github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-09-30 03:34:29 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fixes subnets representations using slash notation

Browse Source 
The ipv4 representation was only accepting slash notation with masks
represented in 2 digits. In the ipv6 implementation several fixies were made:
The maximum value to a bitmask was 64 which is not the reality, as ipv6 can
handle 128 bits. The second change was also to enable mask representation with
more and less than 2 digits. A more general fix was added to allow the unit
tests to work even if a invalid ip/range was informed during the creation of
the "tree", now it is checking if the tree is NULL while performing the
execution of the operator. Initial problem was reported at the issue: #706.
This commit is contained in:
Felipe Zimmerle
2014-06-10 16:09:05 -07:00
parent 731466cff0
commit 5d92e448ae
3 changed files with 36 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
apache2/re_operators.c
View File

@@ -122,7 +122,7 @@ static int msre_op_ipmatch_param_init(msre_rule *rule, char **error_msg) {
* \retval 0 On No Match
*/
static int msre_op_ipmatch_execute(modsec_rec *msr, msre_rule *rule, msre_var *var, char **error_msg) {
TreeRoot *rtree = rule->ip_op;
TreeRoot *rtree = NULL;
int res = 0;
if (error_msg == NULL)
@@ -130,11 +130,13 @@ static int msre_op_ipmatch_execute(modsec_rec *msr, msre_rule *rule, msre_var *v
else
*error_msg = NULL;
if (rtree == NULL) {
if (rule == NULL || rule->ip_op == NULL) {
msr_log(msr, 1, "ipMatch Internal Error: ipmatch value is null.");
return 0;
}
rtree = rule->ip_op;
res = tree_contains_ip(msr->mp, rtree, var->value, NULL, error_msg);
if (res < 0) {