Skip to content

Commit f7cff06

Browse files
author
Artur Mackowiak
committed
Fixes after review
1 parent 811d9a0 commit f7cff06

File tree

4 files changed

+1311
-14
lines changed

4 files changed

+1311
-14
lines changed

‎config.orig

Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
# vim: filetype=sh
2+
3+
# If $NGX_IGNORE_RPATH is set to "YES", we will ignore explicit
4+
# library path specification on resulting binary, allowing libmodsecurity.so
5+
# to be relocated across configured library pathes (adjust /etc/ld.so.conf
6+
# or set $LD_LIBRARY_PATH environment variable to manage them)
7+
#
8+
# $YAJL_LIB variable may need to be populated in case of non-standard
9+
# path of libyajl.so's installation
10+
11+
ngx_feature_name=
12+
ngx_feature_run=no
13+
ngx_feature_incs="#include <modsecurity/modsecurity.h>"
14+
ngx_feature_libs="-lmodsecurity"
15+
ngx_feature_test='printf("hello");'
16+
ngx_modsecurity_opt_I=
17+
ngx_modsecurity_opt_L=
18+
19+
YAJL_EXTRA=
20+
if test -n "$YAJL_LIB"; then
21+
YAJL_EXTRA="-L$YAJL_LIB -lyajl"
22+
fi
23+
24+
# If $MODSECURITY_INC is specified, lets use it. Otherwise lets try
25+
# the default paths
26+
#
27+
if [ -n "$MODSECURITY_INC" -o -n "$MODSECURITY_LIB" ]; then
28+
# explicitly set ModSecurity lib path
29+
ngx_feature="ModSecurity library in \"$MODSECURITY_LIB\" and \"$MODSECURITY_INC\" (specified by the MODSECURITY_LIB and MODSECURITY_INC env)"
30+
ngx_feature_path="$MODSECURITY_INC"
31+
ngx_modsecurity_opt_I="-I$MODSECURITY_INC"
32+
ngx_modsecurity_opt_L="-L$MODSECURITY_LIB $YAJL_EXTRA"
33+
34+
if [ $NGX_RPATH = YES ]; then
35+
ngx_feature_libs="-R$MODSECURITY_LIB -L$MODSECURITY_LIB -lmodsecurity $YAJL_EXTRA"
36+
elif [ "$NGX_IGNORE_RPATH" != "YES" -a $NGX_SYSTEM = "Linux" ]; then
37+
ngx_feature_libs="-Wl,-rpath,$MODSECURITY_LIB -L$MODSECURITY_LIB -lmodsecurity $YAJL_EXTRA"
38+
else
39+
ngx_feature_libs="-L$MODSECURITY_LIB -lmodsecurity $YAJL_EXTRA"
40+
fi
41+
42+
. auto/feature
43+
44+
if [ $ngx_found = no ]; then
45+
cat << END
46+
$0: error: ngx_http_modsecurity_module requires the ModSecurity library and MODSECURITY_LIB is defined as "$MODSECURITY_LIB" and MODSECURITY_INC (path for modsecurity.h) "$MODSECURITY_INC", but we cannot find ModSecurity there.
47+
END
48+
exit 1
49+
fi
50+
else
51+
# auto-discovery
52+
ngx_feature="ModSecurity library"
53+
ngx_feature_libs="-lmodsecurity"
54+
55+
. auto/feature
56+
57+
if [ $ngx_found = no ]; then
58+
ngx_feature="ModSecurity library in /usr/local/modsecurity"
59+
ngx_feature_path="/usr/local/modsecurity/include"
60+
if [ $NGX_RPATH = YES ]; then
61+
ngx_feature_libs="-R/usr/local/modsecurity/lib -L/usr/local/modsecurity/lib -lmodsecurity"
62+
elif [ "$NGX_IGNORE_RPATH" != "YES" -a $NGX_SYSTEM = "Linux" ]; then
63+
ngx_feature_libs="-Wl,-rpath,/usr/local/modsecurity/lib -L/usr/local/modsecurity/lib -lmodsecurity"
64+
else
65+
ngx_feature_libs="-L/usr/local/modsecurity/lib -lmodsecurity"
66+
fi
67+
68+
. auto/feature
69+
70+
fi
71+
fi
72+
73+
74+
75+
if [ $ngx_found = no ]; then
76+
cat << END
77+
$0: error: ngx_http_modsecurity_module requires the ModSecurity library.
78+
END
79+
exit 1
80+
fi
81+
82+
83+
ngx_addon_name=ngx_http_modsecurity_module
84+
85+
# We must place ngx_http_modsecurity_module after ngx_http_gzip_filter_module
86+
# in load order list to be able to read response body before it gets compressed
87+
# (for filter modules later initialization means earlier execution).
88+
#
89+
# Nginx implements load ordering only for dynamic modules and only a BEFORE part
90+
# of "ngx_module_order". So we list all of the modules that come after
91+
# ngx_http_gzip_filter_module as a BEFORE dependency for
92+
# ngx_http_modsecurity_module.
93+
#
94+
# For static compilation HTTP_FILTER_MODULES will be patched later.
95+
96+
modsecurity_dependency="ngx_http_postpone_filter_module \
97+
ngx_http_ssi_filter_module \
98+
ngx_http_charset_filter_module \
99+
ngx_http_xslt_filter_module \
100+
ngx_http_image_filter_module \
101+
ngx_http_sub_filter_module \
102+
ngx_http_addition_filter_module \
103+
ngx_http_gunzip_filter_module \
104+
ngx_http_userid_filter_module \
105+
ngx_http_headers_filter_module \
106+
ngx_http_copy_filter_module"
107+
108+
109+
if test -n "$ngx_module_link"; then
110+
ngx_module_type=HTTP_FILTER
111+
ngx_module_name="$ngx_addon_name"
112+
ngx_module_srcs="$ngx_addon_dir/src/ngx_http_modsecurity_module.c \
113+
$ngx_addon_dir/src/ngx_http_modsecurity_pre_access.c \
114+
$ngx_addon_dir/src/ngx_http_modsecurity_header_filter.c \
115+
$ngx_addon_dir/src/ngx_http_modsecurity_body_filter.c \
116+
$ngx_addon_dir/src/ngx_http_modsecurity_log.c \
117+
$ngx_addon_dir/src/ngx_http_modsecurity_rewrite.c \
118+
"
119+
ngx_module_deps="$ngx_addon_dir/src/ddebug.h \
120+
$ngx_addon_dir/src/ngx_http_modsecurity_common.h \
121+
"
122+
ngx_module_libs="$ngx_feature_libs"
123+
ngx_module_incs="$ngx_feature_path"
124+
125+
ngx_module_order="ngx_http_chunked_filter_module \
126+
ngx_http_v2_filter_module \
127+
ngx_http_range_header_filter_module \
128+
ngx_http_gzip_filter_module \
129+
$ngx_module_name \
130+
$modsecurity_dependency";
131+
132+
. auto/module
133+
else
134+
CFLAGS="$ngx_modsecurity_opt_I $CFLAGS"
135+
NGX_LD_OPT="$ngx_modsecurity_opt_L $NGX_LD_OPT"
136+
137+
CORE_INCS="$CORE_INCS $ngx_feature_path"
138+
CORE_LIBS="$CORE_LIBS $ngx_feature_libs"
139+
140+
HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES ngx_http_modsecurity_module"
141+
NGX_ADDON_SRCS="\
142+
$NGX_ADDON_SRCS \
143+
$ngx_addon_dir/src/ngx_http_modsecurity_module.c \
144+
$ngx_addon_dir/src/ngx_http_modsecurity_pre_access.c \
145+
$ngx_addon_dir/src/ngx_http_modsecurity_header_filter.c \
146+
$ngx_addon_dir/src/ngx_http_modsecurity_body_filter.c \
147+
$ngx_addon_dir/src/ngx_http_modsecurity_log.c \
148+
$ngx_addon_dir/src/ngx_http_modsecurity_rewrite.c \
149+
"
150+
151+
NGX_ADDON_DEPS="\
152+
$NGX_ADDON_DEPS \
153+
$ngx_addon_dir/src/ddebug.h \
154+
$ngx_addon_dir/src/ngx_http_modsecurity_common.h \
155+
"
156+
fi
157+
158+
#
159+
# Nginx does not provide reliable way to introduce our module into required
160+
# place in static ($ngx_module_link=ADDON) compilation mode, so we must
161+
# explicitly update module "ordering rules".
162+
#
163+
if [ "$ngx_module_link" != DYNAMIC ] ; then
164+
# Reposition modsecurity module to satisfy $modsecurity_dependency
165+
# (this mimics dependency resolution made by ngx_add_module() function
166+
# though less optimal in terms of computational complexity).
167+
modules=
168+
found=
169+
for module in $HTTP_FILTER_MODULES; do
170+
# skip our module name from the original list
171+
if [ "$module" = "$ngx_addon_name" ]; then
172+
continue
173+
fi
174+
if [ -z "${found}" ]; then
175+
for item in $modsecurity_dependency; do
176+
if [ "$module" = "$item" ]; then
177+
modules="${modules} $ngx_addon_name"
178+
found=1
179+
break
180+
fi
181+
done
182+
fi
183+
modules="${modules} $module"
184+
done
185+
if [ -z "${found}" ]; then
186+
# This must never happen since ngx_http_copy_filter_module must be in HTTP_FILTER_MODULES
187+
# and we stated dependency on it in $modsecurity_dependency
188+
echo "$0: error: cannot reposition modsecurity module in HTTP_FILTER_MODULES list"
189+
exit 1
190+
fi
191+
HTTP_FILTER_MODULES="${modules}"
192+
fi

‎src/ngx_http_modsecurity_module.c

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -958,26 +958,26 @@ ngx_http_modsecurity_phase_time(ngx_http_request_t *r,
958958
ngx_http_variable_value_t *v, uintptr_t data)
959959
{
960960
ngx_http_modsecurity_ctx_t *ctx;
961-
ngx_msec_int_t phase_time;
962961

963962
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
964963
if (ctx == NULL) {
965964
return NGX_ERROR;
966965
}
967966

968-
if (data == 0) {
969-
phase_time = ctx->req_headers_phase_time;
970-
} else if (data == 1) {
971-
phase_time = ctx->req_body_phase_time;
972-
} else if (data == 2) {
973-
phase_time = ctx->resp_headers_phase_time;
974-
} else if (data == 3) {
975-
phase_time = ctx->resp_body_phase_time;
976-
} else if (data == 4) {
977-
phase_time = ctx->logging_phase_time;
967+
switch(data) {
968+
case 0:
969+
return ngx_http_modsecurity_time_variable(r, v, data, ctx->req_headers_phase_time);
970+
case 1:
971+
return ngx_http_modsecurity_time_variable(r, v, data, ctx->req_body_phase_time);
972+
case 2:
973+
return ngx_http_modsecurity_time_variable(r, v, data, ctx->resp_headers_phase_time);
974+
case 3:
975+
return ngx_http_modsecurity_time_variable(r, v, data, ctx->resp_body_phase_time);
976+
case 4:
977+
return ngx_http_modsecurity_time_variable(r, v, data, ctx->logging_phase_time);
978978
}
979979

980-
return ngx_http_modsecurity_time_variable(r, v, data, ctx->phase_time);
980+
return -1;
981981
}
982982

983983

@@ -1051,7 +1051,7 @@ ngx_http_modsecurity_time_variable(ngx_http_request_t *r,
10511051
if(usec == -1) {
10521052
v->len = ngx_sprintf(p, "-") - p;
10531053
} else {
1054-
v->len = ngx_sprintf(p, "%T.%06M", (time_t) nsec / 1000000000, nsec % 1000000000) - p;
1054+
v->len = ngx_sprintf(p, "%T.%06M", (time_t) usec / 1000000, usec % 1000000) - p;
10551055
}
10561056

10571057
v->valid = 1;
@@ -1067,7 +1067,7 @@ ngx_msec_int_t
10671067
ngx_http_modsecurity_compute_processing_time(struct timespec tv) {
10681068
struct timespec current_tv;
10691069
(void) clock_gettime(CLOCK_MONOTONIC, &current_tv);
1070-
return (ngx_msec_int_t) ((current_tv.tv_sec - tv.tv_sec) * 1000000000 + (current_tv.tv_nsec - tv.tv_nsec));
1070+
return (ngx_msec_int_t) ((current_tv.tv_sec - tv.tv_sec) * 1000000 + (current_tv.tv_nsec - tv.tv_nsec) / 1000);
10711071
};
10721072

10731073
/* vi:set ft=c ts=4 sw=4 et fdm=marker: */

0 commit comments

Comments
 (0)