes as much as possible into there.
+
+
+// These are the result codes:
+#define ZR_OK         0x00000000     // nb. the pseudo-code zr-recent is never returned,
+#define ZR_RECENT     0x00000001     // but can be passed to FormatZipMessage.
+// The following come from general system stuff (e.g. files not openable)
+#define ZR_GENMASK    0x0000FF00
+#define ZR_NODUPH     0x00000100     // couldn't duplicate the handle
+#define ZR_NOFILE     0x00000200     // couldn't create/open the file
+#define ZR_NOALLOC    0x00000300     // failed to allocate some resource
+#define ZR_WRITE      0x00000400     // a general error writing to the file
+#define ZR_NOTFOUND   0x00000500     // couldn't find that file in the zip
+#define ZR_MORE       0x00000600     // there's still more data to be unzipped
+#define ZR_CORRUPT    0x00000700     // the zipfile is corrupt or not a zipfile
+#define ZR_READ       0x00000800     // a general error reading the file
+// The following come from mistakes on the part of the caller
+#define ZR_CALLERMASK 0x00FF0000
+#define ZR_ARGS       0x00010000     // general mistake with the arguments
+#define ZR_NOTMMAP    0x00020000     // tried to ZipGetMemory, but that only works on mmap zipfiles, which yours wasn't
+#define ZR_MEMSIZE    0x00030000     // the memory size is too small
+#define ZR_FAILED     0x00040000     // the thing was already failed when you called this function
+#define ZR_ENDED      0x00050000     // the zip creation has already been closed
+#define ZR_MISSIZE    0x00060000     // the indicated input file size turned out mistaken
+#define ZR_PARTIALUNZ 0x00070000     // the file had already been partially unzipped
+#define ZR_ZMODE      0x00080000     // tried to mix creating/opening a zip 
+// The following come from bugs within the zip library itself
+#define ZR_BUGMASK    0xFF000000
+#define ZR_NOTINITED  0x01000000     // initialisation didn't work
+#define ZR_SEEK       0x02000000     // trying to seek in an unseekable file
+#define ZR_NOCHANGE   0x04000000     // changed its mind on storage, but not allowed
+#define ZR_FLATE      0x05000000     // an internal error in the de/inflation code
+
+
+
+
+
+// e.g.
+//
+// SetCurrentDirectory("c:\\docs\\stuff");
+// HZIP hz = OpenZip("c:\\stuff.zip",0,ZIP_FILENAME);
+// ZIPENTRY ze; GetZipItem(hz,-1,&ze); int numitems=ze.index;
+// for (int i=0; i<numitems; i++)
+// { GetZipItem(hz,i,&ze);
+//   UnzipItem(hz,i,ze.name,0,ZIP_FILENAME);
+// }
+// CloseZip(hz);
+//
+//
+// HRSRC hrsrc = FindResource(hInstance,MAKEINTRESOURCE(1),RT_RCDATA);
+// HANDLE hglob = LoadResource(hInstance,hrsrc);
+// void *zipbuf=LockResource(hglob);
+// unsigned int ziplen=SizeofResource(hInstance,hrsrc);
+// HZIP hz = OpenZip(zipbuf, ziplen, ZIP_MEMORY);
+//   - unzip to a membuffer -
+// ZIPENTRY ze; int i; FindZipItem(hz,"file.dat",&i,&ze);
+// char *ibuf = new char[ze.unc_size];
+// UnzipItem(hz,i, ibuf, ze.unc_size,ZIP_MEMORY);
+// delete[] buf;
+//   - unzip to a fixed membuff -
+// ZIPENTRY ze; int i; FindZipItem(hz,"file.dat",&i,&ze);
+// char ibuf[1024]; ZIPRESULT zr=ZR_MORE; unsigned long totsize=0;
+// while (zr==ZR_MORE)
+// { zr = UnzipItem(hz,i, ibuf,1024,ZIP_MEMORY);
+//   unsigned long bufsize=1024; if (zr==ZR_OK) bufsize=ze.unc_size-totsize;
+//   totsize+=bufsize;
+// }
+//   - unzip to a pipe -
+// HANDLE hthread=CreateWavReaderThread(&hread,&hwrite);
+// FindZipItem(hz,"sound.wav",&i,&ze);
+// UnzipItem(hz,i, hwrite,0,ZIP_HANDLE);
+// CloseHandle(hwrite);
+// WaitForSingleObject(hthread,INFINITE);
+// CloseHandle(hread); CloseHandle(hthread);
+//   - finished -
+// CloseZip(hz);
+// // note: no need to free resources obtained through Find/Load/LockResource
+//
+//
+// SetCurrentDirectory("c:\\docs\\pipedzipstuff");
+// HANDLE hread,hwrite; CreatePipe(&hread,&hwrite);
+// CreateZipWriterThread(hwrite);
+// HZIP hz = OpenZip(hread,0,ZIP_HANDLE);
+// for (int i=0; ; i++)
+// { ZIPENTRY ze; ZRESULT res = GetZipItem(hz,i,&ze);
+//   if (res!=ZE_OK) break; // no more
+//   UnzipItem(hz,i, ze.name,0,ZIP_FILENAME);
+// }
+// CloseZip(hz);
+//
+
+
+
+
+// Now we indulge in a little skullduggery so that the code works whether
+// the user has included just zip or both zip and unzip.
+// Idea: if header files for both zip and unzip are present, then presumably
+// the cpp files for zip and unzip are both present, so we will call
+// one or the other of them based on a dynamic choice. If the header file
+// for only one is present, then we will bind to that particular one.
+HZIP OpenZipU(void *rd, void *z,unsigned int len,DWORD flags);
+ZRESULT CloseZipU(HZIP hz);
+unsigned int FormatZipMessageU(ZRESULT code, char *buf,unsigned int len);
+bool IsZipHandleU(HZIP hz);
+#define OpenZip OpenZipU
+
+#ifdef XZIP_H
+#undef CloseZip
+#define CloseZip(hz) (IsZipHandleU(hz)?CloseZipU(hz):CloseZipZ(hz))
+#else
+#define CloseZip CloseZipU
+#define FormatZipMessage FormatZipMessageU
+#endif
+
+
+#endif //XUNZIP_H
--- a/iis/ModSecurityIIS/Installer/stdafx.cpp
+++ b/iis/ModSecurityIIS/Installer/stdafx.cpp
@ -0,0 +1,8 @@
+// stdafx.cpp : source file that includes just the standard includes
+// Installer.pch will be the pre-compiled header
+// stdafx.obj will contain the pre-compiled type information
+
+#include "stdafx.h"
+
+// TODO: reference any additional headers you need in STDAFX.H
+// and not in this file
--- a/iis/ModSecurityIIS/Installer/stdafx.h
+++ b/iis/ModSecurityIIS/Installer/stdafx.h
@ -0,0 +1,15 @@
+// stdafx.h : include file for standard system include files,
+// or project specific include files that are used frequently, but
+// are changed infrequently
+//
+
+#pragma once
+
+#include "targetver.h"
+
+#include <stdio.h>
+#include <tchar.h>
+
+
+
+// TODO: reference additional headers your program requires here
--- a/iis/ModSecurityIIS/Installer/targetver.h
+++ b/iis/ModSecurityIIS/Installer/targetver.h
@ -0,0 +1,8 @@
+#pragma once
+
+// Including SDKDDKVer.h defines the highest available Windows platform.
+
+// If you wish to build your application for a previous Windows platform, include WinSDKVer.h and
+// set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h.
+
+#include <SDKDDKVer.h>
--- a/iis/ModSecurityIIS/ModSecurityIIS.sln
+++ b/iis/ModSecurityIIS/ModSecurityIIS.sln
@ -3,35 +3,51 @@ Microsoft Visual Studio Solution File, Format Version 11.00
 # Visual Studio 2010
 Project("{54435603-DBB4-11D2-8724-00A0C9A8B90C}") = "ModSecurityIIS", "ModSecurityIIS\ModSecurityIIS.vdproj", "{3352AEF1-9F2A-47CD-9F63-658553063040}"
 	ProjectSection(ProjectDependencies) = postProject
-		{023E10BD-4FF6-4401-9A40-AED9717073F2} = {023E10BD-4FF6-4401-9A40-AED9717073F2}
+		{990BB195-6716-4DE3-B5E4-DCFCB1BD7D9C} = {990BB195-6716-4DE3-B5E4-DCFCB1BD7D9C}
 	EndProjectSection
 EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "configure", "ModSecurityIIS\installer project\configure.csproj", "{023E10BD-4FF6-4401-9A40-AED9717073F2}"
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Installer", "Installer\Installer.vcxproj", "{990BB195-6716-4DE3-B5E4-DCFCB1BD7D9C}"
 EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Mixed Platforms = Debug|Mixed Platforms
+		Debug|Win32 = Debug|Win32
 		Debug|x64 = Debug|x64
 		Debug|x86 = Debug|x86
+		Release|Mixed Platforms = Release|Mixed Platforms
+		Release|Win32 = Release|Win32
 		Release|x64 = Release|x64
 		Release|x86 = Release|x86
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{3352AEF1-9F2A-47CD-9F63-658553063040}.Debug|Mixed Platforms.ActiveCfg = Debug
+		{3352AEF1-9F2A-47CD-9F63-658553063040}.Debug|Mixed Platforms.Build.0 = Debug
+		{3352AEF1-9F2A-47CD-9F63-658553063040}.Debug|Win32.ActiveCfg = Debug
+		{3352AEF1-9F2A-47CD-9F63-658553063040}.Debug|Win32.Build.0 = Debug
 		{3352AEF1-9F2A-47CD-9F63-658553063040}.Debug|x64.ActiveCfg = Debug
 		{3352AEF1-9F2A-47CD-9F63-658553063040}.Debug|x64.Build.0 = Debug
 		{3352AEF1-9F2A-47CD-9F63-658553063040}.Debug|x86.ActiveCfg = Debug
 		{3352AEF1-9F2A-47CD-9F63-658553063040}.Debug|x86.Build.0 = Debug
+		{3352AEF1-9F2A-47CD-9F63-658553063040}.Release|Mixed Platforms.ActiveCfg = Release
+		{3352AEF1-9F2A-47CD-9F63-658553063040}.Release|Mixed Platforms.Build.0 = Release
+		{3352AEF1-9F2A-47CD-9F63-658553063040}.Release|Win32.ActiveCfg = Release
+		{3352AEF1-9F2A-47CD-9F63-658553063040}.Release|Win32.Build.0 = Release
 		{3352AEF1-9F2A-47CD-9F63-658553063040}.Release|x64.ActiveCfg = Release
 		{3352AEF1-9F2A-47CD-9F63-658553063040}.Release|x64.Build.0 = Release
 		{3352AEF1-9F2A-47CD-9F63-658553063040}.Release|x86.ActiveCfg = Release
 		{3352AEF1-9F2A-47CD-9F63-658553063040}.Release|x86.Build.0 = Release
-		{023E10BD-4FF6-4401-9A40-AED9717073F2}.Debug|x64.ActiveCfg = Debug|x64
-		{023E10BD-4FF6-4401-9A40-AED9717073F2}.Debug|x64.Build.0 = Debug|x64
-		{023E10BD-4FF6-4401-9A40-AED9717073F2}.Debug|x86.ActiveCfg = Debug|x86
-		{023E10BD-4FF6-4401-9A40-AED9717073F2}.Debug|x86.Build.0 = Debug|x86
-		{023E10BD-4FF6-4401-9A40-AED9717073F2}.Release|x64.ActiveCfg = Release|x86
-		{023E10BD-4FF6-4401-9A40-AED9717073F2}.Release|x64.Build.0 = Release|x86
-		{023E10BD-4FF6-4401-9A40-AED9717073F2}.Release|x86.ActiveCfg = Release|x86
-		{023E10BD-4FF6-4401-9A40-AED9717073F2}.Release|x86.Build.0 = Release|x86
+		{990BB195-6716-4DE3-B5E4-DCFCB1BD7D9C}.Debug|Mixed Platforms.ActiveCfg = Debug|Win32
+		{990BB195-6716-4DE3-B5E4-DCFCB1BD7D9C}.Debug|Mixed Platforms.Build.0 = Debug|Win32
+		{990BB195-6716-4DE3-B5E4-DCFCB1BD7D9C}.Debug|Win32.ActiveCfg = Debug|Win32
+		{990BB195-6716-4DE3-B5E4-DCFCB1BD7D9C}.Debug|Win32.Build.0 = Debug|Win32
+		{990BB195-6716-4DE3-B5E4-DCFCB1BD7D9C}.Debug|x64.ActiveCfg = Debug|Win32
+		{990BB195-6716-4DE3-B5E4-DCFCB1BD7D9C}.Debug|x86.ActiveCfg = Debug|Win32
+		{990BB195-6716-4DE3-B5E4-DCFCB1BD7D9C}.Release|Mixed Platforms.ActiveCfg = Release|Win32
+		{990BB195-6716-4DE3-B5E4-DCFCB1BD7D9C}.Release|Mixed Platforms.Build.0 = Release|Win32
+		{990BB195-6716-4DE3-B5E4-DCFCB1BD7D9C}.Release|Win32.ActiveCfg = Release|Win32
+		{990BB195-6716-4DE3-B5E4-DCFCB1BD7D9C}.Release|Win32.Build.0 = Release|Win32
+		{990BB195-6716-4DE3-B5E4-DCFCB1BD7D9C}.Release|x64.ActiveCfg = Release|Win32
+		{990BB195-6716-4DE3-B5E4-DCFCB1BD7D9C}.Release|x86.ActiveCfg = Release|Win32
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
--- a/iis/ModSecurityIIS/ModSecurityIIS/readme.rtf
+++ b/iis/ModSecurityIIS/ModSecurityIIS/readme.rtf
@ -58,10 +58,10 @@
 \leveltemplateid1225817962\'01\'95;}{\levelnumbers;}\f1\fbias0 \fi-360\li5760\jclisttab\tx5760\lin5760 }{\listlevel\levelnfc23\levelnfcn23\leveljc0\leveljcn0\levelfollow0\levelstartat1\lvltentative\levelspace0\levelindent0{\leveltext
 \leveltemplateid1897401684\'01\'95;}{\levelnumbers;}\f1\fbias0 \fi-360\li6480\jclisttab\tx6480\lin6480 }{\listname ;}\listid652101753}}{\*\listoverridetable{\listoverride\listid625282538\listoverridecount0\ls1}{\listoverride\listid652101753
 \listoverridecount0\ls2}}{\*\pgptbl {\pgp\ipgp10\itap0\li720\ri0\sb0\sa240}{\pgp\ipgp10\itap0\li720\ri0\sb0\sa240}{\pgp\ipgp10\itap0\li720\ri0\sb0\sa240}{\pgp\ipgp10\itap0\li720\ri0\sb0\sa240}{\pgp\ipgp6\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp8\itap0\li0\ri0\sb0
-\sa0}{\pgp\ipgp0\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp7\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp10\itap0\li720\ri0\sb0\sa240}{\pgp\ipgp0\itap0\li0\ri0\sb0\sa0}}{\*\rsidtbl \rsid1197496\rsid2315486\rsid3168183\rsid4593034\rsid6385683\rsid6967166\rsid9512544
-\rsid10098429\rsid12742482\rsid13639667\rsid16350125\rsid16593896}{\mmathPr\mmathFont34\mbrkBin0\mbrkBinSub0\msmallFrac0\mdispDef1\mlMargin0\mrMargin0\mdefJc1\mwrapIndent1440\mintLim0\mnaryLim1}{\info{\author Suha Can}{\operator Greg}
-{\creatim\yr2012\mo6\dy4\hr11\min43}{\revtim\yr2012\mo7\dy12\hr17\min47}{\version7}{\edmins6}{\nofpages1}{\nofwords134}{\nofchars767}{\*\company Microsoft Corporation}{\nofcharsws900}{\vern49273}}{\*\xmlnstbl {\xmlns1 http://schemas.microsoft.com/office/w
-ord/2003/wordml}}\paperw12240\paperh15840\margl1440\margr1440\margt1440\margb1440\gutter0\ltrsect 
+\sa0}{\pgp\ipgp0\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp7\itap0\li0\ri0\sb0\sa0}{\pgp\ipgp10\itap0\li720\ri0\sb0\sa240}{\pgp\ipgp0\itap0\li0\ri0\sb0\sa0}}{\*\rsidtbl \rsid1197496\rsid2315486\rsid3168183\rsid4593034\rsid6385683\rsid6633290\rsid6754893\rsid6967166
+\rsid9512544\rsid10098429\rsid12742482\rsid13639667\rsid16350125\rsid16593896}{\mmathPr\mmathFont34\mbrkBin0\mbrkBinSub0\msmallFrac0\mdispDef1\mlMargin0\mrMargin0\mdefJc1\mwrapIndent1440\mintLim0\mnaryLim1}{\info{\author Suha Can}{\operator Greg}
+{\creatim\yr2012\mo6\dy4\hr11\min43}{\revtim\yr2013\mo1\dy17\hr16\min15}{\version9}{\edmins12}{\nofpages1}{\nofwords173}{\nofchars992}{\*\company Microsoft Corporation}{\nofcharsws1163}{\vern49275}}{\*\xmlnstbl {\xmlns1 http://schemas.microsoft.com/office
+/word/2003/wordml}}\paperw12240\paperh15840\margl1440\margr1440\margt1440\margb1440\gutter0\ltrsect 
 \widowctrl\ftnbj\aenddoc\trackmoves0\trackformatting1\donotembedsysfont1\relyonvml0\donotembedlingdata0\grfdocevents0\validatexml1\showplaceholdtext0\ignoremixedcontent0\saveinvalidxml0\showxmlerrors1\noxlattoyen
 \expshrtn\noultrlspc\dntblnsbdb\nospaceforul\formshade\horzdoc\dgmargin\dghspace180\dgvspace180\dghorigin1440\dgvorigin1440\dghshow1\dgvshow1
 \jexpand\viewkind1\viewscale100\pgbrdrhead\pgbrdrfoot\splytwnine\ftnlytwnine\htmautsp\nolnhtadjtbl\useltbaln\alntblind\lytcalctblwd\lyttblrtgr\lnbrkrule\nobrkwrptbl\snaptogridincell\allowfieldendsel\wrppunct
@ -75,38 +75,44 @@ ord/2003/wordml}}\paperw12240\paperh15840\margl1440\margr1440\margt1440\margb144
 \par }\pard\plain \ltrpar\ql \li0\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0\pararsid16350125 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \f31506\fs22\lang1033\langfe1033\cgrid\langnp1033\langfenp1033 {
 \rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid6385683\charrsid16350125 ModSecurity home page }{\field\fldedit{\*\fldinst {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid2315486 HYPERLINK "http://www.modsecurity.org"}{\rtlch\fcs1 \af0\afs24 
 \ltrch\fcs0 \f0\fs24\insrsid2315486\charrsid16350125 {\*\datafield 
-00d0c9ea79f9bace118c8200aa004ba90b0200000003000000e0c9ea79f9bace118c8200aa004ba90b5000000068007400740070003a002f002f007700770077002e006d006f006400730065006300750072006900740079002e006f00720067002f000000795881f43b1d7f48af2c825dc485276300000000a5ab0000}}
-}{\fldrslt {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \cs16\f0\fs24\ul\cf2\insrsid6385683\charrsid16350125 http://www.modsecurity.org}}}\sectd \ltrsect\linex0\endnhere\sectlinegrid360\sectdefaultcl\sftnbj {\field\fldedit{\*\fldinst {\rtlch\fcs1 \af0\afs24 
+00d0c9ea79f9bace118c8200aa004ba90b0200000003000000e0c9ea79f9bace118c8200aa004ba90b5000000068007400740070003a002f002f007700770077002e006d006f006400730065006300750072006900740079002e006f00720067002f000000795881f43b1d7f48af2c825dc485276300000000a5ab00000000}
+}}{\fldrslt {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \cs16\f0\fs24\ul\cf2\insrsid6385683\charrsid16350125 http://www.modsecurity.org}}}\sectd \ltrsect\linex0\endnhere\sectlinegrid360\sectdefaultcl\sftnbj {\field\fldedit{\*\fldinst {\rtlch\fcs1 \af0\afs24 
 \ltrch\fcs0 \f0\fs24\insrsid6385683\charrsid16350125  HYPERLINK "http://engineering/" }{\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid2315486\charrsid16350125 {\*\datafield 
-00d0c9ea79f9bace118c8200aa004ba90b0200000003000000e0c9ea79f9bace118c8200aa004ba90b4000000068007400740070003a002f002f0065006e00670069006e0065006500720069006e0067002f000000795881f43b1d7f48af2c825dc485276300000000a5ab0000}}}{\fldrslt {\rtlch\fcs1 \af0\afs24 
-\ltrch\fcs0 \cs16\f0\fs24\ul\cf2\insrsid6385683\charrsid16350125 /}}}\sectd \ltrsect\linex0\endnhere\sectlinegrid360\sectdefaultcl\sftnbj {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid6385683\charrsid16350125 
+00d0c9ea79f9bace118c8200aa004ba90b0200000003000000e0c9ea79f9bace118c8200aa004ba90b4000000068007400740070003a002f002f0065006e00670069006e0065006500720069006e0067002f000000795881f43b1d7f48af2c825dc485276300000000a5ab00000000}}}{\fldrslt {\rtlch\fcs1 
+\af0\afs24 \ltrch\fcs0 \cs16\f0\fs24\ul\cf2\insrsid6385683\charrsid16350125 /}}}\sectd \ltrsect\linex0\endnhere\sectlinegrid360\sectdefaultcl\sftnbj {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid6385683\charrsid16350125 
 \par OWASP Core Rule Set for ModSecurity: }{\field\fldedit{\*\fldinst {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid6385683\charrsid16350125  HYPERLINK "https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project" }{\rtlch\fcs1 
 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid2315486\charrsid16350125 {\*\datafield 
 00d0c9ea79f9bace118c8200aa004ba90b0200000003000000e0c9ea79f9bace118c8200aa004ba90bba000000680074007400700073003a002f002f007700770077002e006f0077006100730070002e006f00720067002f0069006e006400650078002e007000680070002f00430061007400650067006f00720079003a00
-4f0057004100530050005f004d006f006400530065006300750072006900740079005f0043006f00720065005f00520075006c0065005f005300650074005f00500072006f006a006500630074000000795881f43b1d7f48af2c825dc485276300000000a5ab0000}}}{\fldrslt {\rtlch\fcs1 \af0\afs24 
+4f0057004100530050005f004d006f006400530065006300750072006900740079005f0043006f00720065005f00520075006c0065005f005300650074005f00500072006f006a006500630074000000795881f43b1d7f48af2c825dc485276300000000a5ab00000016}}}{\fldrslt {\rtlch\fcs1 \af0\afs24 
 \ltrch\fcs0 \cs16\f0\fs24\ul\cf2\insrsid6385683\charrsid16350125 https://}}}\sectd \ltrsect\linex0\endnhere\sectlinegrid360\sectdefaultcl\sftnbj {\field\fldedit{\*\fldinst {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid2315486 
 HYPERLINK "https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project"}{\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid2315486\charrsid16350125 {\*\datafield 
 00d0c9ea79f9bace118c8200aa004ba90b0200000003000000e0c9ea79f9bace118c8200aa004ba90bba000000680074007400700073003a002f002f007700770077002e006f0077006100730070002e006f00720067002f0069006e006400650078002e007000680070002f00430061007400650067006f00720079003a00
-4f0057004100530050005f004d006f006400530065006300750072006900740079005f0043006f00720065005f00520075006c0065005f005300650074005f00500072006f006a006500630074000000795881f43b1d7f48af2c825dc485276300000000a5ab0000}}}{\fldrslt {\rtlch\fcs1 \af0\afs24 
+4f0057004100530050005f004d006f006400530065006300750072006900740079005f0043006f00720065005f00520075006c0065005f005300650074005f00500072006f006a006500630074000000795881f43b1d7f48af2c825dc485276300000000a5ab00000000}}}{\fldrslt {\rtlch\fcs1 \af0\afs24 
 \ltrch\fcs0 \cs16\f0\fs24\ul\cf2\insrsid6385683\charrsid16350125 www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project}}}\sectd \ltrsect\linex0\endnhere\sectlinegrid360\sectdefaultcl\sftnbj {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 
 \f0\fs24\insrsid6385683\charrsid16350125  
+\par }{\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid6633290 The OWASP CRS was installed on your system drive, under }{\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \b\f0\fs24\insrsid6633290\charrsid6633290 inetpub\\wwwroot\\owasp_crs}{\rtlch\fcs1 \af0\afs24 
+\ltrch\fcs0 \f0\fs24\insrsid6633290 
+\par You can include it in your website by adding to your }{\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \b\f0\fs24\insrsid6633290\charrsid6633290 web.config}{\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid6633290  file, in }{\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 
+\b\f0\fs24\insrsid6633290\charrsid6633290 system.webServer}{\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid6633290  section:
+\par }{\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid6633290\charrsid6633290         <ModSecurity enabled="true" configFile="}{\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid6633290 owasp_crs\\}{\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 
+\f0\fs24\insrsid6633290\charrsid6633290 modsecurity}{\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid6633290 _iis}{\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid6633290\charrsid6633290 .conf" />
 \par }{\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\lang1045\langfe1033\langnp1045\insrsid6385683\charrsid16350125 MSRC blog }{\field\fldedit{\*\fldinst {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\lang1045\langfe1033\langnp1045\insrsid6385683\charrsid16350125 
 HYPERLINK "http://blogs.technet.com/b/srd/" }{\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\lang1045\langfe1033\langnp1045\insrsid2315486\charrsid16350125 {\*\datafield 
 00d0c9ea79f9bace118c8200aa004ba90b0200000003000000e0c9ea79f9bace118c8200aa004ba90b5800000068007400740070003a002f002f0062006c006f00670073002e0074006500630068006e00650074002e0063006f006d002f0062002f007300720064002f000000795881f43b1d7f48af2c825dc48527630000
-0000a5ab0000}}}{\fldrslt {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \cs16\f0\fs24\ul\cf2\lang1045\langfe1033\langnp1045\insrsid6385683\charrsid16350125 http://blogs.technet.com/b/srd/}}}\sectd \ltrsect\linex0\endnhere\sectlinegrid360\sectdefaultcl\sftnbj {
-\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\lang1045\langfe1033\langnp1045\insrsid6385683\charrsid16350125   
+0000a5ab00000000}}}{\fldrslt {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \cs16\f0\fs24\ul\cf2\lang1045\langfe1033\langnp1045\insrsid6385683\charrsid16350125 http://blogs.technet.com/b/srd/}}}\sectd \ltrsect\linex0\endnhere\sectlinegrid360\sectdefaultcl\sftnbj {
+\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\lang1045\langfe1033\langnp1045\insrsid6385683\charrsid16350125   }{\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\lang1045\langfe1033\langnp1045\insrsid6385683\charrsid6633290 
 \par }{\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid6385683\charrsid16350125 Trustwave SpiderLabs blog: }{\field\fldedit{\*\fldinst {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid2315486 HYPERLINK "http://blog.spiderlabs.com/"}{\rtlch\fcs1 
 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid2315486\charrsid16350125 {\*\datafield 
-00d0c9ea79f9bace118c8200aa004ba90b0200000003000000e0c9ea79f9bace118c8200aa004ba90b5000000068007400740070003a002f002f0062006c006f0067002e007300700069006400650072006c006100620073002e0063006f006d002f000000795881f43b1d7f48af2c825dc485276300000000a5ab0000}}
-}{\fldrslt {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \cs16\f0\fs24\ul\cf2\insrsid6385683\charrsid16350125 http://blog.spiderlabs.com}}}\sectd \ltrsect\linex0\endnhere\sectlinegrid360\sectdefaultcl\sftnbj {\field\fldedit{\*\fldinst {\rtlch\fcs1 \af0\afs24 
+00d0c9ea79f9bace118c8200aa004ba90b0200000003000000e0c9ea79f9bace118c8200aa004ba90b5000000068007400740070003a002f002f0062006c006f0067002e007300700069006400650072006c006100620073002e0063006f006d002f000000795881f43b1d7f48af2c825dc485276300000000a5ab00000000}
+}}{\fldrslt {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \cs16\f0\fs24\ul\cf2\insrsid6385683\charrsid16350125 http://blog.spiderlabs.com}}}\sectd \ltrsect\linex0\endnhere\sectlinegrid360\sectdefaultcl\sftnbj {\field\fldedit{\*\fldinst {\rtlch\fcs1 \af0\afs24 
 \ltrch\fcs0 \f0\fs24\insrsid6385683\charrsid16350125  HYPERLINK "http://blog.spiderlabs.com/" }{\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid2315486\charrsid16350125 {\*\datafield 
-00d0c9ea79f9bace118c8200aa004ba90b0200000003000000e0c9ea79f9bace118c8200aa004ba90b5000000068007400740070003a002f002f0062006c006f0067002e007300700069006400650072006c006100620073002e0063006f006d002f000000795881f43b1d7f48af2c825dc485276300000000a5ab0000}}
-}{\fldrslt {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \cs16\f0\fs24\ul\cf2\insrsid6385683\charrsid16350125 /}}}\sectd \ltrsect\linex0\endnhere\sectlinegrid360\sectdefaultcl\sftnbj {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid6385683\charrsid16350125  
+00d0c9ea79f9bace118c8200aa004ba90b0200000003000000e0c9ea79f9bace118c8200aa004ba90b5000000068007400740070003a002f002f0062006c006f0067002e007300700069006400650072006c006100620073002e0063006f006d002f000000795881f43b1d7f48af2c825dc485276300000000a5ab00000000}
+}}{\fldrslt {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \cs16\f0\fs24\ul\cf2\insrsid6385683\charrsid16350125 /}}}\sectd \ltrsect\linex0\endnhere\sectlinegrid360\sectdefaultcl\sftnbj {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid6385683\charrsid16350125  

 \par Trustwave Commercial Rule Set for ModSecurity: }{\field\fldedit{\*\fldinst {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid2315486 HYPERLINK "https://www.trustwave.com/modsecurity-rules-support.php"}{\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 
 \f0\fs24\insrsid2315486\charrsid16350125 {\*\datafield 
 00d0c9ea79f9bace118c8200aa004ba90b0200000003000000e0c9ea79f9bace118c8200aa004ba90b88000000680074007400700073003a002f002f007700770077002e007400720075007300740077006100760065002e0063006f006d002f006d006f006400730065006300750072006900740079002d00720075006c00
-650073002d0073007500700070006f00720074002e007000680070000000795881f43b1d7f48af2c825dc485276300000000a5ab0000}}}{\fldrslt {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \cs16\f0\fs24\ul\cf2\insrsid6385683\charrsid16350125 
+650073002d0073007500700070006f00720074002e007000680070000000795881f43b1d7f48af2c825dc485276300000000a5ab00000000}}}{\fldrslt {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \cs16\f0\fs24\ul\cf2\insrsid6385683\charrsid16350125 
 https://www.trustwave.com/modsecurity-rules-support.php}}}\sectd \ltrsect\linex0\endnhere\sectlinegrid360\sectdefaultcl\sftnbj {\rtlch\fcs1 \af0\afs24 \ltrch\fcs0 \f0\fs24\insrsid6385683\charrsid16350125  
 \par }\pard \ltrpar\ql \li0\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 {\rtlch\fcs1 \af0 \ltrch\fcs0 \insrsid6967166 
 \par }{\*\themedata 504b030414000600080000002100e9de0fbfff0000001c020000130000005b436f6e74656e745f54797065735d2e786d6cac91cb4ec3301045f748fc83e52d4a
@ -120,43 +126,43 @@ c7060abb0884a4eff7a93dfeae8bf9e194e720169aaa06c3e2433fcb68e1763dbf7f82c985a4a725
 a1a82fe353bd90a865aad41ed0b5b8f9d6fd010000ffff0300504b0304140006000800000021006b799616830000008a0000001c0000007468656d652f746865
 6d652f7468656d654d616e616765722e786d6c0ccc4d0ac3201040e17da17790d93763bb284562b2cbaebbf600439c1a41c7a0d29fdbd7e5e38337cedf14d59b
 4b0d592c9c070d8a65cd2e88b7f07c2ca71ba8da481cc52c6ce1c715e6e97818c9b48d13df49c873517d23d59085adb5dd20d6b52bd521ef2cdd5eb9246a3d8b
-4757e8d3f729e245eb2b260a0238fd010000ffff0300504b03041400060008000000210030dd4329a8060000a41b0000160000007468656d652f7468656d652f
-7468656d65312e786d6cec594f6fdb3614bf0fd87720746f6327761a07758ad8b19b2d4d1bc46e871e698996d850a240d2497d1bdae38001c3ba618715d86d87
-615b8116d8a5fb34d93a6c1dd0afb0475292c5585e9236d88aad3e2412f9e3fbff1e1fa9abd7eec70c1d1221294fda5efd72cd4324f1794093b0eddd1ef62fad
-79482a9c0498f184b4bd2991deb58df7dfbb8ad755446282607d22d771db8b944ad79796a40fc3585ee62949606ecc458c15bc8a702910f808e8c66c69b9565b
-5d8a314d3c94e018c8de1a8fa94fd05093f43672e23d06af89927ac06762a049136785c10607758d9053d965021d62d6f6804fc08f86e4bef210c352c144dbab
-999fb7b4717509af678b985ab0b6b4ae6f7ed9ba6c4170b06c788a705430adf71bad2b5b057d03606a1ed7ebf5babd7a41cf00b0ef83a6569632cd467faddec9
-699640f6719e76b7d6ac355c7c89feca9cccad4ea7d36c65b258a206641f1b73f8b5da6a6373d9c11b90c537e7f08dce66b7bbeae00dc8e257e7f0fd2badd586
-8b37a088d1e4600ead1ddaef67d40bc898b3ed4af81ac0d76a197c86826828a24bb318f3442d8ab518dfe3a20f000d6458d104a9694ac6d88728eee2782428d6
-0cf03ac1a5193be4cbb921cd0b495fd054b5bd0f530c1931a3f7eaf9f7af9e3f45c70f9e1d3ff8e9f8e1c3e3073f5a42ceaa6d9c84e5552fbffdeccfc71fa33f
-9e7ef3f2d117d57859c6fffac327bffcfc793510d26726ce8b2f9ffcf6ecc98baf3efdfdbb4715f04d814765f890c644a29be408edf3181433567125272371be
-15c308d3f28acd249438c19a4b05fd9e8a1cf4cd296699771c393ac4b5e01d01e5a30a787d72cf1178108989a2159c77a2d801ee72ce3a5c545a6147f32a9979
-3849c26ae66252c6ed637c58c5bb8b13c7bfbd490a75330f4b47f16e441c31f7184e140e494214d273fc80900aedee52ead87597fa824b3e56e82e451d4c2b4d
-32a423279a668bb6690c7e9956e90cfe766cb37b077538abd27a8b1cba48c80acc2a841f12e698f13a9e281c57911ce298950d7e03aba84ac8c154f8655c4f2a
-f074481847bd804859b5e696007d4b4edfc150b12addbecba6b18b148a1e54d1bc81392f23b7f84137c2715a851dd0242a633f900710a218ed715505dfe56e86
-e877f0034e16bafb0e258ebb4faf06b769e888340b103d331115bebc4eb813bf83291b63624a0d1475a756c734f9bbc2cd28546ecbe1e20a3794ca175f3fae90
-fb6d2dd99bb07b55e5ccf68942bd0877b23c77b908e8db5f9db7f024d9239010f35bd4bbe2fcae387bfff9e2bc289f2fbe24cfaa301468dd8bd846dbb4ddf1c2
-ae7b4c191ba8292337a469bc25ec3d411f06f53a73e224c5292c8de0516732307070a1c0660d125c7d44553488700a4d7bddd3444299910e254ab984c3a219ae
-a4adf1d0f82b7bd46cea4388ad1c12ab5d1ed8e1153d9c9f350a3246aad01c6873462b9ac05999ad5cc988826eafc3acae853a33b7ba11cd1445875ba1b236b1
-399483c90bd560b0b0263435085a21b0f22a9cf9356b38ec6046026d77eba3dc2dc60b17e92219e180643ed27acffba86e9c94c7ca9c225a0f1b0cfae0788ad5
-4adc5a9aec1b703b8b93caec1a0bd8e5de7b132fe5113cf312503b998e2c2927274bd051db6b35979b1ef271daf6c6704e86c73805af4bdd476216c26593af84
-0dfb5393d964f9cc9bad5c313709ea70f561ed3ea7b053075221d51696910d0d339585004b34272bff7213cc7a510a5454a3b349b1b206c1f0af490176745d4b
-c663e2abb2b34b23da76f6352ba57ca2881844c1111ab189d8c7e07e1daaa04f40255c77988aa05fe06e4e5bdb4cb9c5394bbaf28d98c1d971ccd20867e556a7
-689ec9166e0a522183792b8907ba55ca6e943bbf2a26e52f48957218ffcf54d1fb09dc3eac04da033e5c0d0b8c74a6b43d2e54c4a10aa511f5fb021a07533b20
-5ae07e17a621a8e082dafc17e450ffb739676998b48643a4daa7211214f623150942f6a02c99e83b85583ddbbb2c4996113211551257a656ec1139246ca86be0
-aadedb3d1441a89b6a929501833b197fee7b9641a3503739e57c732a59b1f7da1cf8a73b1f9bcca0945b874d4393dbbf10b1680f66bbaa5d6f96e77b6f59113d
-316bb31a795600b3d256d0cad2fe354538e7566b2bd69cc6cbcd5c38f0e2bcc63058344429dc2121fd07f63f2a7c66bf76e80d75c8f7a1b622f878a18941d840
-545fb28d07d205d20e8ea071b283369834296bdaac75d256cb37eb0bee740bbe278cad253b8bbfcf69eca23973d939b97891c6ce2cecd8da8e2d343578f6648a
-c2d0383fc818c798cf64e52f597c740f1cbd05df0c264c49134cf09d4a60e8a107260f20f92d47b374e32f000000ffff0300504b030414000600080000002100
-0dd1909fb60000001b010000270000007468656d652f7468656d652f5f72656c732f7468656d654d616e616765722e786d6c2e72656c73848f4d0ac2301484f7
-8277086f6fd3ba109126dd88d0add40384e4350d363f2451eced0dae2c082e8761be9969bb979dc9136332de3168aa1a083ae995719ac16db8ec8e4052164e89
-d93b64b060828e6f37ed1567914b284d262452282e3198720e274a939cd08a54f980ae38a38f56e422a3a641c8bbd048f7757da0f19b017cc524bd62107bd500
-1996509affb3fd381a89672f1f165dfe514173d9850528a2c6cce0239baa4c04ca5bbabac4df000000ffff0300504b01022d0014000600080000002100e9de0f
-bfff0000001c0200001300000000000000000000000000000000005b436f6e74656e745f54797065735d2e786d6c504b01022d0014000600080000002100a5d6
-a7e7c0000000360100000b00000000000000000000000000300100005f72656c732f2e72656c73504b01022d00140006000800000021006b799616830000008a
-0000001c00000000000000000000000000190200007468656d652f7468656d652f7468656d654d616e616765722e786d6c504b01022d00140006000800000021
-0030dd4329a8060000a41b00001600000000000000000000000000d60200007468656d652f7468656d652f7468656d65312e786d6c504b01022d001400060008
-00000021000dd1909fb60000001b0100002700000000000000000000000000b20900007468656d652f7468656d652f5f72656c732f7468656d654d616e616765722e786d6c2e72656c73504b050600000000050005005d010000ad0a00000000}
+4757e8d3f729e245eb2b260a0238fd010000ffff0300504b030414000600080000002100da7e1364a9060000a41b0000160000007468656d652f7468656d652f
+7468656d65312e786d6cec594d6f1b4518be23f11f467b6f6327761a4775aad8b11b48d346b15bd4e37877bc3bcdecce6a669cd437d41e9190100571a012370e
+08a8d44a5ccaaf09144191fa1778676677bd13af49d24650417b68bcb3cffbfd31efcc5ebd763f66e890084979d2f6ea976b1e2289cf039a846deff6b07f69cd
+4352e124c08c27a4ed4d89f4ae6dbcffde55bcae22121304f4895cc76d2f522a5d5f5a923e2c637999a7248177632e62ace051844b81c047c037664bcbb5daea
+528c69e2a104c7c0f6d6784c7d82869aa5b79133ef31784c94d40b3e1303cd9a3814061b1cd435424e659709748859db0339013f1a92fbca430c4b052fda5ead
+d6efd76aded2c6d525bc9e1131b580d6a1abc1bf8c2e23080e968d4c118e0aa1f57ea37565abe06f004ccde37abd5eb7572ff81900f67db0d4ea52e6d9e8afd5
+3b39cf12c8fe9ce7ddad356b0d175fe2bf32a773abd3e9345b992e96a901d99f8d39fc5a6db5b1b9ece00dc8e29b73f84667b3db5d75f00664f1ab73f8fe95d6
+6ac3c51b50c468723087d671e9f733ee0564ccd976257c0de06b79206728c88622bbb488314fd4a25c8bf13d2efa00d04086154d909aa6648c7dc8e22e8e4782
+62ad0f5e27b8f4c62ef9726e49cb42d21734556defc3144345ccf8bd7afefdabe74fd1f18367c70f7e3a7ef8f0f8c18f969143b58d93b04cf5f2dbcffe7cfc31
+fae3e9372f1f7d518d9765fcaf3f7cf2cbcf9f5703a17c66eabcf8f2c96fcf9ebcf8ead3dfbf7b5401df147854860f694c24ba498ed03e8fc130e31557733212
+e7a31846989629369350e2046b2915fc7b2a72d037a79865d171f4e810d7837704b48f2ae0f5c93d47e14124268a5648de896207b8cb39eb7051e9851d2dabe4
+e6e12409ab858b4919b78ff16195ec2e4e9cf8f62629f4cd3c2d1dc3bb1171d4dc6338513824095148bfe307845458779752c7afbbd4175cf2b1427729ea605a
+e992211d39d93423daa631c4655a6533c4dbf1cdee1dd4e1accaea2d72e822a12a30ab507e4898e3c6eb78a2705cc57288635676f80daca22a250753e197713d
+a920d221611cf502226515cd2d01f69682be83a16355867d974d631729143da8e27903735e466ef1836e84e3b40a3ba04954c67e200f204531dae3aa0abecbdd
+0ad1cf10079c2c0cf71d4a9c709fde0d6ed3d051699620facd4454c4f23ae14efe0ea66c8c896935d0d49d5e1dd3e4ef1a37a3d0b9ad848b6bdcd02a5f7cfdb8
+42efb7b5656fc2ee555533db271af522dcc9f6dce522a06f7f77dec293648f4041cc6f51ef9af3bbe6ecfde79bf3a27abef8963cebc2d0a0f52c62076d3376c7
+0ba7ee31656ca0a68cdc9066f096b0f7047d58d474e6c4498a53581ac14f5dc920c0c185021b1a24b8fa88aa6810e11486f6baa7998432631d4a9472098745b3
+5cc95be361f057f6a8d9d48710db392456bb3cb0cb2b7a393f6b146c8c56a139d0e682563483b30a5bb9923105db5e47585d2b75666975a39a698a8eb4c264ed
+627328079717a6c162e14d186a108c42e0e55538f36bd170d8c18c04daef364679584c142e324432c201c962a4ed9e8f51dd0429cf953943b41d3619f4c1f114
+af95a4b534db379076962095c5351688cba3f72651ca33781625e076b21c59522e4e96a0a3b6d76a2e373de4e3b4ed8de19c0c3fe314a22ef51c895908974dbe
+1236ed4f2d6653e5b368b672c3dc22a8c3d587f5fb9cc14e1f4885545b58463635ccab2c0558a22559fd979be0d68b32a0a21b9d4d8b953548867f4d0bf0a31b
+5a321e135f95835d5ad1beb38f592be51345c4200a8ed0884dc43e86f0eb54057b022ae1bac37404fd007773dadbe695db9cb3a22bdf88199c5dc72c8d70d66e
+7589e6956ce1a621153a98a7927a605ba5eec6b8f39b624afe824c29a7f1ffcc14bd9fc0edc34aa023e0c3d5b0c048574adbe342451cba501a51bf2f607030bd
+03b205ee77e13524155c509bbf821ceabfb6e62c0f53d6708854fb344482c27ea42241c81eb425937da730ab677b9765c9324626a34aeacad4aa3d2287840d75
+0f5cd57bbb87224875d34db236607027f3cf7dce2a6814ea21a75c6f4e272bf65e5b03fff4e4638b198c72fbb0196872ff172a16e3c16c57b5f4863cdf7bcb86
+e817b331ab915705082b6d05adacec5f5385736eb5b663cd59bcdccc958328ce5b0c8bc54094c21d12d2ffc1fe4785cfecd70ebda10ef93ef456041f2f343348
+1bc8ea4b76f040ba41dac5110c4e76d1269366655d9b8d4eda6bf9667dc1936e21f784b3b5666789f7399d5d0c67ae38a7162fd2d999871d5fdbb585ae86c89e
+2c51581ae707191318f399acfc258b8fee41a0b7e09bc18429699209be53090c33f4c0d40114bf95684837fe020000ffff0300504b0304140006000800000021
+000dd1909fb60000001b010000270000007468656d652f7468656d652f5f72656c732f7468656d654d616e616765722e786d6c2e72656c73848f4d0ac2301484
+f78277086f6fd3ba109126dd88d0add40384e4350d363f2451eced0dae2c082e8761be9969bb979dc9136332de3168aa1a083ae995719ac16db8ec8e4052164e
+89d93b64b060828e6f37ed1567914b284d262452282e3198720e274a939cd08a54f980ae38a38f56e422a3a641c8bbd048f7757da0f19b017cc524bd62107bd5
+001996509affb3fd381a89672f1f165dfe514173d9850528a2c6cce0239baa4c04ca5bbabac4df000000ffff0300504b01022d0014000600080000002100e9de
+0fbfff0000001c0200001300000000000000000000000000000000005b436f6e74656e745f54797065735d2e786d6c504b01022d0014000600080000002100a5
+d6a7e7c0000000360100000b00000000000000000000000000300100005f72656c732f2e72656c73504b01022d00140006000800000021006b79961683000000
+8a0000001c00000000000000000000000000190200007468656d652f7468656d652f7468656d654d616e616765722e786d6c504b01022d001400060008000000
+2100da7e1364a9060000a41b00001600000000000000000000000000d60200007468656d652f7468656d652f7468656d65312e786d6c504b01022d0014000600
+0800000021000dd1909fb60000001b0100002700000000000000000000000000b30900007468656d652f7468656d652f5f72656c732f7468656d654d616e616765722e786d6c2e72656c73504b050600000000050005005d010000ae0a00000000}
 {\*\colorschememapping 3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d22796573223f3e0d0a3c613a636c724d
 617020786d6c6e733a613d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f64726177696e676d6c2f323030362f6d6169
 6e22206267313d226c743122207478313d22646b3122206267323d226c743222207478323d22646b322220616363656e74313d22616363656e74312220616363
@ -214,8 +220,8 @@ fffffffffffffffffdfffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffff
 ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
 ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
 ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
-ffffffffffffffffffffffffffffffff52006f006f007400200045006e00740072007900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000500ffffffffffffffffffffffff0c6ad98892f1d411a65f0040963251e5000000000000000000000000301c
-57149160cd01feffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000
+ffffffffffffffffffffffffffffffff52006f006f007400200045006e00740072007900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000500ffffffffffffffffffffffff0c6ad98892f1d411a65f0040963251e5000000000000000000000000f0d5
+16df10f5cd01feffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000
 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000
 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffff000000000000000000000000000000000000000000000000
 0000000000000000000000000000000000000000000000000105000000000000}}
--- a/iis/mymodule.cpp
+++ b/iis/mymodule.cpp
@ -367,8 +367,12 @@ HRESULT CMyHttpModule::ReadFileChunk(HTTP_DATA_CHUNK *chunk, char *buf)
 		{
 			bytesRead = (DWORD)chunk->FromFileHandle.ByteRange.Length.QuadPart;
 		}
+		if ((bytesTotal + bytesRead) > chunk->FromFileHandle.ByteRange.Length.QuadPart)
+		{ 
+			bytesRead = chunk->FromFileHandle.ByteRange.Length.QuadPart - bytesTotal; 
+		}

-		memcpy(buf, pIoBuffer, bytesRead);
+		memcpy(buf, pIoBuffer + dwDataStartOffset, bytesRead);

 		buf += bytesRead;
 		bytesTotal += bytesRead;
@ -403,6 +407,8 @@ CMyHttpModule::OnSendResponse(

 	EnterCriticalSection(&m_csLock);

+	// here we must check if response body processing is enabled
+	//
 	if(rsc == NULL || rsc->m_pRequestRec == NULL || rsc->m_pResponseBuffer != NULL || !modsecIsResponseBodyAccessEnabled(rsc->m_pRequestRec))
 	{
 		goto Exit;
@ -501,9 +507,6 @@ CMyHttpModule::OnSendResponse(
 		*(const char **)apr_array_push(r->content_languages) = lng;
 	}

-	// here we must check if response body processing is enabled
-	//
-
 	// Disable kernel caching for this response
 	// Probably we don't have to do it for ModSecurity

@ -765,17 +768,33 @@ CMyHttpModule::OnBeginRequest(

 			pConfig->m_Config = modsecGetDefaultConfig();

+			PCWSTR servpath = pHttpContext->GetApplication()->GetApplicationPhysicalPath();
+			char *apppath;
+			USHORT apppathlen;
+
+			hr = pConfig->GlobalWideCharToMultiByte((WCHAR *)servpath, wcslen(servpath), &apppath, &apppathlen);
+
+			if ( FAILED( hr ) )
+			{
+				delete path;
+				hr = E_UNEXPECTED;
+				goto Finished;
+			}
+
 			if(path[0] != 0)
 			{
-				const char * err = modsecProcessConfig((directory_config *)pConfig->m_Config, path);
+				const char * err = modsecProcessConfig((directory_config *)pConfig->m_Config, path, apppath);

 				if(err != NULL)
 				{
 					WriteEventViewerLog(err, EVENTLOG_ERROR_TYPE);
+					delete apppath;
+					delete path;
+					goto Finished;
 				}
 			}
+			delete apppath;
 		}
-
 		delete path;
 	}

@ -788,6 +807,11 @@ CMyHttpModule::OnBeginRequest(

 	r = modsecNewRequest(c, (directory_config *)pConfig->m_Config);

+	// on IIS we force input stream inspection flag, because its absence does not add any performance gain
+	// it's because on IIS request body must be restored each time it was read
+	//
+	modsecSetConfigForIISRequestBody(r);
+
 	REQUEST_STORED_CONTEXT *rsc = new REQUEST_STORED_CONTEXT();

 	rsc->m_pConnRec = c;
--- a/nginx/modsecurity/config
+++ b/nginx/modsecurity/config
@ -3,4 +3,4 @@ HTTP_MODULES="$HTTP_MODULES ngx_http_modsecurity"
 NGX_ADDON_SRCS="$NGX_ADDON_SRCS $ngx_addon_dir/ngx_http_modsecurity.c"
 NGX_ADDON_DEPS="$NGX_ADDON_DEPS"
 CORE_LIBS="$CORE_LIBS $ngx_addon_dir/../../standalone/.libs/standalone.a -lapr-1 -laprutil-1 -lxml2 -lm"
-CORE_INCS="$CORE_INCS /usr/include/apache2 /usr/include/apr-1.0 $ngx_addon_dir/../../standalone $ngx_addon_dir/../../apache2 /usr/include/libxml2"
+CORE_INCS="$CORE_INCS /usr/include/apache2 /usr/include/apr-1.0 /usr/include/httpd /usr/include/apr-1 $ngx_addon_dir/../../standalone $ngx_addon_dir/../../apache2 /usr/include/libxml2"
--- a/nginx/modsecurity/ngx_http_modsecurity.c
+++ b/nginx/modsecurity/ngx_http_modsecurity.c
--- a/standalone/api.c
+++ b/standalone/api.c
--- a/standalone/api.h
+++ b/standalone/api.h
@ -51,7 +51,7 @@ void modsecTerminate();

 void modsecStartConfig();
 directory_config *modsecGetDefaultConfig();
-const char *modsecProcessConfig(directory_config *config, const char *dir);
+const char *modsecProcessConfig(directory_config *config, const char *file, const char *dir);
 void modsecFinalizeConfig();

 void modsecInitProcess();
@ -70,9 +70,12 @@ void modsecSetReadBody(apr_status_t (*func)(request_rec *r, char *buf, unsigned
 void modsecSetReadResponse(apr_status_t (*func)(request_rec *r, char *buf, unsigned int length, unsigned int *readcnt, int *is_eos));
 void modsecSetWriteBody(apr_status_t (*func)(request_rec *r, char *buf, unsigned int length));
 void modsecSetWriteResponse(apr_status_t (*func)(request_rec *r, char *buf, unsigned int length));
+void modsecSetDropAction(int (*func)(request_rec *r));

 int modsecIsResponseBodyAccessEnabled(request_rec *r);

+void modsecSetConfigForIISRequestBody(request_rec *r);
+
 #ifdef __cplusplus
 }
 #endif
--- a/standalone/config.c
+++ b/standalone/config.c
--- a/standalone/main.cpp
+++ b/standalone/main.cpp
@ -239,7 +239,7 @@ void main(int argc, char *argv[])

 	config = modsecGetDefaultConfig();

-	const char * err = modsecProcessConfig(config, config_file);
+	const char * err = modsecProcessConfig(config, config_file, "c:\\inetpub\\wwwroot");

 	if(err != NULL)
 	{
--- a/standalone/server.c
+++ b/standalone/server.c
@ -992,6 +992,7 @@ AP_DECLARE(apr_status_t) unixd_set_proc_mutex_perms(apr_proc_mutex_t *pmutex)
 #endif
            union semun ick;
            struct semid_ds buf;
+            memset(&buf,0,sizeof(buf));

            apr_os_proc_mutex_get(&ospmutex, pmutex);
            buf.sem_perm.uid = unixd_config.user_id;
--- a/standalone/standalone.vcxproj.user
+++ b/standalone/standalone.vcxproj.user
@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
-    <LocalDebuggerCommandArguments>-c d:\xss.conf d:\test.dat</LocalDebuggerCommandArguments>
+    <LocalDebuggerCommandArguments>-c owasp_crs\modsecurity_iis.conf d:\test.dat</LocalDebuggerCommandArguments>
    <DebuggerFlavor>WindowsLocalDebugger</DebuggerFlavor>
    <LocalDebuggerCommand>$(TargetPath)</LocalDebuggerCommand>
    <LocalDebuggerAttach>false</LocalDebuggerAttach>