Fix LF line detection, add MULTIPART_CRLF_LINE, MULTIPART_CRLF_LF_LINES.

apache2/msc_multipart.c

@@ -172,19 +172,30 @@ static int multipart_parse_content_disposition(modsec_rec *msr, char *c_d_value)
  *
  */
 static int multipart_process_part_header(modsec_rec *msr, char **error_msg) {
-    int i, rc;
+    int i, len, rc;
     
     if (error_msg == NULL) return -1;
     *error_msg = NULL;
 
     /* Check for nul bytes. */
-    for(i = 0; i < (MULTIPART_BUF_SIZE - msr->mpd->bufleft); i++) {
+    len = MULTIPART_BUF_SIZE - msr->mpd->bufleft;
+    for(i = 0; i < len; i++) {
         if (msr->mpd->buf[i] == '\0') {
             *error_msg = apr_psprintf(msr->mp, "Multipart: Nul byte in part headers.");
             return -1;
         }        
     }
 
+    if (len > 1) {
+        if (msr->mpd->buf[len - 2] == '\r') {
+            msr->mpd->flag_lf_line = 1;
+        } else {
+            msr->mpd->flag_crlf_line = 1;
+        }
+    } else {
+        msr->mpd->flag_lf_line = 1;
+    }
+
     /* Is this an empty line? */
     if (   ((msr->mpd->buf[0] == '\r')
           &&(msr->mpd->buf[1] == '\n')
@@ -196,9 +207,11 @@ static int multipart_process_part_header(modsec_rec *msr, char **error_msg) {
         
         /* Empty line. */
 
-        if (msr->mpd->buf[0] == '\n') {
+        //if (msr->mpd->buf[0] == '\n') {
-            msr->mpd->flag_lf_line = 1;
+        //    msr->mpd->flag_lf_line = 1;
-        }
+        //} else {
+        //    msr->mpd->flag_crlf_line = 1;
+        //}
 
         header_value = (char *)apr_table_get(msr->mpd->mpp->headers, "Content-Disposition");
         if (header_value == NULL) {
@@ -237,6 +250,9 @@ static int multipart_process_part_header(modsec_rec *msr, char **error_msg) {
         msr->mpd->mpp->last_header_name = NULL;
     } else {
         /* Header line. */
+
+        // XXX
+
         if ((msr->mpd->buf[0] == '\t')||(msr->mpd->buf[0] == ' ')) {
             char *header_value, *new_value, *data;
             
@@ -838,6 +854,8 @@ int multipart_process_chunk(modsec_rec *msr, const char *buf,
                     {
                         if (*boundary_end == '\n') {
                             msr->mpd->flag_lf_line = 1;
+                        } else {
+                            msr->mpd->flag_crlf_line = 1;
                         }
 
                         if (multipart_process_boundary(msr, (is_final ? 1 : 0), error_msg) < 0) {

apache2/msc_multipart.h

@@ -105,6 +105,7 @@ struct multipart_data {
     int                      flag_header_folding;
     int                      flag_boundary_quoted;
     int                      flag_lf_line;
+    int                      flag_crlf_line;
     int                      flag_unmatched_boundary;
     int                      flag_boundary_whitespace;
 };

apache2/re_variables.c

@@ -1288,6 +1288,30 @@ static int var_multipart_header_folding_generate(modsec_rec *msr, msre_var *var,
     }
 }
 
+/* MULTIPART_CRLF_LINE */
+
+static int var_multipart_crlf_line_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
+    apr_table_t *vartab, apr_pool_t *mptmp)
+{
+    if ((msr->mpd != NULL)&&(msr->mpd->flag_crlf_line != 0)) {
+        return var_simple_generate(var, vartab, mptmp, "1");
+    } else {
+        return var_simple_generate(var, vartab, mptmp, "0");
+    }
+}
+
+/* MULTIPART_CRLF_LF_LINES */
+
+static int var_multipart_crlf_lf_lines_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
+    apr_table_t *vartab, apr_pool_t *mptmp)
+{
+    if ((msr->mpd != NULL)&&(msr->mpd->flag_lf_line != 0)&&(msr->mpd->flag_crlf_line != 0)) {
+        return var_simple_generate(var, vartab, mptmp, "1");
+    } else {
+        return var_simple_generate(var, vartab, mptmp, "0");
+    }
+}
+
 /* MULTIPART_LF_LINE */
 
 static int var_multipart_lf_line_generate(modsec_rec *msr, msre_var *var, msre_rule *rule,
@@ -2321,6 +2345,28 @@ void msre_engine_register_default_variables(msre_engine *engine) {
         PHASE_REQUEST_BODY
     );
 
+    /* MULTIPART_CRLF_LINE */
+    msre_engine_variable_register(engine,
+        "MULTIPART_CRLF_LINE",
+        VAR_SIMPLE,
+        0, 0,
+        NULL,
+        var_multipart_crlf_line_generate,
+        VAR_CACHE,
+        PHASE_REQUEST_BODY
+    );
+
+    /* MULTIPART_CRLF_LF_LINES */
+    msre_engine_variable_register(engine,
+        "MULTIPART_CRLF_LF_LINES",
+        VAR_SIMPLE,
+        0, 0,
+        NULL,
+        var_multipart_crlf_lf_lines_generate,
+        VAR_CACHE,
+        PHASE_REQUEST_BODY
+    );
+
     /* MULTIPART_LF_LINE */
     msre_engine_variable_register(engine,
         "MULTIPART_LF_LINE",