github_mirrors/ModSecurity
3
0
Fork 1
mirror of https://github.com/owasp-modsecurity/ModSecurity.git synced 2025-08-14 05:45:59 +03:00
Code Issues Packages Projects Releases Wiki Activity

Allow user to choose between TLS versions(TLSProtocol option introduced).

Browse Source
This commit is contained in:
Ishwor Gurung 2015-05-03 16:59:59 +10:00 committed by Felipe Zimmerle
parent 831282ee2c
commit bd7ee39d2e
1 changed files with 54 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
mlogc/mlogc.c
View File

@ -158,6 +158,8 @@ static apr_pool_t *recv_pool = NULL;
static apr_array_header_t *queue = NULL; static apr_array_header_t *queue = NULL;
static const char *queue_path = NULL; static const char *queue_path = NULL;
static int ssl_validation = 0; static int ssl_validation = 0;
static int tlsprotocol = 1;
static curl_version_info_data* curlversion = NULL;
/* static apr_time_t queue_time = 0; */ /* static apr_time_t queue_time = 0; */
static void *requestline_regex = NULL; static void *requestline_regex = NULL;
static int running = 0; static int running = 0;
@ -810,6 +812,26 @@ static void init_configuration(void)
startup_delay = atoi(s); startup_delay = atoi(s);
} }
/* TLS Protocol - TLSv1(0) TLSv1.1(1) TLSv1.2(2) (SSLv3 not supported) */
s = apr_table_get(conf, "TLSProtocol");
if (s != NULL) {
int num = atoi(s);
switch (num) {
case 0:
tlsprotocol = 0;
break;
case 1:
tlsprotocol = 1;
break;
case 2:
tlsprotocol = 2;
break;
default:
tlsprotocol = 2; /* Default is TLSv1.2 */
}
}
curlversion = curl_version_info(CURLVERSION_NOW);
if ( startup_delay > 0 ) { if ( startup_delay > 0 ) {
error_log(LOG_NOTICE, NULL, error_log(LOG_NOTICE, NULL,
"Delaying execution for %dms.", startup_delay); "Delaying execution for %dms.", startup_delay);
@ -824,6 +846,8 @@ static void init_configuration(void)
error_log(LOG_DEBUG2, NULL, "ErrorLog=%s", error_log_path); error_log(LOG_DEBUG2, NULL, "ErrorLog=%s", error_log_path);
error_log(LOG_DEBUG2, NULL, "ErrorLogLevel=%d", error_log_level); error_log(LOG_DEBUG2, NULL, "ErrorLogLevel=%d", error_log_level);
error_log(LOG_DEBUG2, NULL, "StartupDelay=%d", startup_delay); error_log(LOG_DEBUG2, NULL, "StartupDelay=%d", startup_delay);
error_log(LOG_DEBUG2, NULL, "TLSProtocol=%d", tlsprotocol);
error_log(LOG_DEBUG2, NULL, "cURL version=%s", curlversion->version);
s = apr_table_get(conf, "CheckpointInterval"); s = apr_table_get(conf, "CheckpointInterval");
if (s != NULL) { if (s != NULL) {
@ -1182,6 +1206,8 @@ static void logc_init(void)
apr_status_t rc = 0; apr_status_t rc = 0;
const char *errptr = NULL; const char *errptr = NULL;
int i, erroffset; int i, erroffset;
/* cURL major, minor and patch version */
short cmaj, cmin, cpat = 0;
queue = apr_array_make(pool, 64, sizeof(entry_t *)); queue = apr_array_make(pool, 64, sizeof(entry_t *));
if (queue == NULL) { if (queue == NULL) {
@ -1246,8 +1272,31 @@ static void logc_init(void)
/* Seems like CURL_SSLVERSION_TLSv1_2 is not supported on libcurl /* Seems like CURL_SSLVERSION_TLSv1_2 is not supported on libcurl
* < v7.34.0 * < v7.34.0
*
* version_num is a 24 bit number created like this:
* <8 bits major number> | <8 bits minor number> | <8 bits patch number>.
*/ */
curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1); switch (tlsprotocol) {
case 0:
curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_0);
break;
case 1:
curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_1);
break;
case 2:
curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
break;
default:
curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
break;
}
cmaj = curlversion->version_num >> 16;
cmin = (curlversion->version_num & 0x00ff00) >> 8;
cpat = (curlversion->version_num & 0x0000ff);
/* If cURL version < v7.34.0, use TLS v1.x */
if (cmaj <= 7 && cmin < 34) {
curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);
}
curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 15); curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 15);
curl_easy_setopt(curl, CURLOPT_NOSIGNAL, TRUE); curl_easy_setopt(curl, CURLOPT_NOSIGNAL, TRUE);
@ -1258,6 +1307,10 @@ static void logc_init(void)
*(CURL **)apr_array_push(curl_handles) = curl; *(CURL **)apr_array_push(curl_handles) = curl;
} }
if (cmaj <= 7 && cmin < 34) {
error_log(LOG_DEBUG2, NULL, "TLSv1.2 is unsupported in cURL %d.%d.%d", cmaj, cmin, cpat);
}
logline_regex = pcre_compile(logline_pattern, PCRE_CASELESS, logline_regex = pcre_compile(logline_pattern, PCRE_CASELESS,
&errptr, &erroffset, NULL); &errptr, &erroffset, NULL);
if (logline_regex == NULL) { if (logline_regex == NULL) {