Skip to content

Commit 1a89b6b

Browse files
chaizhenhuachaizhenhua
committed
Fixed deny not work in response phase, Fixed debug log message
1 parent 65d8896 commit 1a89b6b

File tree

2 files changed

+72
-47
lines changed

2 files changed

+72
-47
lines changed

‎nginx/modsecurity/ngx_http_modsecurity.c

Lines changed: 55 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -183,8 +183,10 @@ ngx_http_modsecurity_merge_loc_conf(ngx_conf_t *cf, void *parent,
183183
ngx_conf_merge_ptr_value(conf->config, prev->config, NULL);
184184

185185
if (conf->enable && conf->config == NULL) {
186-
ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
187-
"ModSecurity: enabled in %V:%ui while no config file is specified ",
186+
ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
187+
"\"ModSecurityEnabled\" in %V:%ui is set to \"on\""
188+
" while directive \"ModSecurityConfig\" is not found"
189+
" in the same location",
188190
conf->file, conf->line);
189191
return NGX_CONF_ERROR;
190192
}
@@ -224,6 +226,7 @@ modsec_pcre_free(void *ptr)
224226
static ngx_int_t
225227
ngx_http_modsecurity_preconfiguration(ngx_conf_t *cf)
226228
{
229+
server_rec *s;
227230

228231
/* XXX: temporary hack, nginx uses pcre as well and hijacks these two */
229232
pcre_malloc = modsec_pcre_malloc;
@@ -232,9 +235,20 @@ ngx_http_modsecurity_preconfiguration(ngx_conf_t *cf)
232235
modsecSetLogHook(cf->log, modsecLog);
233236
modsecSetDropAction(ngx_http_modsecurity_drop_action);
234237

235-
modsecInit();
236-
modsecStartConfig();
238+
s = modsecInit();
239+
if (s == NULL) {
240+
return NGX_ERROR;
241+
}
242+
243+
/* set host name */
244+
s->server_hostname = ngx_palloc(cf->pool, ngx_cycle->hostname.len + 1);
245+
if (s->server_hostname == NULL) {
246+
return NGX_ERROR;
247+
}
248+
ngx_memcpy(s->server_hostname, ngx_cycle->hostname.data, ngx_cycle->hostname.len);
249+
s->server_hostname[ ngx_cycle->hostname.len] = '\0';
237250

251+
modsecStartConfig();
238252
return NGX_OK;
239253
}
240254

@@ -344,31 +358,27 @@ ngx_http_modsecurity_handler(ngx_http_request_t *r)
344358
ngx_http_modsecurity_ctx_t *ctx;
345359
ngx_int_t rc;
346360

347-
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "modSecurity: handler");
348-
349361
cf = ngx_http_get_module_loc_conf(r, ngx_http_modsecurity);
350362

351363
/* Process only main request */
352364
if (r != r->main || r->internal || !cf->enable) {
353365
return NGX_DECLINED;
354366
}
355367

368+
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "modSecurity: handler");
369+
356370
ctx = ngx_http_modsecurity_create_ctx(r);
357371
if (ctx == NULL) {
358372
return NGX_ERROR;
359373
}
360374
ngx_http_set_ctx(r, ctx, ngx_http_modsecurity);
361375

362376
/* processing request headers */
363-
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "modSecurity: process request headers");
364-
365377
rc = modsecProcessRequestHeaders(ctx->req);
366-
378+
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "ModSecurity: modsecProcessRequestHeaders %d", rc);
367379
if (rc == DECLINED) {
368380
if (r->method == NGX_HTTP_POST) {
369381
/* Processing POST request body, should we process PUT? */
370-
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "modSecurity: method POST");
371-
372382
rc = ngx_http_read_client_request_body(r, ngx_http_modsecurity_body_handler);
373383
if (rc >= NGX_HTTP_SPECIAL_RESPONSE) {
374384
return rc;
@@ -377,12 +387,11 @@ ngx_http_modsecurity_handler(ngx_http_request_t *r)
377387
return NGX_DONE;
378388
}
379389
/* other method */
380-
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "modSecurity: process request body");
381-
rc = modsecProcessRequestBody(ctx->req);
390+
rc = modsecProcessRequestBody(ctx->req);
391+
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "ModSecurity: modsecProcessRequestBody %d", rc);
382392
}
383393

384394
if (rc != DECLINED) {
385-
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "ModSecurity: status: %d, need action", rc);
386395

387396
/* Nginx and Apache share same response code */
388397
if (rc < NGX_HTTP_SPECIAL_RESPONSE || rc >= 600) {
@@ -412,7 +421,7 @@ ngx_http_modsecurity_body_handler(ngx_http_request_t *r)
412421
return;
413422
}
414423

415-
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "modSecurity: process request body");
424+
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "modSecurity: body handler");
416425

417426
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity);
418427

@@ -426,9 +435,9 @@ ngx_http_modsecurity_body_handler(ngx_http_request_t *r)
426435
modsecSetBodyBrigade(ctx->req, ctx->brigade);
427436

428437
rc = modsecProcessRequestBody(ctx->req);
438+
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "ModSecurity: modsecProcessRequestBody %d", rc);
429439

430440
if (rc != DECLINED) {
431-
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "ModSecurity: status: %d, need action", rc);
432441

433442
/* Nginx and Apache share same response code */
434443
if (rc < NGX_HTTP_SPECIAL_RESPONSE || rc >= 600) {
@@ -474,21 +483,17 @@ ngx_http_modsecurity_header_filter(ngx_http_request_t *r) {
474483
ngx_http_modsecurity_loc_conf_t *cf;
475484
ngx_http_modsecurity_ctx_t *ctx;
476485
const char *lang;
486+
ngx_int_t rc;
477487

478488
cf = ngx_http_get_module_loc_conf(r, ngx_http_modsecurity);
479489
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity);
480-
490+
481491
if (r != r->main || r->internal || !cf->enable || ctx->complete) {
482492
return ngx_http_next_header_filter(r);
483493
}
484-
485-
if (r->method == NGX_HTTP_HEAD || r->header_only
486-
|| !modsecIsResponseBodyAccessEnabled(ctx->req) ) {
487-
/* TODO: RESPONSE HEADERS PHASE
488-
*/
489-
return ngx_http_next_header_filter(r);
490-
}
491-
494+
495+
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "modSecurity: header filter");
496+
492497
/* copy headers_out */
493498
if (ngx_list_copy_to_apr_table(&r->headers_out.headers,
494499
ctx->req->headers_out,
@@ -507,6 +512,22 @@ ngx_http_modsecurity_header_filter(ngx_http_request_t *r) {
507512
*(const char **)apr_array_push(ctx->req->content_languages) = lang;
508513
}
509514

515+
if (r->method == NGX_HTTP_HEAD || r->header_only) {
516+
517+
ctx->complete = 1;
518+
rc = modsecProcessResponse(ctx->req);
519+
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "ModSecurity: modsecProcessResponse %d", rc);
520+
if (rc == DECLINED || rc == APR_SUCCESS) {
521+
return ngx_http_next_header_filter(r);
522+
}
523+
524+
if (rc < NGX_HTTP_SPECIAL_RESPONSE || rc >= 600) {
525+
rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
526+
}
527+
528+
return rc;
529+
}
530+
510531
return NGX_OK;
511532
}
512533

@@ -520,7 +541,7 @@ ngx_http_modsecurity_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
520541

521542
cf = ngx_http_get_module_loc_conf(r, ngx_http_modsecurity);
522543
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity);
523-
544+
524545
if (r != r->main || r->internal || !cf->enable || ctx->complete) {
525546
return ngx_http_next_body_filter(r, in);
526547
}
@@ -532,10 +553,8 @@ ngx_http_modsecurity_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
532553
}
533554

534555
rc = move_chain_to_brigade(in, ctx->brigade, r->pool);
535-
if (rc == NGX_ERROR) {
536-
return NGX_ERROR;
537-
} else if (rc == NGX_AGAIN) {
538-
return NGX_AGAIN;
556+
if (rc != NGX_OK) {
557+
return rc;
539558
}
540559

541560
/* last buf has been saved */
@@ -544,6 +563,7 @@ ngx_http_modsecurity_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
544563
modsecSetResponseBrigade(ctx->req, ctx->brigade);
545564

546565
rc = modsecProcessResponse(ctx->req);
566+
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "ModSecurity: modsecProcessResponse %d", rc);
547567

548568
if (rc == DECLINED || rc == APR_SUCCESS) {
549569

@@ -565,22 +585,17 @@ ngx_http_modsecurity_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
565585
rc = ngx_http_next_header_filter(r);
566586

567587
if (rc == NGX_ERROR || rc > NGX_OK) {
568-
return rc;
588+
return ngx_http_filter_finalize_request(r, &ngx_http_modsecurity, rc);
569589
}
570590

571-
rc = ngx_http_next_body_filter(r, in);
572-
if (rc == NGX_ERROR || rc >= NGX_HTTP_SPECIAL_RESPONSE) {
573-
return rc;
574-
}
575-
576-
return NGX_OK;
591+
return ngx_http_next_body_filter(r, in);
577592
}
578593

579594
if (rc < NGX_HTTP_SPECIAL_RESPONSE || rc >= 600) {
580595
rc = NGX_HTTP_INTERNAL_SERVER_ERROR;
581596
}
582597

583-
return rc; /* ngx_http_filter_finalize_request(r, &ngx_http_modsecurity, rc); */
598+
return ngx_http_filter_finalize_request(r, &ngx_http_modsecurity, rc);
584599
}
585600

586601

@@ -709,7 +724,8 @@ ngx_http_modsecurity_config(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
709724

710725
msg = modsecProcessConfig(mscf->config, (const char *)value[1].data, NULL);
711726
if (msg != NULL) {
712-
ngx_conf_log_error(NGX_LOG_EMERG, cf, 0, "modSecurity: modsecProcessConfig() %s", msg);
727+
ngx_log_error(NGX_LOG_EMERG, cf->log, 0, "ModSecurityConfig in %s:%ui: %s",
728+
cf->conf_file->file.name.data, cf->conf_file->line, msg);
713729
return NGX_CONF_ERROR;
714730
}
715731

‎standalone/api.c

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -215,7 +215,11 @@ apr_status_t ap_http_in_filter(ap_filter_t *f, apr_bucket_brigade *bb_out,
215215
return APR_SUCCESS;
216216
}
217217

218-
return AP_NOBODY_READ;
218+
/* cannot read request body */
219+
e = apr_bucket_eos_create(f->c->bucket_alloc);
220+
APR_BRIGADE_INSERT_TAIL(bb_out, e);
221+
222+
return APR_SUCCESS;
219223
}
220224

221225
apr_status_t ap_http_out_filter(ap_filter_t *f, apr_bucket_brigade *b) {
@@ -560,7 +564,7 @@ int modsecProcessResponse(request_rec *r) {
560564

561565
if (bb == NULL) {
562566
msr_log(msr, 1, "Process response: Failed to create brigade.");
563-
return -1;
567+
return APR_EGENERAL;
564568
}
565569

566570
msr->r = r;
@@ -583,19 +587,24 @@ int modsecProcessResponse(request_rec *r) {
583587
e = apr_bucket_pool_create(tmp, readcnt, r->pool, r->connection->bucket_alloc);
584588
APR_BRIGADE_INSERT_TAIL(bb, e);
585589
}
586-
587-
if(is_eos) {
588-
e = apr_bucket_eos_create(r->connection->bucket_alloc);
589-
APR_BRIGADE_INSERT_TAIL(bb, e);
590-
}
591590
}
591+
592+
e = apr_bucket_eos_create(r->connection->bucket_alloc);
593+
APR_BRIGADE_INSERT_TAIL(bb, e);
592594
} else {
593-
return AP_NOBODY_WROTE;
595+
/* cannot read response body process header only */
596+
597+
e = apr_bucket_eos_create(r->connection->bucket_alloc);
598+
APR_BRIGADE_INSERT_TAIL(bb, e);
594599
}
595600

596601
f = ap_add_output_filter("HTTP_OUT", msr, r, r->connection);
597602
status = ap_pass_brigade(r->output_filters, bb);
598603
ap_remove_output_filter(f);
604+
if(status > 0
605+
&& msr->intercept_actionset->intercept_status != 0) {
606+
status = msr->intercept_actionset->intercept_status;
607+
}
599608
return status;
600609
}
601610

0 commit comments

Comments
 (0)