From 24b5c96c20ae5faadfd6f277fca6ed504fe1b85f Mon Sep 17 00:00:00 2001 From: brenosilva Date: Thu, 14 Jun 2012 13:54:05 +0000 Subject: [PATCH 01/64] update CHANGES --- CHANGES | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/CHANGES b/CHANGES index e9239d56..a181be40 100644 --- a/CHANGES +++ b/CHANGES @@ -91,9 +91,8 @@ * Added build system support for KfreeBSD and HURD. - * In 2009, Stefan Esser published an evasion technique that relies on the use of single quotes and PHP. - The trick was treating a request parameter as a file. A patch was applied into ModSecurity 2.5.11 by Brian Rectanus. - Ivan Ristic reported that the patch was imcomplete. We added extra checks for this evasion. + * Fixed a multipart bypass issue related to quote parsing + Credits to Qualys Vulnerability & Malware Research Labs (VMRL). 20 Mar 2012 - 2.6.5 ------------------- From 563017fce6ea07041da293d14c63186efe908d0f Mon Sep 17 00:00:00 2001 From: brenosilva Date: Fri, 15 Jun 2012 12:13:32 +0000 Subject: [PATCH 02/64] Fix loop into getkey --- apache2/msc_crypt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apache2/msc_crypt.c b/apache2/msc_crypt.c index 07ba5fd0..03aa33b0 100644 --- a/apache2/msc_crypt.c +++ b/apache2/msc_crypt.c @@ -132,7 +132,7 @@ unsigned char *getkey(apr_pool_t *mp) { srand((unsigned int) time(0)); while(length--) { - output[length-1] = (rand() % 94 + 33); + output[length] = (rand() % 94 + 33); srand(rand()); } From 39fcad45661754f8d7d0d7feb90b87365d01344d Mon Sep 17 00:00:00 2001 From: brenosilva Date: Fri, 15 Jun 2012 12:43:29 +0000 Subject: [PATCH 03/64] Improve random number generator --- apache2/msc_crypt.c | 10 ++++++++-- apache2/msc_crypt.h | 7 +++++++ 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/apache2/msc_crypt.c b/apache2/msc_crypt.c index 03aa33b0..89a8ed5c 100644 --- a/apache2/msc_crypt.c +++ b/apache2/msc_crypt.c @@ -125,15 +125,21 @@ char *normalize_path(modsec_rec *msr, char *input) { */ unsigned char *getkey(apr_pool_t *mp) { unsigned short int length = 12; + struct glinear data; + uint64_t seed; char output[13]; char *key = NULL; output[length] = '\0'; - srand((unsigned int) time(0)); + seed = data.seed; + srand(data.seed); while(length--) { + seed *= data.mul; + seed += data.add; + data.seed = seed % data.mod; output[length] = (rand() % 94 + 33); - srand(rand()); + srand(data.seed + rand() + time(0)); } key = apr_psprintf(mp,"%s",output); diff --git a/apache2/msc_crypt.h b/apache2/msc_crypt.h index c5f6e8d8..3286fa8f 100644 --- a/apache2/msc_crypt.h +++ b/apache2/msc_crypt.h @@ -27,6 +27,13 @@ #define INT32_MAX (2147483647) #endif +struct glinear { + uint32_t seed; + uint32_t mod; + uint32_t mul; + uint32_t add; +}; + char DSOLOCAL *hmac(modsec_rec *msr,const unsigned char *key, int key_len, char *msg, int msglen); unsigned char DSOLOCAL *do_hash_link(modsec_rec *msr, char *link, From f72ba4d36fd6760c227a1d6df6fa00c0ec5f2019 Mon Sep 17 00:00:00 2001 From: brenosilva Date: Fri, 15 Jun 2012 13:15:51 +0000 Subject: [PATCH 04/64] Improve random number generator --- apache2/msc_crypt.c | 54 ++++++++++++++++++++++++++++++++++++++++++++- apache2/msc_crypt.h | 5 +++++ 2 files changed, 58 insertions(+), 1 deletion(-) diff --git a/apache2/msc_crypt.c b/apache2/msc_crypt.c index 89a8ed5c..46b5d591 100644 --- a/apache2/msc_crypt.c +++ b/apache2/msc_crypt.c @@ -116,6 +116,58 @@ char *normalize_path(modsec_rec *msr, char *input) { return apr_pstrdup(msr->mp, input); } +/** + * \brief Create a random number + * + * \retval seed random seed + */ +unsigned long prng() { + short num_matrix1[10]; num_matrix2[10]; + unsigned long num, num1, num2; + short n, *p; + unsigned short seed_num; + unsigned long seed; + + seed_num = seed & 16BITS_MASK; + num = seed & 31BITS_MASK; + + p = num_matrix1; + + for(n = 18; n-- ; ) { + num = 30903*seed_num + (num>>16); + *p++ = seed_num = num & 16BITS_MASK; + if (n == 9) + p = num_matrix2; + } + + num_matrix1[0] &= 15BITS_MASK; + num_matrix2[0] &= 15BITS_MASK; + memcpy((char*)num_matrix1+2,(char*)num_matrix1+1,8*sizeof(short)); + memcpy((char*)num_matrix2+2,(char*)num_matrix2+1,8*sizeof(short)); + + num1 = num_matrix1[0]; + num2 = num_matrix2[0]; + + num1 += 1941 * num_matrix1[2] + 1860 * num_matrix1[3] + + 1812 * num_matrix1[4] + 1776 * num_matrix1[5] + + 1492 * num_matrix1[6] + 1215 * num_matrix1[7] + + 1066 * num_matrix1[8] + 12013 * num_matrix1[9]; + + num2 += 1111 * num_matrix2[2] + 2222 * num_matrix2[3] + + 3333 * num_matrix2[4] + 4444 * num_matrix2[5] + + 5555 * num_matrix2[6] + 6666 * num_matrix2[7] + + 7777 * num_matrix2[8] + 9272 * num_matrix2[9]; + + num_matrix1[0] = num1/16BITS_MASK; + num_matrix2[0] = num2/16BITS_MASK; + num_matrix1[1] = 16BITS_MASK&num1; + num_matrix2[1] = 16BITS_MASK&num2; + + seed = (((long)num_matrix1[1])<<16)+(long)num_matrix2[1]; + + return seed; +} + /** * \brief Create a random password * @@ -139,7 +191,7 @@ unsigned char *getkey(apr_pool_t *mp) { seed += data.add; data.seed = seed % data.mod; output[length] = (rand() % 94 + 33); - srand(data.seed + rand() + time(0)); + srand(data.seed + prng()); } key = apr_psprintf(mp,"%s",output); diff --git a/apache2/msc_crypt.h b/apache2/msc_crypt.h index 3286fa8f..70192ecc 100644 --- a/apache2/msc_crypt.h +++ b/apache2/msc_crypt.h @@ -34,6 +34,11 @@ struct glinear { uint32_t add; }; +#define 16BITS_MASK 65536L +#define 16BITS_MASK 0xFFFF +#define 15BITS_MASK 0x7FFF +#define 31BITS_MASK 0x7FFFFFFF + char DSOLOCAL *hmac(modsec_rec *msr,const unsigned char *key, int key_len, char *msg, int msglen); unsigned char DSOLOCAL *do_hash_link(modsec_rec *msr, char *link, From 4ef3cc8ebab907fae219eb16405dffa9eadb6e4f Mon Sep 17 00:00:00 2001 From: brenosilva Date: Fri, 15 Jun 2012 16:56:50 +0000 Subject: [PATCH 05/64] Improve random number generator --- apache2/msc_crypt.c | 18 +++++++++--------- apache2/msc_crypt.h | 8 ++++---- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/apache2/msc_crypt.c b/apache2/msc_crypt.c index 46b5d591..fc02b987 100644 --- a/apache2/msc_crypt.c +++ b/apache2/msc_crypt.c @@ -128,20 +128,20 @@ unsigned long prng() { unsigned short seed_num; unsigned long seed; - seed_num = seed & 16BITS_MASK; - num = seed & 31BITS_MASK; + seed_num = seed & N16BITS_MASK; + num = seed & N31BITS_MASK; p = num_matrix1; for(n = 18; n-- ; ) { num = 30903*seed_num + (num>>16); - *p++ = seed_num = num & 16BITS_MASK; + *p++ = seed_num = num & N16BITS_MASK; if (n == 9) p = num_matrix2; } - num_matrix1[0] &= 15BITS_MASK; - num_matrix2[0] &= 15BITS_MASK; + num_matrix1[0] &= N15BITS_MASK; + num_matrix2[0] &= N15BITS_MASK; memcpy((char*)num_matrix1+2,(char*)num_matrix1+1,8*sizeof(short)); memcpy((char*)num_matrix2+2,(char*)num_matrix2+1,8*sizeof(short)); @@ -158,10 +158,10 @@ unsigned long prng() { 5555 * num_matrix2[6] + 6666 * num_matrix2[7] + 7777 * num_matrix2[8] + 9272 * num_matrix2[9]; - num_matrix1[0] = num1/16BITS_MASK; - num_matrix2[0] = num2/16BITS_MASK; - num_matrix1[1] = 16BITS_MASK&num1; - num_matrix2[1] = 16BITS_MASK&num2; + num_matrix1[0] = num1/N16BITS_MASK; + num_matrix2[0] = num2/N16BITS_MASK; + num_matrix1[1] = N16BITS_MASK&num1; + num_matrix2[1] = N16BITS_MASK&num2; seed = (((long)num_matrix1[1])<<16)+(long)num_matrix2[1]; diff --git a/apache2/msc_crypt.h b/apache2/msc_crypt.h index 70192ecc..d40d7225 100644 --- a/apache2/msc_crypt.h +++ b/apache2/msc_crypt.h @@ -34,10 +34,10 @@ struct glinear { uint32_t add; }; -#define 16BITS_MASK 65536L -#define 16BITS_MASK 0xFFFF -#define 15BITS_MASK 0x7FFF -#define 31BITS_MASK 0x7FFFFFFF +#define N16BITS_MASK 65536L +#define N16BITS_MASK 0xFFFF +#define N15BITS_MASK 0x7FFF +#define N31BITS_MASK 0x7FFFFFFF char DSOLOCAL *hmac(modsec_rec *msr,const unsigned char *key, int key_len, char *msg, int msglen); From 575356f10cba6c8f5b82d7badeeaeda654e7e1d4 Mon Sep 17 00:00:00 2001 From: brenosilva Date: Fri, 15 Jun 2012 17:06:10 +0000 Subject: [PATCH 06/64] Fix PRNG code --- apache2/msc_crypt.c | 10 +++++----- apache2/msc_crypt.h | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/apache2/msc_crypt.c b/apache2/msc_crypt.c index fc02b987..e831f729 100644 --- a/apache2/msc_crypt.c +++ b/apache2/msc_crypt.c @@ -122,20 +122,20 @@ char *normalize_path(modsec_rec *msr, char *input) { * \retval seed random seed */ unsigned long prng() { - short num_matrix1[10]; num_matrix2[10]; + short num_matrix1[10], num_matrix2[10]; unsigned long num, num1, num2; short n, *p; unsigned short seed_num; unsigned long seed; - seed_num = seed & N16BITS_MASK; + seed_num = seed & N16BITS_MAX; num = seed & N31BITS_MASK; p = num_matrix1; for(n = 18; n-- ; ) { num = 30903*seed_num + (num>>16); - *p++ = seed_num = num & N16BITS_MASK; + *p++ = seed_num = num & N16BITS_MAX; if (n == 9) p = num_matrix2; } @@ -160,8 +160,8 @@ unsigned long prng() { num_matrix1[0] = num1/N16BITS_MASK; num_matrix2[0] = num2/N16BITS_MASK; - num_matrix1[1] = N16BITS_MASK&num1; - num_matrix2[1] = N16BITS_MASK&num2; + num_matrix1[1] = N16BITS_MAX & num1; + num_matrix2[1] = N16BITS_MAX & num2; seed = (((long)num_matrix1[1])<<16)+(long)num_matrix2[1]; diff --git a/apache2/msc_crypt.h b/apache2/msc_crypt.h index d40d7225..8bd74d6d 100644 --- a/apache2/msc_crypt.h +++ b/apache2/msc_crypt.h @@ -35,7 +35,7 @@ struct glinear { }; #define N16BITS_MASK 65536L -#define N16BITS_MASK 0xFFFF +#define N16BITS_MAX 0xFFFF #define N15BITS_MASK 0x7FFF #define N31BITS_MASK 0x7FFFFFFF From 4ab785c192215b0df0879df856c5e1ec4655f977 Mon Sep 17 00:00:00 2001 From: brenosilva Date: Fri, 15 Jun 2012 19:27:59 +0000 Subject: [PATCH 07/64] Fix PRNG code and windows compilation errors --- apache2/apache2_config.c | 5 +++-- apache2/msc_crypt.c | 20 +++----------------- apache2/msc_crypt.h | 7 ------- apache2/msc_tree.h | 33 ++++++++++++++++++++------------- 4 files changed, 26 insertions(+), 39 deletions(-) diff --git a/apache2/apache2_config.c b/apache2/apache2_config.c index 78f46660..13393e5f 100644 --- a/apache2/apache2_config.c +++ b/apache2/apache2_config.c @@ -686,6 +686,7 @@ void init_directory_config(directory_config *dcfg) /* Encryption */ if (dcfg->crypto_key == NOT_SET_P) dcfg->crypto_key = getkey(dcfg->mp); + if (dcfg->crypto_key_len == NOT_SET) dcfg->crypto_key_len = strlen(dcfg->crypto_key); if (dcfg->crypto_key_add == NOT_SET) dcfg->crypto_key_add = ENCRYPTION_KEYONLY; if (dcfg->crypto_param_name == NOT_SET_P) dcfg->crypto_param_name = "crypt"; if (dcfg->encryption_is_enabled == NOT_SET) dcfg->encryption_is_enabled = ENCRYPTION_DISABLED; @@ -2315,9 +2316,9 @@ static const char *cmd_encryption_key(cmd_parms *cmd, void *_dcfg, const char *_ char *p1 = NULL; if (dcfg == NULL) return NULL; + if (_p1 == NULL) return NULL; - if (p1 == NULL) return NULL; - if (strcasecmp(p1, "Rand") == 0) { + if (strcasecmp(_p1, "Rand") == 0) { p1 = apr_pstrdup(cmd->pool, getkey(cmd->pool)); dcfg->crypto_key = p1; dcfg->crypto_key_len = strlen(dcfg->crypto_key); diff --git a/apache2/msc_crypt.c b/apache2/msc_crypt.c index e831f729..1838bf9f 100644 --- a/apache2/msc_crypt.c +++ b/apache2/msc_crypt.c @@ -177,24 +177,10 @@ unsigned long prng() { */ unsigned char *getkey(apr_pool_t *mp) { unsigned short int length = 12; - struct glinear data; - uint64_t seed; - char output[13]; - char *key = NULL; + unsigned char *key = NULL; + unsigned long int seed = time(NULL); - output[length] = '\0'; - - seed = data.seed; - srand(data.seed); - while(length--) { - seed *= data.mul; - seed += data.add; - data.seed = seed % data.mod; - output[length] = (rand() % 94 + 33); - srand(data.seed + prng()); - } - - key = apr_psprintf(mp,"%s",output); + key = apr_psprintf(mp,"%lu%lu",prng(),seed); return key; } diff --git a/apache2/msc_crypt.h b/apache2/msc_crypt.h index 8bd74d6d..bf0cfc8f 100644 --- a/apache2/msc_crypt.h +++ b/apache2/msc_crypt.h @@ -27,13 +27,6 @@ #define INT32_MAX (2147483647) #endif -struct glinear { - uint32_t seed; - uint32_t mod; - uint32_t mul; - uint32_t add; -}; - #define N16BITS_MASK 65536L #define N16BITS_MAX 0xFFFF #define N15BITS_MASK 0x7FFF diff --git a/apache2/msc_tree.h b/apache2/msc_tree.h index 04d96444..7c4d9009 100644 --- a/apache2/msc_tree.h +++ b/apache2/msc_tree.h @@ -16,6 +16,13 @@ #define __MSC_TREE_H__ #include "modsecurity.h" +#include + +typedef struct CPTData CPTData; +typedef struct TreePrefix TreePrefix; +typedef struct TreeNode TreeNode; +typedef struct CPTTree CPTTree; +typedef struct TreeRoot TreeRoot; #define IPV4_TREE 0x1 #define IPV6_TREE 0x2 @@ -37,36 +44,36 @@ #define NETMASK_4 0x4 #define NETMASK_2 0x2 -typedef struct CPTData_ { +struct CPTData { uint8_t netmask; - struct CPTData_ *next; -} CPTData; + struct CPTData *next; +}; -typedef struct TreePrefix_ { +struct TreePrefix { uint8_t *buffer; uint16_t bitlen; CPTData *prefix_data; -} TreePrefix; +}; -typedef struct TreeNode_ { +struct TreeNode { uint16_t bit; int count; uint8_t *netmasks; TreePrefix *prefix; - struct TreeNode_ *left, *right; - struct TreeNode_ *parent; -} TreeNode; + struct TreeNode *left, *right; + struct TreeNode *parent; +}; -typedef struct CPTTree_ { +struct CPTTree { int count; apr_pool_t *pool; TreeNode *head; -} CPTTree; +}; -typedef struct TreeRoot_ { +struct TreeRoot { CPTTree *ipv4_tree; CPTTree *ipv6_tree; -} TreeRoot; +}; DSOLOCAL CPTTree *CPTCreateRadixTree(apr_pool_t *pool); DSOLOCAL TreeNode *CPTIpMatch(modsec_rec *, uint8_t *, CPTTree *, int); From 04fa8bbd0eb4a33e6d59195e1406e09b0000903d Mon Sep 17 00:00:00 2001 From: brenosilva Date: Fri, 15 Jun 2012 19:59:16 +0000 Subject: [PATCH 08/64] Fix windows error compilation --- apache2/msc_tree.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apache2/msc_tree.c b/apache2/msc_tree.c index 0451fab2..3a3cded2 100644 --- a/apache2/msc_tree.c +++ b/apache2/msc_tree.c @@ -16,7 +16,9 @@ #include #include #include +#if !defined(WIN32) || !defined(WINNT) #include +#endif #include "apr_lib.h" #include "msc_util.h" #include "msc_tree.h" From 22e20c6997c5626cc4a5ab8a9da2c962292c8da8 Mon Sep 17 00:00:00 2001 From: brenosilva Date: Fri, 15 Jun 2012 20:27:21 +0000 Subject: [PATCH 09/64] Fix windows error compilation --- apache2/msc_crypt.c | 1 + apache2/msc_tree.h | 6 +++--- apache2/persist_dbm.c | 2 +- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/apache2/msc_crypt.c b/apache2/msc_crypt.c index 1838bf9f..1ad85dee 100644 --- a/apache2/msc_crypt.c +++ b/apache2/msc_crypt.c @@ -18,6 +18,7 @@ #include "acmp.h" #include "libxml/HTMLtree.h" #include "libxml/uri.h" +#include /** * \brief Normalize path in URI diff --git a/apache2/msc_tree.h b/apache2/msc_tree.h index 7c4d9009..96b9fa57 100644 --- a/apache2/msc_tree.h +++ b/apache2/msc_tree.h @@ -75,8 +75,8 @@ struct TreeRoot { CPTTree *ipv6_tree; }; -DSOLOCAL CPTTree *CPTCreateRadixTree(apr_pool_t *pool); -DSOLOCAL TreeNode *CPTIpMatch(modsec_rec *, uint8_t *, CPTTree *, int); -DSOLOCAL TreeNode *TreeAddIP(const char *, CPTTree *, int); +CPTTree DSOLOCAL *CPTCreateRadixTree(apr_pool_t *pool); +TreeNode DSOLOCAL *CPTIpMatch(modsec_rec *, uint8_t *, CPTTree *, int); +TreeNode DSOLOCAL *TreeAddIP(const char *, CPTTree *, int); #endif /*__MSC_TREE_H__ */ diff --git a/apache2/persist_dbm.c b/apache2/persist_dbm.c index 215ebcda..4bb6a3e1 100644 --- a/apache2/persist_dbm.c +++ b/apache2/persist_dbm.c @@ -586,7 +586,7 @@ int collections_remove_stale(modsec_rec *msr, const char *col_name) { goto error; } - if(strcasestr(col_name,"user") || strcasestr(col_name,"session") || strcasestr(col_name,"resource")) + if(strstr(col_name,"USER") || strstr(col_name,"SESSION") || strstr(col_name, "RESOURCE")) dbm_filename = apr_pstrcat(msr->mp, msr->txcfg->data_dir, "/", msr->txcfg->webappid, "_", col_name, NULL); else dbm_filename = apr_pstrcat(msr->mp, msr->txcfg->data_dir, "/", col_name, NULL); From 780db20398931e31b1e0803bdb825a98b6d32d65 Mon Sep 17 00:00:00 2001 From: brenosilva Date: Fri, 15 Jun 2012 20:44:10 +0000 Subject: [PATCH 10/64] Add inet_pton for windows --- apache2/msc_util.c | 35 +++++++++++++++++++++++++++++++++++ apache2/msc_util.h | 4 ++++ 2 files changed, 39 insertions(+) diff --git a/apache2/msc_util.c b/apache2/msc_util.c index 900da363..f8505eb8 100644 --- a/apache2/msc_util.c +++ b/apache2/msc_util.c @@ -570,6 +570,41 @@ char *file_basename(apr_pool_t *mp, const char *filename) { return d; } +#ifdef WIN32 +int inet_pton(int family, const char *src, void *dst) { + struct addrinfo addr; + struct sockaddr_in *in = NULL; + struct sockaddr_in6 *in6 = NULL; + struct addrinfo *addr_info = NULL; + + memset(&addr, 0, sizeof(struct addrinfo)); + addr.ai_family = family; + + if (getaddrinfo(src, NULL, &addr, &addr_info) != 0) + return -1; + + if (addr_info) { + if (addr_info->ai_family == AF_INET) { + in = (struct sockaddr_in*)addr_info->ai_addr; + memcpy(dst, &in->sin_addr, 4); + } + else if (addr_info->ai_family == AF_INET6) { + in6 = (struct sockaddr_in6*)addr_info->ai_addr; + memcpy(dst, &in6->sin6_addr, 16); + } + else { + freeaddrinfo(addr_info); + return -1; + } + + freeaddrinfo(addr_info); + return 1; + } + + return -1; +} +#endif + /** * */ diff --git a/apache2/msc_util.h b/apache2/msc_util.h index f32cce22..9a7b2fdd 100644 --- a/apache2/msc_util.h +++ b/apache2/msc_util.h @@ -28,6 +28,10 @@ #include "modsecurity.h" #include "re.h" +#if WIN32 +int DSOLOCAL inet_pton(int family, const char *src, void *dst) +#endif + int DSOLOCAL normalize_path_inplace(unsigned char *input, int len, int win, int *changed); int DSOLOCAL parse_boolean(const char *input); From de56a8bcf412b7a57e6f9deb0d259d22146f9ecc Mon Sep 17 00:00:00 2001 From: brenosilva Date: Fri, 15 Jun 2012 20:45:54 +0000 Subject: [PATCH 11/64] Add inet_pton for windows --- apache2/msc_util.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/apache2/msc_util.c b/apache2/msc_util.c index f8505eb8..ac4ecd4f 100644 --- a/apache2/msc_util.c +++ b/apache2/msc_util.c @@ -586,11 +586,13 @@ int inet_pton(int family, const char *src, void *dst) { if (addr_info) { if (addr_info->ai_family == AF_INET) { in = (struct sockaddr_in*)addr_info->ai_addr; - memcpy(dst, &in->sin_addr, 4); + if(in != NULL) + memcpy(dst, &in->sin_addr, 4); } else if (addr_info->ai_family == AF_INET6) { in6 = (struct sockaddr_in6*)addr_info->ai_addr; - memcpy(dst, &in6->sin6_addr, 16); + if(in6 != NULL) + memcpy(dst, &in6->sin6_addr, 16); } else { freeaddrinfo(addr_info); From e2d0715c14cd8150dcb2a776af659f1551998328 Mon Sep 17 00:00:00 2001 From: brenosilva Date: Fri, 15 Jun 2012 20:58:35 +0000 Subject: [PATCH 12/64] Update CHANGES --- CHANGES | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/CHANGES b/CHANGES index a181be40..ef30dac6 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,11 @@ +NN Jun 2012 - 2.7.0-rc2 +------------------- + + * Fix compilation errors unders Windows platform. + + * Fix SecEncryptionKey was not working as expected. + + 08 Jun 2012 - 2.7.0-rc1 ------------------- From 35d97d586908dddca4efb3907af211ee345b9dcd Mon Sep 17 00:00:00 2001 From: brenosilva Date: Sat, 16 Jun 2012 16:31:09 +0000 Subject: [PATCH 13/64] Fix code for windows --- apache2/msc_util.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apache2/msc_util.h b/apache2/msc_util.h index 9a7b2fdd..a7b765d5 100644 --- a/apache2/msc_util.h +++ b/apache2/msc_util.h @@ -28,8 +28,8 @@ #include "modsecurity.h" #include "re.h" -#if WIN32 -int DSOLOCAL inet_pton(int family, const char *src, void *dst) +#ifdef WIN32 +int DSOLOCAL inet_pton(int family, const char *src, void *dst); #endif int DSOLOCAL normalize_path_inplace(unsigned char *input, int len, int win, int *changed); From 81b74ba6334e21502a89865a40bf7ac5d0dbd075 Mon Sep 17 00:00:00 2001 From: brenosilva Date: Sat, 16 Jun 2012 19:33:22 +0000 Subject: [PATCH 14/64] Fix code for windows --- apache2/msc_tree.c | 64 +++++++++++++++++++++--------------------- apache2/msc_tree.h | 17 ++++++----- apache2/msc_util.c | 18 ++++++++++++ apache2/msc_util.h | 2 ++ apache2/re_operators.c | 4 +-- 5 files changed, 62 insertions(+), 43 deletions(-) diff --git a/apache2/msc_tree.c b/apache2/msc_tree.c index 3a3cded2..8dae4e24 100644 --- a/apache2/msc_tree.c +++ b/apache2/msc_tree.c @@ -37,7 +37,7 @@ CPTTree *CPTCreateRadixTree(apr_pool_t *pool) { return tree; } -void ConvertIPNetmask(uint8_t *buffer, uint8_t netmask, uint16_t ip_bitmask) { +void ConvertIPNetmask(unsigned char *buffer, unsigned char netmask, unsigned int ip_bitmask) { int aux = 0, bytes = 0; int mask = 0, mask_bit = 0; @@ -72,7 +72,7 @@ TreeNode *CPTCreateNode(apr_pool_t *pool) { return node; } -CPTData *CPTCreateCPTData(uint8_t netmask, apr_pool_t *pool) { +CPTData *CPTCreateCPTData(unsigned char netmask, apr_pool_t *pool) { CPTData *prefix_data = apr_palloc(pool, sizeof(CPTData)); @@ -87,8 +87,8 @@ CPTData *CPTCreateCPTData(uint8_t netmask, apr_pool_t *pool) { return prefix_data; } -TreePrefix *InsertDataPrefix(TreePrefix *prefix, uint8_t *ipdata, uint16_t ip_bitmask, - uint8_t netmask, apr_pool_t *pool) { +TreePrefix *InsertDataPrefix(TreePrefix *prefix, unsigned char *ipdata, unsigned int ip_bitmask, + unsigned char netmask, apr_pool_t *pool) { if(prefix == NULL) return NULL; @@ -104,8 +104,8 @@ TreePrefix *InsertDataPrefix(TreePrefix *prefix, uint8_t *ipdata, uint16_t ip_bi return prefix; } -TreePrefix *CPTCreatePrefix(uint8_t *ipdata, uint16_t ip_bitmask, - uint8_t netmask, apr_pool_t *pool) { +TreePrefix *CPTCreatePrefix(unsigned char *ipdata, unsigned int ip_bitmask, + unsigned char netmask, apr_pool_t *pool) { TreePrefix *prefix = NULL; int bytes = ip_bitmask/8; @@ -162,7 +162,7 @@ void CPTAppendToCPTDataList(CPTData *new, CPTData **list) { return; } -int TreePrefixContainNetmask(TreePrefix *prefix, uint8_t netmask) { +int TreePrefixContainNetmask(TreePrefix *prefix, unsigned char netmask) { CPTData *prefix_data = NULL; if (prefix == NULL) { @@ -179,7 +179,7 @@ int TreePrefixContainNetmask(TreePrefix *prefix, uint8_t netmask) { return 0; } -int CheckBitmask(uint8_t netmask, uint16_t ip_bitmask) { +int CheckBitmask(unsigned char netmask, unsigned int ip_bitmask) { switch(netmask) { @@ -198,7 +198,7 @@ int CheckBitmask(uint8_t netmask, uint16_t ip_bitmask) { return 0; } -TreeNode *CPTCreateHead(TreePrefix *prefix, TreeNode *node, CPTTree *tree, uint8_t netmask, uint16_t ip_bitmask) { +TreeNode *CPTCreateHead(TreePrefix *prefix, TreeNode *node, CPTTree *tree, unsigned char netmask, unsigned int ip_bitmask) { if(tree == NULL) return NULL; @@ -216,7 +216,7 @@ TreeNode *CPTCreateHead(TreePrefix *prefix, TreeNode *node, CPTTree *tree, uint8 return node; node->count++; - node->netmasks = apr_palloc(tree->pool, (node->count * sizeof(uint8_t))); + node->netmasks = apr_palloc(tree->pool, (node->count * sizeof(unsigned char))); if(node->netmasks) node->netmasks[0] = netmask; @@ -243,7 +243,7 @@ TreeNode *SetParentNode(TreeNode *node, TreeNode *new_node, CPTTree *tree) { } int InsertNetmask(TreeNode *node, TreeNode *parent, TreeNode *new_node, - CPTTree *tree, uint8_t netmask, uint8_t bitlen) { + CPTTree *tree, unsigned char netmask, unsigned char bitlen) { int i; if (netmask != NETMASK_256-1 && netmask != NETMASK_128) { @@ -258,7 +258,7 @@ int InsertNetmask(TreeNode *node, TreeNode *parent, TreeNode *new_node, } node->count++; - node->netmasks = apr_palloc(tree->pool, (node->count * sizeof(uint8_t))); + node->netmasks = apr_palloc(tree->pool, (node->count * sizeof(unsigned char))); if(node->netmasks == NULL) return 0; @@ -286,12 +286,12 @@ int InsertNetmask(TreeNode *node, TreeNode *parent, TreeNode *new_node, return 0; } -TreeNode *CPTAddElement(uint8_t *ipdata, uint16_t ip_bitmask, CPTTree *tree, uint8_t netmask) { - uint8_t *buffer = NULL; - uint8_t bitlen = 0; +TreeNode *CPTAddElement(unsigned char *ipdata, unsigned int ip_bitmask, CPTTree *tree, unsigned char netmask) { + unsigned char *buffer = NULL; + unsigned char bitlen = 0; int bit_validation = 0, test_bit = 0; int i = 0, j = 0, temp = 0; - uint16_t x, y; + unsigned int x, y; TreeNode *node = NULL, *new_node = NULL; TreeNode *parent = NULL, *i_node = NULL; TreeNode *bottom_node = NULL; @@ -407,7 +407,7 @@ TreeNode *CPTAddElement(uint8_t *ipdata, uint16_t ip_bitmask, CPTTree *tree, uin node->count++; new_node = node; - node->netmasks = apr_palloc(tree->pool, (node->count * sizeof(uint8_t))); + node->netmasks = apr_palloc(tree->pool, (node->count * sizeof(unsigned char))); if ((node->count -1) == 0) { node->netmasks[0] = netmask; @@ -474,7 +474,7 @@ TreeNode *CPTAddElement(uint8_t *ipdata, uint16_t ip_bitmask, CPTTree *tree, uin i++; } - i_node->netmasks = apr_palloc(tree->pool, (node->count - i) * sizeof(uint8_t)); + i_node->netmasks = apr_palloc(tree->pool, (node->count - i) * sizeof(unsigned char)); if(i_node->netmasks == NULL) { return NULL; @@ -514,7 +514,7 @@ TreeNode *CPTAddElement(uint8_t *ipdata, uint16_t ip_bitmask, CPTTree *tree, uin return new_node; } -int TreeCheckData(TreePrefix *prefix, CPTData *prefix_data, uint16_t netmask) { +int TreeCheckData(TreePrefix *prefix, CPTData *prefix_data, unsigned int netmask) { for(prefix_data != NULL; ; prefix_data = prefix_data->next) { if (prefix_data->netmask == netmask) { @@ -525,7 +525,7 @@ int TreeCheckData(TreePrefix *prefix, CPTData *prefix_data, uint16_t netmask) return 0; } -int TreePrefixNetmask(modsec_rec *msr, TreePrefix *prefix, uint16_t netmask, int flag) { +int TreePrefixNetmask(modsec_rec *msr, TreePrefix *prefix, unsigned int netmask, int flag) { CPTData *prefix_data = NULL; int ret = 0; @@ -564,8 +564,8 @@ int TreePrefixNetmask(modsec_rec *msr, TreePrefix *prefix, uint16_t netmask, int return ret; } -TreeNode *CPTRetriveNode(modsec_rec *msr, uint8_t *buffer, uint16_t ip_bitmask, TreeNode *node) { - uint16_t x, y; +TreeNode *CPTRetriveNode(modsec_rec *msr, unsigned char *buffer, unsigned int ip_bitmask, TreeNode *node) { + unsigned int x, y; if(node == NULL) { if (msr->txcfg->debuglog_level >= 9) { @@ -610,7 +610,7 @@ TreeNode *CPTRetriveParentNode(TreeNode *node) { return node; } -TreeNode *CPTFindElementIPNetblock(modsec_rec *msr, uint8_t *ipdata, uint8_t ip_bitmask, TreeNode *node) { +TreeNode *CPTFindElementIPNetblock(modsec_rec *msr, unsigned char *ipdata, unsigned char ip_bitmask, TreeNode *node) { TreeNode *netmask_node = NULL; int mask = 0, bytes = 0; int i = 0, j = 0; @@ -690,10 +690,10 @@ TreeNode *CPTFindElementIPNetblock(modsec_rec *msr, uint8_t *ipdata, uint8_t ip_ return CPTFindElementIPNetblock(msr, ipdata, ip_bitmask, netmask_node->parent); } -TreeNode *CPTFindElement(modsec_rec *msr, uint8_t *ipdata, uint16_t ip_bitmask, CPTTree *tree) { +TreeNode *CPTFindElement(modsec_rec *msr, unsigned char *ipdata, unsigned int ip_bitmask, CPTTree *tree) { TreeNode *node = NULL; int mask = 0, bytes = 0; - uint8_t temp_data[NETMASK_256-1]; + unsigned char temp_data[NETMASK_256-1]; if (tree == NULL) { if (msr->txcfg->debuglog_level >= 9) { @@ -771,7 +771,7 @@ TreeNode *CPTFindElement(modsec_rec *msr, uint8_t *ipdata, uint16_t ip_bitmask, return CPTFindElementIPNetblock(msr, temp_data, ip_bitmask, node); } -TreeNode *CPTIpMatch(modsec_rec *msr, uint8_t *ipdata, CPTTree *tree, int type) { +TreeNode *CPTIpMatch(modsec_rec *msr, unsigned char *ipdata, CPTTree *tree, int type) { if(tree == NULL) { if (msr->txcfg->debuglog_level >= 9) { @@ -807,8 +807,8 @@ TreeNode *CPTIpMatch(modsec_rec *msr, uint8_t *ipdata, CPTTree *tree, int type) } TreeNode *TreeAddIP(const char *buffer, CPTTree *tree, int type) { - uint32_t ip, ret; - uint8_t netmask_v4 = NETMASK_32, netmask_v6 = NETMASK_128; + unsigned long ip, ret; + unsigned char netmask_v4 = NETMASK_32, netmask_v6 = NETMASK_128; char ip_strv4[NETMASK_32], ip_strv6[NETMASK_128]; struct in_addr addr4; struct in6_addr addr6; @@ -820,7 +820,7 @@ TreeNode *TreeAddIP(const char *buffer, CPTTree *tree, int type) { switch(type) { case IPV4_TREE: - bzero(&addr4, sizeof(addr4)); + memset(&addr4, 0, sizeof(addr4)); memset(ip_strv4, 0x0, NETMASK_32); strncpy(ip_strv4, buffer, sizeof(ip_strv4) - 2); @@ -849,10 +849,10 @@ TreeNode *TreeAddIP(const char *buffer, CPTTree *tree, int type) { tree->count++; - return CPTAddElement((uint8_t *)&ip, NETMASK_32, tree, netmask_v4); + return CPTAddElement((unsigned char *)&ip, NETMASK_32, tree, netmask_v4); case IPV6_TREE: - bzero(&addr6, sizeof(addr6)); + memset(&addr6, 0, sizeof(addr6)); memset(ip_strv6, 0x0, NETMASK_128); strncpy(ip_strv6, buffer, sizeof(ip_strv6) - 2); @@ -878,7 +878,7 @@ TreeNode *TreeAddIP(const char *buffer, CPTTree *tree, int type) { tree->count++; - return CPTAddElement((uint8_t *)&addr6.s6_addr, NETMASK_128, tree, netmask_v6); + return CPTAddElement((unsigned char *)&addr6.s6_addr, NETMASK_128, tree, netmask_v6); default: return NULL; } diff --git a/apache2/msc_tree.h b/apache2/msc_tree.h index 96b9fa57..6bda085f 100644 --- a/apache2/msc_tree.h +++ b/apache2/msc_tree.h @@ -16,7 +16,6 @@ #define __MSC_TREE_H__ #include "modsecurity.h" -#include typedef struct CPTData CPTData; typedef struct TreePrefix TreePrefix; @@ -45,20 +44,20 @@ typedef struct TreeRoot TreeRoot; #define NETMASK_2 0x2 struct CPTData { - uint8_t netmask; + unsigned char netmask; struct CPTData *next; }; struct TreePrefix { - uint8_t *buffer; - uint16_t bitlen; + unsigned char *buffer; + unsigned int bitlen; CPTData *prefix_data; }; struct TreeNode { - uint16_t bit; + unsigned int bit; int count; - uint8_t *netmasks; + unsigned char *netmasks; TreePrefix *prefix; struct TreeNode *left, *right; struct TreeNode *parent; @@ -75,8 +74,8 @@ struct TreeRoot { CPTTree *ipv6_tree; }; -CPTTree DSOLOCAL *CPTCreateRadixTree(apr_pool_t *pool); -TreeNode DSOLOCAL *CPTIpMatch(modsec_rec *, uint8_t *, CPTTree *, int); -TreeNode DSOLOCAL *TreeAddIP(const char *, CPTTree *, int); +CPTTree DSOLOCAL *CPTCreateRadixTree(apr_pool_t *pool); +TreeNode DSOLOCAL *CPTIpMatch(modsec_rec *msr, unsigned char *ipdata, CPTTree *tree, int type); +TreeNode DSOLOCAL *TreeAddIP(const char *buffer, CPTTree *tree, int type); #endif /*__MSC_TREE_H__ */ diff --git a/apache2/msc_util.c b/apache2/msc_util.c index ac4ecd4f..a3ecc701 100644 --- a/apache2/msc_util.c +++ b/apache2/msc_util.c @@ -571,6 +571,24 @@ char *file_basename(apr_pool_t *mp, const char *filename) { } #ifdef WIN32 +char *strcasestr(const char *haystack, const char *needle) { + char aux, lower_aux; + int length; + + if ((aux = *needle++) != 0) { + aux = (char)tolower((unsigned char)aux); + length = strlen(needle); + do { + do { + if ((lower_aux = *haystack++) == 0) + return NULL; + } while ((char)tolower((unsigned char)lower_aux) != aux); + } while (strncasecmp(haystack, needle, length) != 0); + haystack--; + } + return ((char *)haystack); +} + int inet_pton(int family, const char *src, void *dst) { struct addrinfo addr; struct sockaddr_in *in = NULL; diff --git a/apache2/msc_util.h b/apache2/msc_util.h index a7b765d5..80c8cadf 100644 --- a/apache2/msc_util.h +++ b/apache2/msc_util.h @@ -29,7 +29,9 @@ #include "re.h" #ifdef WIN32 +#include int DSOLOCAL inet_pton(int family, const char *src, void *dst); +char DSOLOCAL *strcasestr(const char *haystack, const char *needle); #endif int DSOLOCAL normalize_path_inplace(unsigned char *input, int len, int win, int *changed); diff --git a/apache2/re_operators.c b/apache2/re_operators.c index 86d91dc8..f12a8c96 100644 --- a/apache2/re_operators.c +++ b/apache2/re_operators.c @@ -333,7 +333,7 @@ static int msre_op_ipmatchFromFile_execute(modsec_rec *msr, msre_rule *rule, msr return 0; } - if (CPTIpMatch(msr, (uint8_t *)&in.s_addr, rtree->ipv4_tree, IPV4_TREE) != NULL) { + if (CPTIpMatch(msr, (unsigned char *)&in.s_addr, rtree->ipv4_tree, IPV4_TREE) != NULL) { *error_msg = apr_psprintf(msr->mp, "IPmatchFromFile \"%s\" matched at %s.", var->value, var->name); return 1; } @@ -347,7 +347,7 @@ static int msre_op_ipmatchFromFile_execute(modsec_rec *msr, msre_rule *rule, msr return 0; } - if (CPTIpMatch(msr, (uint8_t *)&in6.s6_addr, rtree->ipv6_tree, IPV6_TREE) != NULL) { + if (CPTIpMatch(msr, (unsigned char *)&in6.s6_addr, rtree->ipv6_tree, IPV6_TREE) != NULL) { *error_msg = apr_psprintf(msr->mp, "IPmatchFromFile \"%s\" matched at %s.", var->value, var->name); return 1; } From 21be05c7fa674ed57342769ec54cc9555883275b Mon Sep 17 00:00:00 2001 From: brenosilva Date: Sat, 16 Jun 2012 19:41:18 +0000 Subject: [PATCH 15/64] change release to 2.7.0-rc2 --- apache2/msc_release.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apache2/msc_release.h b/apache2/msc_release.h index b99585fc..b2dbc9aa 100644 --- a/apache2/msc_release.h +++ b/apache2/msc_release.h @@ -40,7 +40,7 @@ #define MODSEC_VERSION_MINOR "7" #define MODSEC_VERSION_MAINT "0" #define MODSEC_VERSION_TYPE "-rc" -#define MODSEC_VERSION_RELEASE "1" +#define MODSEC_VERSION_RELEASE "2" #define MODSEC_VERSION_SUFFIX MODSEC_VERSION_TYPE MODSEC_VERSION_RELEASE From 3bb931e18818e1432ea88269b468a42dda1dfd0a Mon Sep 17 00:00:00 2001 From: brenosilva Date: Sun, 17 Jun 2012 13:32:07 +0000 Subject: [PATCH 16/64] Fix warnings --- apache2/modsecurity.h | 2 +- apache2/msc_crypt.c | 47 ++++++++++++++++++----------------- apache2/msc_crypt.h | 8 +++--- apache2/msc_multipart.c | 2 +- apache2/msc_release.h | 2 +- apache2/msc_tree.h | 4 +-- apache2/re.c | 4 +-- apache2/re_actions.c | 4 +++ apache2/re_operators.c | 55 ++++++++++++++++++++++++++++++++--------- 9 files changed, 82 insertions(+), 46 deletions(-) diff --git a/apache2/modsecurity.h b/apache2/modsecurity.h index 30661a8f..81317d18 100644 --- a/apache2/modsecurity.h +++ b/apache2/modsecurity.h @@ -569,7 +569,7 @@ struct directory_config { /* Encryption */ apr_array_header_t *encryption_method; - const char *crypto_key; + const char *crypto_key; int crypto_key_len; const char *crypto_param_name; int encryption_is_enabled; diff --git a/apache2/msc_crypt.c b/apache2/msc_crypt.c index 1ad85dee..49cfe51c 100644 --- a/apache2/msc_crypt.c +++ b/apache2/msc_crypt.c @@ -70,7 +70,7 @@ char *normalize_path(modsec_rec *msr, char *input) { xmlNormalizeURIPath(uri->path); Uri = apr_pstrdup(msr->mp, uri->path); - for(i = 0; i < strlen(Uri); i++) { + for(i = 0; i < (int)strlen(Uri); i++) { if(Uri[i] != '.' && Uri[i] != '/') { if (i - 1 < 0) i = 0; @@ -84,7 +84,7 @@ char *normalize_path(modsec_rec *msr, char *input) { } } - if(bytes >= strlen(uri->path)) + if(bytes >= (int)strlen(uri->path)) return NULL; content = apr_psprintf(msr->mp, "%s", uri->path+bytes); @@ -126,8 +126,8 @@ unsigned long prng() { short num_matrix1[10], num_matrix2[10]; unsigned long num, num1, num2; short n, *p; - unsigned short seed_num; - unsigned long seed; + unsigned short seed_num = 0; + unsigned long seed = 0; seed_num = seed & N16BITS_MAX; num = seed & N31BITS_MASK; @@ -176,9 +176,8 @@ unsigned long prng() { * * \retval key random key */ -unsigned char *getkey(apr_pool_t *mp) { - unsigned short int length = 12; - unsigned char *key = NULL; +char *getkey(apr_pool_t *mp) { + char *key = NULL; unsigned long int seed = time(NULL); key = apr_psprintf(mp,"%lu%lu",prng(),seed); @@ -197,8 +196,8 @@ unsigned char *getkey(apr_pool_t *mp) { * * \retval hex_digest The MAC */ -char *hmac(modsec_rec *msr, const unsigned char *key, int key_len, - char *msg, int msglen) { +char *hmac(modsec_rec *msr, const char *key, int key_len, + unsigned char *msg, int msglen) { apr_sha1_ctx_t ctx; unsigned char digest[APR_SHA1_DIGESTSIZE]; unsigned char hmac_ipad[HMAC_PAD_SIZE], hmac_opad[HMAC_PAD_SIZE]; @@ -294,7 +293,7 @@ int init_response_body_html_parser(modsec_rec *msr) { msr_log(msr, 4, "init_response_body_html_parser: assuming ISO-8859-1."); msr->crypto_html_tree = htmlReadMemory(msr->resbody_data, msr->resbody_length, NULL, "ISO-8859-1", HTML_PARSE_RECOVER | HTML_PARSE_NOBLANKS | HTML_PARSE_NOERROR | HTML_PARSE_NOWARNING); - htmlSetMetaEncoding ((htmlDocPtr) msr->crypto_html_tree, "ISO-8859-1"); + htmlSetMetaEncoding ((htmlDocPtr) msr->crypto_html_tree, (const xmlChar *) "ISO-8859-1"); } else{ charset+=8; @@ -310,7 +309,7 @@ int init_response_body_html_parser(modsec_rec *msr) { "init_response_body_html_parser: Charset[%s]",charset); msr->crypto_html_tree = htmlReadMemory(msr->resbody_data, msr->resbody_length, NULL, charset, HTML_PARSE_RECOVER| HTML_PARSE_NOBLANKS | HTML_PARSE_NOERROR | HTML_PARSE_NOWARNING); - htmlSetMetaEncoding ((htmlDocPtr) msr->crypto_html_tree, charset); + htmlSetMetaEncoding ((htmlDocPtr) msr->crypto_html_tree, (const xmlChar *)charset); if(final_charset != NULL) *final_charset=sep; } @@ -320,7 +319,7 @@ int init_response_body_html_parser(modsec_rec *msr) { msr_log(msr, 4,"init_response_body_html_parser: Enconding[%s].",msr->r->content_encoding); msr->crypto_html_tree = htmlReadMemory(msr->resbody_data, msr->resbody_length, NULL, msr->r->content_encoding, HTML_PARSE_RECOVER | HTML_PARSE_NOBLANKS | HTML_PARSE_NOERROR | HTML_PARSE_NOWARNING); - htmlSetMetaEncoding ((htmlDocPtr) msr->crypto_html_tree, msr->r->content_encoding); + htmlSetMetaEncoding ((htmlDocPtr) msr->crypto_html_tree, (const xmlChar *)msr->r->content_encoding); } if(msr->crypto_html_tree == NULL){ if (msr->txcfg->debuglog_level >= 4) @@ -356,7 +355,6 @@ int do_encryption_method(modsec_rec *msr, char *link, int type) { char *my_error_msg = NULL; int ovector[33]; int rc; - const char *ret; if(msr == NULL) return -1; @@ -997,8 +995,7 @@ int inject_encrypted_response_body(modsec_rec *msr, int elts) { char *p = NULL; const char *ctype = NULL; const char *encoding = NULL; - char* new_ct = NULL; - int rc = 0; + char *new_ct = NULL, *content_value = NULL; if(msr == NULL) return -1; @@ -1081,7 +1078,7 @@ int inject_encrypted_response_body(modsec_rec *msr, int elts) { } msr->stream_output_length = output_buf->buffer->use; - msr->stream_output_data = (unsigned char *)malloc(msr->stream_output_length+1); + msr->stream_output_data = (char *)malloc(msr->stream_output_length+1); if (msr->stream_output_data == NULL) { xmlOutputBufferClose(output_buf); @@ -1110,7 +1107,7 @@ int inject_encrypted_response_body(modsec_rec *msr, int elts) { } msr->stream_output_length = output_buf->conv->use; - msr->stream_output_data = (unsigned char *)malloc(msr->stream_output_length+1); + msr->stream_output_data = (char *)malloc(msr->stream_output_length+1); if (msr->stream_output_data == NULL) { xmlOutputBufferClose(output_buf); @@ -1128,8 +1125,12 @@ int inject_encrypted_response_body(modsec_rec *msr, int elts) { xmlOutputBufferClose(output_buf); + content_value = (char*)apr_psprintf(msr->mp, "%"APR_SIZE_T_FMT, msr->stream_output_length); apr_table_unset(msr->r->headers_out,"Content-Length"); - apr_table_set(msr->r->headers_out, "Content-Length",(char*)apr_psprintf(msr->mp, APR_SIZE_T_FMT, msr->stream_output_length)); + + if (msr->txcfg->debuglog_level >= 4) + msr_log(msr, 4, "inject_encrypted_response_body: Setting new content value %s", content_value); + apr_table_set(msr->r->headers_out, "Content-Length", content_value); xmlFreeDoc(msr->crypto_html_tree); @@ -1149,10 +1150,10 @@ int inject_encrypted_response_body(modsec_rec *msr, int elts) { * \retval mac_link MACed link * \retval NULL on fail */ -unsigned char *do_hash_link(modsec_rec *msr, char *link, int type) { - unsigned char *mac_link = NULL; +char *do_hash_link(modsec_rec *msr, char *link, int type) { + char *mac_link = NULL; char *path_chunk = NULL; - unsigned char *hash_value = NULL; + char *hash_value = NULL; char *qm = NULL; if(msr == NULL) return NULL; @@ -1339,10 +1340,10 @@ unsigned char *do_hash_link(modsec_rec *msr, char *link, int type) { qm = strchr((char*)link,'?'); if(qm == NULL){ - mac_link= (unsigned char*)apr_psprintf(msr->mp, "%s?%s=%s", link, msr->txcfg->crypto_param_name, (char *)hash_value); + mac_link= (char*)apr_psprintf(msr->mp, "%s?%s=%s", link, msr->txcfg->crypto_param_name, (char *)hash_value); } else{ - mac_link= (unsigned char*)apr_psprintf(msr->mp, "%s&%s=%s", link, msr->txcfg->crypto_param_name, (char*)hash_value); + mac_link= (char*)apr_psprintf(msr->mp, "%s&%s=%s", link, msr->txcfg->crypto_param_name, (char*)hash_value); } return mac_link; diff --git a/apache2/msc_crypt.h b/apache2/msc_crypt.h index bf0cfc8f..94bb9931 100644 --- a/apache2/msc_crypt.h +++ b/apache2/msc_crypt.h @@ -32,11 +32,11 @@ #define N15BITS_MASK 0x7FFF #define N31BITS_MASK 0x7FFFFFFF -char DSOLOCAL *hmac(modsec_rec *msr,const unsigned char *key, int key_len, - char *msg, int msglen); -unsigned char DSOLOCAL *do_hash_link(modsec_rec *msr, char *link, +char DSOLOCAL *hmac(modsec_rec *msr, const char *key, int key_len, + unsigned char *msg, int msglen); +char DSOLOCAL *do_hash_link(modsec_rec *msr, char *link, int type); -unsigned char DSOLOCAL *getkey(apr_pool_t *mp); +char DSOLOCAL *getkey(apr_pool_t *mp); int DSOLOCAL init_response_body_html_parser(modsec_rec *msr); int DSOLOCAL encrypt_response_body_links(modsec_rec *msr); diff --git a/apache2/msc_multipart.c b/apache2/msc_multipart.c index 35eb6174..ae518953 100644 --- a/apache2/msc_multipart.c +++ b/apache2/msc_multipart.c @@ -20,7 +20,7 @@ #include "msc_util.h" #include "msc_parsers.h" -void validate_quotes(modsec_rec *msr, unsigned char *data) { +void validate_quotes(modsec_rec *msr, char *data) { int i, len; if(msr == NULL) diff --git a/apache2/msc_release.h b/apache2/msc_release.h index b2dbc9aa..b99585fc 100644 --- a/apache2/msc_release.h +++ b/apache2/msc_release.h @@ -40,7 +40,7 @@ #define MODSEC_VERSION_MINOR "7" #define MODSEC_VERSION_MAINT "0" #define MODSEC_VERSION_TYPE "-rc" -#define MODSEC_VERSION_RELEASE "2" +#define MODSEC_VERSION_RELEASE "1" #define MODSEC_VERSION_SUFFIX MODSEC_VERSION_TYPE MODSEC_VERSION_RELEASE diff --git a/apache2/msc_tree.h b/apache2/msc_tree.h index 6bda085f..a6df488f 100644 --- a/apache2/msc_tree.h +++ b/apache2/msc_tree.h @@ -31,8 +31,8 @@ typedef struct TreeRoot TreeRoot; #define TREE_CHECK(x, y) ((x) & (y)) #define MASK_BITS(x) ((x + 1) * 8) -#define SHIFT_LEFT_MASK(x) (-1 << x) -#define SHIFT_RIGHT_MASK(x,y) (x >> y) +#define SHIFT_LEFT_MASK(x) ((-1) << (x)) +#define SHIFT_RIGHT_MASK(x,y) ((x) >> (y)) #define NETMASK_256 0x100 #define NETMASK_128 0x80 diff --git a/apache2/re.c b/apache2/re.c index 677bef08..1b94fffe 100644 --- a/apache2/re.c +++ b/apache2/re.c @@ -1459,7 +1459,7 @@ static apr_status_t msre_ruleset_process_phase_(msre_ruleset *ruleset, modsec_re int do_process = 1; const char *range = NULL; rule_exception *re = NULL; - char *my_error_msg, *error_msg; + char *my_error_msg; const apr_array_header_t *tag_tarr = NULL; const apr_table_entry_t *tag_telts = NULL; @@ -2165,7 +2165,7 @@ msre_rule *msre_rule_create(msre_ruleset *ruleset, int type, msre_rule *rule; char *my_error_msg; const char *argsp; - int rc, idx; + int rc; if (error_msg == NULL) return NULL; *error_msg = NULL; diff --git a/apache2/re_actions.c b/apache2/re_actions.c index 5b114905..92257129 100644 --- a/apache2/re_actions.c +++ b/apache2/re_actions.c @@ -990,6 +990,7 @@ static apr_status_t msre_action_ctl_execute(modsec_rec *msr, apr_pool_t *mptmp, if (msr->txcfg->debuglog_level >= 4) { msr_log(msr, 4, "Ctl: Set EncryptionEnforcement to %s.", value); } + return 1; } else if (strcasecmp(name, "EncryptionEngine") == 0) { if (strcasecmp(value, "on") == 0) { @@ -1003,6 +1004,7 @@ static apr_status_t msre_action_ctl_execute(modsec_rec *msr, apr_pool_t *mptmp, if (msr->txcfg->debuglog_level >= 4) { msr_log(msr, 4, "Ctl: Set EncryptionEngine to %s.", value); } + return 1; } else if (strcasecmp(name, "ruleRemoveById") == 0) { *(const char **)apr_array_push(msr->removed_rules) = (const char *)apr_pstrdup(msr->mp, value); @@ -1274,6 +1276,8 @@ static apr_status_t msre_action_ctl_execute(modsec_rec *msr, apr_pool_t *mptmp, msr_log(msr, 1, "Internal Error: Unknown ctl action \"%s\".", name); return -1; } + + return -1; } /* xmlns */ diff --git a/apache2/re_operators.c b/apache2/re_operators.c index f12a8c96..39bf5ad1 100644 --- a/apache2/re_operators.c +++ b/apache2/re_operators.c @@ -304,8 +304,6 @@ static int msre_op_ipmatchFromFile_param_init(msre_rule *rule, char **error_msg) static int msre_op_ipmatchFromFile_execute(modsec_rec *msr, msre_rule *rule, msre_var *var, char **error_msg) { TreeRoot *rtree = rule->op_param_data; - TreeNode *node; - apr_sockaddr_t *sa; struct in_addr in; struct in6_addr in6; @@ -736,7 +734,11 @@ static int msre_op_validateEncryption_param_init(msre_rule *rule, char **error_m int erroffset; msc_regex_t *regex; const char *pattern = rule->op_param; + #ifdef WITH_PCRE_STUDY + #ifdef WITH_PCRE_JIT int rc, jit; + #endif + #endif if (error_msg == NULL) return -1; *error_msg = NULL; @@ -795,10 +797,14 @@ static int msre_op_validateEncryption_execute(modsec_rec *msr, msre_rule *rule, unsigned int target_length; char *my_error_msg = NULL; int ovector[33]; - int rc, jit; - char *qspos = NULL; - const char *parm = NULL, *pattern = NULL; - msc_parm *mparm = NULL; + int rc; + const char *pattern = NULL; + #ifdef WITH_PCRE_STUDY + #ifdef WITH_PCRE_JIT + int jit; + #endif + #endif + if (error_msg == NULL) return -1; *error_msg = NULL; @@ -968,7 +974,11 @@ static int msre_op_rx_param_init(msre_rule *rule, char **error_msg) { int erroffset; msc_regex_t *regex; const char *pattern = rule->op_param; + #ifdef WITH_PCRE_STUDY + #ifdef WITH_PCRE_JIT int rc, jit; + #endif + #endif if (error_msg == NULL) return -1; *error_msg = NULL; @@ -1019,10 +1029,16 @@ static int msre_op_rx_execute(modsec_rec *msr, msre_rule *rule, msre_var *var, c int capture = 0; int matched_bytes = 0; int matched = 0; - int rc, jit; + int rc; char *qspos = NULL; const char *parm = NULL, *pattern = NULL; msc_parm *mparm = NULL; + #ifdef WITH_PCRE_STUDY + #ifdef WITH_PCRE_JIT + int jit; + #endif + #endif + if (error_msg == NULL) return -1; *error_msg = NULL; @@ -2644,14 +2660,18 @@ static int msre_op_verifyCC_execute(modsec_rec *msr, msre_rule *rule, msre_var * unsigned int target_length; char *my_error_msg = NULL; int ovector[33]; - int rc, jit; + int rc; int is_cc = 0; int offset; int matched_bytes = 0; char *qspos = NULL; const char *parm = NULL; msc_parm *mparm = NULL; - + #ifdef WITH_PCRE_STUDY + #ifdef WITH_PCRE_JIT + int jit; + #endif + #endif if (error_msg == NULL) return -1; *error_msg = NULL; @@ -2946,13 +2966,19 @@ static int msre_op_verifyCPF_execute(modsec_rec *msr, msre_rule *rule, msre_var unsigned int target_length; char *my_error_msg = NULL; int ovector[33]; - int rc, jit; + int rc; int is_cpf = 0; int offset; int matched_bytes = 0; char *qspos = NULL; const char *parm = NULL; msc_parm *mparm = NULL; + #ifdef WITH_PCRE_STUDY + #ifdef WITH_PCRE_JIT + int jit; + #endif + #endif + if (error_msg == NULL) return -1; *error_msg = NULL; @@ -3235,13 +3261,19 @@ static int msre_op_verifySSN_execute(modsec_rec *msr, msre_rule *rule, msre_var unsigned int target_length; char *my_error_msg = NULL; int ovector[33]; - int rc, jit; + int rc; int is_ssn = 0; int offset; int matched_bytes = 0; char *qspos = NULL; const char *parm = NULL; msc_parm *mparm = NULL; + #ifdef WITH_PCRE_STUDY + #ifdef WITH_PCRE_JIT + int jit; + #endif + #endif + if (error_msg == NULL) return -1; *error_msg = NULL; @@ -3534,7 +3566,6 @@ static int msre_op_rbl_execute(modsec_rec *msr, msre_rule *rule, msre_var *var, unsigned int high8bits = 0; char *name_to_check = NULL; char *target = NULL; - char *target2 = NULL; apr_sockaddr_t *sa = NULL; apr_status_t rc; int capture = 0; From c22376aa5bea19a9531d5bc2285b88dacdeba153 Mon Sep 17 00:00:00 2001 From: brenosilva Date: Sun, 17 Jun 2012 13:49:33 +0000 Subject: [PATCH 17/64] Fix warnings --- apache2/msc_tree.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/apache2/msc_tree.c b/apache2/msc_tree.c index 8dae4e24..6dab16fc 100644 --- a/apache2/msc_tree.c +++ b/apache2/msc_tree.c @@ -18,6 +18,7 @@ #include #if !defined(WIN32) || !defined(WINNT) #include +#include #endif #include "apr_lib.h" #include "msc_util.h" @@ -171,9 +172,10 @@ int TreePrefixContainNetmask(TreePrefix *prefix, unsigned char netmask) { prefix_data = prefix->prefix_data; - for(prefix_data != NULL; ; prefix_data = prefix_data->next) { + while (prefix_data != NULL) { if (prefix_data->netmask == netmask) return 1; + prefix_data = prefix_data->next; } return 0; @@ -386,9 +388,10 @@ TreeNode *CPTAddElement(unsigned char *ipdata, unsigned int ip_bitmask, CPTTree prefix_data = node->prefix->prefix_data; - for(prefix_data != NULL; ; prefix_data = prefix_data->next) { + while(prefix_data != NULL) { if (prefix_data->netmask == netmask) ++found; + prefix_data = prefix_data->next; } if (found != 0) { @@ -516,10 +519,11 @@ TreeNode *CPTAddElement(unsigned char *ipdata, unsigned int ip_bitmask, CPTTree int TreeCheckData(TreePrefix *prefix, CPTData *prefix_data, unsigned int netmask) { - for(prefix_data != NULL; ; prefix_data = prefix_data->next) { + while(prefix_data != NULL) { if (prefix_data->netmask == netmask) { return 1; } + prefix_data = prefix_data->next; } return 0; From 245f6dc61958ce0f9e3949997a1c0ea0097c9912 Mon Sep 17 00:00:00 2001 From: brenosilva Date: Fri, 22 Jun 2012 03:15:49 +0000 Subject: [PATCH 18/64] Release 2.7.0-rc2 --- CHANGES | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/CHANGES b/CHANGES index ef30dac6..d8f1604a 100644 --- a/CHANGES +++ b/CHANGES @@ -1,10 +1,9 @@ -NN Jun 2012 - 2.7.0-rc2 +22 Jun 2012 - 2.7.0-rc2 ------------------- - * Fix compilation errors unders Windows platform. - - * Fix SecEncryptionKey was not working as expected. + * Fixed compilation errors and warnings under Windows platform. + * Fixed SecEncryptionKey was not working as expected. 08 Jun 2012 - 2.7.0-rc1 ------------------- From 21e21b23a4666cc06d76be9dbafef25be3ebbc6d Mon Sep 17 00:00:00 2001 From: brenosilva Date: Fri, 22 Jun 2012 03:16:16 +0000 Subject: [PATCH 19/64] Release 2.7.0-rc2 --- apache2/msc_release.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apache2/msc_release.h b/apache2/msc_release.h index b99585fc..b2dbc9aa 100644 --- a/apache2/msc_release.h +++ b/apache2/msc_release.h @@ -40,7 +40,7 @@ #define MODSEC_VERSION_MINOR "7" #define MODSEC_VERSION_MAINT "0" #define MODSEC_VERSION_TYPE "-rc" -#define MODSEC_VERSION_RELEASE "1" +#define MODSEC_VERSION_RELEASE "2" #define MODSEC_VERSION_SUFFIX MODSEC_VERSION_TYPE MODSEC_VERSION_RELEASE From 3a05349e0afd0faed9c69c6584afe2b002748b73 Mon Sep 17 00:00:00 2001 From: brenosilva Date: Fri, 22 Jun 2012 12:58:46 +0000 Subject: [PATCH 20/64] Fix setting key len for child conf --- apache2/apache2_config.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/apache2/apache2_config.c b/apache2/apache2_config.c index 13393e5f..fb755a14 100644 --- a/apache2/apache2_config.c +++ b/apache2/apache2_config.c @@ -136,6 +136,7 @@ void *create_directory_config(apr_pool_t *mp, char *path) dcfg->col_timeout = NOT_SET; dcfg->crypto_key = NOT_SET_P; + dcfg->crypto_key_len = NOT_SET; dcfg->crypto_key_add = NOT_SET; dcfg->crypto_param_name = NOT_SET_P; dcfg->encryption_is_enabled = NOT_SET; @@ -554,6 +555,8 @@ void *merge_directory_configs(apr_pool_t *mp, void *_parent, void *_child) /* Encryption */ merged->crypto_key = (child->crypto_key == NOT_SET_P ? parent->crypto_key : child->crypto_key); + merged->crypto_key_len = (child->crypto_key_len == NOT_SET + ? parent->crypto_key_len : child->crypto_key_len); merged->crypto_key_add = (child->crypto_key_add == NOT_SET ? parent->crypto_key_add : child->crypto_key_add); merged->crypto_param_name = (child->crypto_param_name == NOT_SET_P From f4d446574c009ac77deac78e913236797f1c1306 Mon Sep 17 00:00:00 2001 From: brenosilva Date: Tue, 3 Jul 2012 19:12:51 +0000 Subject: [PATCH 21/64] Fix pcre version mismatch warning --- apache2/mod_security2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apache2/mod_security2.c b/apache2/mod_security2.c index e3177079..275a4e33 100644 --- a/apache2/mod_security2.c +++ b/apache2/mod_security2.c @@ -89,7 +89,7 @@ static void version(apr_pool_t *mp) { ap_log_error(APLOG_MARK, APLOG_WARNING, 0, NULL, "ModSecurity: Loaded APR do not match with compiled!"); } - pcre_vrs = apr_psprintf(mp,"%d.%d", PCRE_MAJOR, PCRE_MINOR); + pcre_vrs = apr_psprintf(mp,"%d.%02d", PCRE_MAJOR, PCRE_MINOR); ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL, "ModSecurity: PCRE compiled version=\"%s\"; " From 71c1e7813c383f9a06000f3b0fe0b9202e5f0a59 Mon Sep 17 00:00:00 2001 From: brenosilva Date: Tue, 3 Jul 2012 19:18:45 +0000 Subject: [PATCH 22/64] Fix replacing targets --- apache2/re.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/apache2/re.c b/apache2/re.c index 1b94fffe..a3d3d11a 100644 --- a/apache2/re.c +++ b/apache2/re.c @@ -140,7 +140,7 @@ char *update_rule_target_ex(modsec_rec *msr, msre_ruleset *ruleset, msre_rule *r char *name = NULL, *value = NULL; char *opt = NULL, *param = NULL; char *target_list = NULL, *replace = NULL; - int i, rc, match = 0; + int i, rc, match = 0, var_appended = 0; if(rule != NULL) { @@ -221,10 +221,14 @@ char *update_rule_target_ex(modsec_rec *msr, msre_ruleset *ruleset, msre_rule *r strncasecmp(targets[i]->param,value,strlen(targets[i]->param)) == 0) { memset(targets[i]->name,0,strlen(targets[i]->name)); memset(targets[i]->param,0,strlen(targets[i]->param)); + targets[i]->is_counting = 0; + targets[i]->is_negated = 1; match = 1; } } else if (value == NULL && targets[i]->param == NULL){ memset(targets[i]->name,0,strlen(targets[i]->name)); + targets[i]->is_counting = 0; + targets[i]->is_negated = 1; match = 1; } else continue; @@ -251,13 +255,15 @@ char *update_rule_target_ex(modsec_rec *msr, msre_ruleset *ruleset, msre_rule *r goto end; } if(msr) { - msr_log(msr, 9, "Successfuly replaced variable"); + msr_log(msr, 9, "Successfully replaced variable"); } #if !defined(MSC_TEST) else { - ap_log_error(APLOG_MARK, APLOG_INFO, 0, NULL, " ModSecurity: Successfuly replaced variable"); + ap_log_error(APLOG_MARK, APLOG_INFO, 0, NULL, " ModSecurity: Successfully replaced variable"); } #endif + var_appended = 1; + } else { if(msr) { msr_log(msr, 9, "Cannot find variable to replace"); @@ -361,11 +367,12 @@ char *update_rule_target_ex(modsec_rec *msr, msre_ruleset *ruleset, msre_rule *r } #if !defined(MSC_TEST) else { - ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL, " ModSecurity: Error parseing rule targets to append variable"); + ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL, " ModSecurity: Error parsing rule targets to append variable"); } #endif goto end; } + var_appended = 1; } else { if(msr) { msr_log(msr, 9, "Skipping variable, already appended"); @@ -381,15 +388,16 @@ char *update_rule_target_ex(modsec_rec *msr, msre_ruleset *ruleset, msre_rule *r p = apr_strtok(NULL,",",&savedptr); } - if(match == 0) { + if(var_appended == 1) { current_targets = msre_generate_target_string(ruleset->mp, rule); rule->unparsed = msre_rule_generate_unparsed(ruleset->mp, rule, current_targets, NULL, NULL); + rule->p1 = apr_pstrdup(ruleset->mp, current_targets); if(msr) { - msr_log(msr, 9, "Successfuly appended variable"); + msr_log(msr, 9, "Successfully appended variable"); } #if !defined(MSC_TEST) else { - ap_log_error(APLOG_MARK, APLOG_INFO, 0, NULL, " ModSecurity: Successfuly appended variable"); + ap_log_error(APLOG_MARK, APLOG_INFO, 0, NULL, " ModSecurity: Successfully appended variable"); } #endif } From 1c3efe02f0dcbb87d796e87bd51e62780afa5b55 Mon Sep 17 00:00:00 2001 From: brenosilva Date: Mon, 23 Jul 2012 18:02:29 +0000 Subject: [PATCH 23/64] Update Reference Manual --- CHANGES | 12 ++++ doc/Reference_Manual.html | 147 +++++++++++++++++++++----------------- 2 files changed, 95 insertions(+), 64 deletions(-) diff --git a/CHANGES b/CHANGES index d8f1604a..f1c004df 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,15 @@ +23 Jul 2012 - 2.6.7 +------------------- + + * Fixed PCRE mismtach version warning message (Thanks Victor Julien). + + * Fixed explicit target replacement using SecUpdateTargetById was broken. + + * The ctl:ruleUpdateTargetById is deprecated and will be removed for future versions since + there is no safe way to use it per-request. + + * Added ctl:ruleRemoveTargetById that can be used to exclude targets to be processed per-request. + 22 Jun 2012 - 2.7.0-rc2 ------------------- diff --git a/doc/Reference_Manual.html b/doc/Reference_Manual.html index c7a72c24..ba98326b 100644 --- a/doc/Reference_Manual.html +++ b/doc/Reference_Manual.html @@ -9,26 +9,30 @@ lang="en"> - + + + +href="https://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Special:RecentChanges&feed=rss"> +href="https://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Special:RecentChanges&feed=atom"> SourceForge.net: Reference Manual - mod-security - - @@ -41,7 +45,7 @@ type="text/css"> var wgScript = "/apps/mediawiki/mod-security/index.php"; var wgVariantArticlePath = false; var wgActionPaths = {}; - var wgServer = "http://sourceforge.net"; + var wgServer = "https://sourceforge.net"; var wgCanonicalNamespace = ""; var wgCanonicalSpecialPageName = false; var wgNamespaceNumber = 0; @@ -50,12 +54,12 @@ type="text/css"> var wgAction = "view"; var wgArticleId = "12"; var wgIsArticle = true; - var wgUserName = null; - var wgUserGroups = null; + var wgUserName = "Brenosilva"; + var wgUserGroups = ["admin", "editor", "*", "user", "autoconfirmed"]; var wgUserLanguage = "en"; var wgContentLanguage = "en"; var wgBreakFrames = false; - var wgCurRevisionId = 502; + var wgCurRevisionId = 507; var wgVersion = "1.15.1"; var wgEnableAPI = true; var wgEnableWriteAPI = true; @@ -63,11 +67,13 @@ type="text/css"> var wgDigitTransformTable = ["", ""]; var wgRestrictionEdit = []; var wgRestrictionMove = []; + var wgAjaxWatch = {"watchMsg": "Watch", "unwatchMsg": "Unwatch", "watchingMsg": "Watching…", "unwatchingMsg": "Unwatching…"}; /*]]>*/ + @@ -2604,6 +2610,9 @@ example, lets say you want to only inspect ARGS for a particular URL: 

SecRule REQUEST_FILENAME "@streq /path/to/file.php" "phase:1,t:none,nolog,pass,ctl:ruleUpdateTargetById=958895;REQUEST_URI;REQUEST_FILENAME"
+
Note 
This ctl is deprecated and will be removed +from the code, since we cannot use it per-transaction. +

SecRuleUpdateTargetByMsg

Description: Updates the target (variable) list of the @@ -2653,18 +2662,6 @@ target to the end of the variable list as follows: "phase:2,rev:'2.1.1',capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'958895',tag:'WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.command_injection_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=% {tx.0}"" -

Conditionally Appending Targets -

You could also do the same by using the ctl action. This is -useful if you want to only update the targets for a particular URL -

-
SecRule REQUEST_FILENAME "@streq /path/to/file.php" "phase:1,t:none,nolog,pass,ctl:ruleUpdateTargetByMsg='System Command Injection';!ARGS:email"
-
-

Conditionally Replacing Targets -

You could also replace targets using the ctl action. For -example, lets say you want to only inspect ARGS for a particular URL: -

-
SecRule REQUEST_FILENAME "@streq /path/to/file.php" "phase:1,t:none,nolog,pass,ctl:ruleUpdateTargetByMsg='System Command Injection';REQUEST_URI;REQUEST_FILENAME"
-

SecRuleUpdateTargetByTag

Description: Updates the target (variable) list of the @@ -2714,18 +2711,6 @@ target to the end of the variable list as follows: "phase:2,rev:'2.1.1',capture,t:none,t:htmlEntityDecode,t:compressWhitespace,t:lowercase,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'958895',tag:'WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.command_injection_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=% {tx.0}"" -

Conditionally Appending Targets -

You could also do the same by using the ctl action. This is -useful if you want to only update the targets for a particular URL -

-
SecRule REQUEST_FILENAME "@streq /path/to/file.php" "phase:1,t:none,nolog,pass,ctl:ruleUpdateTargetByMsg='WASCTC/WASC-31';!ARGS:email"
-
-

Conditionally Replacing Targets -

You could also replace targets using the ctl action. For -example, lets say you want to only inspect ARGS for a particular URL: -

-
SecRule REQUEST_FILENAME "@streq /path/to/file.php" "phase:1,t:none,nolog,pass,ctl:ruleUpdateTargetByMsg='WASCTC/WASC-31';REQUEST_URI;REQUEST_FILENAME"
-

SecServerSignature

Description: Instructs ModSecurity to change the data @@ -2932,7 +2917,7 @@ five phases of the Apache request cycle:

Below is a diagram of the standard Apache Request Cycle. In the diagram, the 5 ModSecurity processing phases are shown.

@@ -4511,9 +4496,10 @@ SecRule REQUEST_CONTENT_TYPE ^text/xml "nolog,pass,ctl:requestBodyProcessor=XML"

  • ruleRemoveById - since this action us triggered at run time, it should be specified before the rule in which it is disabling. -
  • ruleUpdateTargetById -
  • ruleUpdateTargetByMsg -
  • ruleUpdateTargetByTag +
  • ruleUpdateTargetById - This is deprecated and will be +removed from the code. Use ruleRemoveTargetById for per-request +exceptions. +
  • ruleRemoveTargetById
  • ruleRemoveByMsg
  • encryptionEngine
  • encryptionEnforcement @@ -6247,16 +6233,16 @@ SecCookieFormat 0 - +
    Retrieved from "http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Reference_Manual"
    +href="https://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Reference_Manual">https://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Reference_Manual"
    @@ -6269,18 +6255,30 @@ href="http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Referen @@ -6290,6 +6288,24 @@ href="http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Referen
    @@ -6297,7 +6313,7 @@ cellspacing="0"> @@ -6306,24 +6322,24 @@ href="http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Main_Pa
    @@ -6348,22 +6364,25 @@ value="Search" title="Search the pages for this text" type="submit">
    @@ -6375,15 +6394,15 @@ href="http://sourceforge.net/apps/mediawiki/mod-security/index.php?title=Referen src="Reference_Manual_files/poweredby_mediawiki_88x31.png" alt="Powered by MediaWiki">
      -
    • This page was last modified on 8 June 2012, at -12:36.
      • -
    • This page has been accessed 130,792 times.
      • +
    • This page was last modified on 23 July 2012, at +17:54.
      • +
    • This page has been accessed 142,275 times.
    - +