2 * ModSecurity for Apache 2.x, http://www.modsecurity.org/
3 * Copyright (c) 2004-2009 Breach Security, Inc. (http://www.breach.com/)
5 * This product is released under the terms of the General Public Licence,
6 * version 2 (GPLv2). Please refer to the file LICENSE (included with this
7 * distribution) which contains the complete text of the licence.
9 * There are special exceptions to the terms and conditions of the GPL
10 * as it is applied to this software. View the full text of the exception in
11 * file MODSECURITY_LICENSING_EXCEPTION in the directory of this software
14 * If any of the files related to licensing are missing or if you have any
15 * other questions related to licensing please contact Breach Security, Inc.
16 * directly using the email address support@breach.com.
19 #include "modsecurity.h"
21 #include "http_core.h"
22 #include "util_script.h"
25 * Sends a brigade with an error bucket down the filter chain.
27 apr_status_t send_error_bucket(modsec_rec *msr, ap_filter_t *f, int status) {
28 apr_bucket_brigade *brigade = NULL;
29 apr_bucket *bucket = NULL;
31 /* Set the status line explicitly for the error document */
32 f->r->status_line = ap_get_status_line(status);
34 brigade = apr_brigade_create(f->r->pool, f->r->connection->bucket_alloc);
35 if (brigade == NULL) return APR_EGENERAL;
37 bucket = ap_bucket_error_create(status, NULL, f->r->pool, f->r->connection->bucket_alloc);
38 if (bucket == NULL) return APR_EGENERAL;
40 APR_BRIGADE_INSERT_TAIL(brigade, bucket);
42 bucket = apr_bucket_eos_create(f->r->connection->bucket_alloc);
43 if (bucket == NULL) return APR_EGENERAL;
45 APR_BRIGADE_INSERT_TAIL(brigade, bucket);
47 ap_pass_brigade(f->next, brigade);
50 * It may not matter what we do from the filter as it may be too
51 * late to even generate an error (already sent to client). Nick Kew
52 * recommends to return APR_EGENERAL in hopes that the handler in control
53 * will notice and do The Right Thing. So, that is what we do now.
60 * Execute system command. First line of the output will be returned in
61 * the "output" parameter.
63 int apache2_exec(modsec_rec *msr, const char *command, const char **argv, char **output) {
64 apr_procattr_t *procattr = NULL;
65 apr_proc_t *procnew = NULL;
66 apr_status_t rc = APR_SUCCESS;
67 const char *const *env = NULL;
68 apr_file_t *script_out = NULL;
69 request_rec *r = msr->r;
72 argv = apr_pcalloc(r->pool, 3 * sizeof(char *));
78 ap_add_common_vars(r);
80 /* PHP hack, getting around its silly security checks. */
81 apr_table_add(r->subprocess_env, "PATH_TRANSLATED", command);
82 apr_table_add(r->subprocess_env, "REDIRECT_STATUS", "302");
84 env = (const char * const *)ap_create_environment(r->pool, r->subprocess_env);
86 msr_log(msr, 1, "Exec: Unable to create environment.");
90 procnew = apr_pcalloc(r->pool, sizeof(*procnew));
91 if (procnew == NULL) {
92 msr_log(msr, 1, "Exec: Unable to allocate %lu bytes.", (unsigned long)sizeof(*procnew));
96 apr_procattr_create(&procattr, r->pool);
97 if (procattr == NULL) {
98 msr_log(msr, 1, "Exec: Unable to create procattr.");
102 apr_procattr_io_set(procattr, APR_NO_PIPE, APR_FULL_BLOCK, APR_NO_PIPE);
103 apr_procattr_cmdtype_set(procattr, APR_SHELLCMD);
105 if (msr->txcfg->debuglog_level >= 9) {
106 msr_log(msr, 9, "Exec: %s", log_escape_nq(r->pool, command));
109 rc = apr_proc_create(procnew, command, argv, env, procattr, r->pool);
110 if (rc != APR_SUCCESS) {
111 msr_log(msr, 1, "Exec: Execution failed: %s (%s)", log_escape_nq(r->pool, command),
112 get_apr_error(r->pool, rc));
116 apr_pool_note_subprocess(r->pool, procnew, APR_KILL_AFTER_TIMEOUT);
118 script_out = procnew->out;
120 msr_log(msr, 1, "Exec: Failed to get script output pipe.");
124 apr_file_pipe_timeout_set(script_out, r->server->timeout);
126 /* Now read from the pipe. */
130 apr_size_t nbytes = 255;
133 rc2 = apr_file_read(script_out, buf, &nbytes);
134 if (rc2 == APR_SUCCESS) {
137 /* if there is more than one line ignore them */
139 if (*p == 0x0a) *p = 0;
143 if (msr->txcfg->debuglog_level >= 4) {
144 msr_log(msr, 4, "Exec: First line from script output: \"%s\"",
145 log_escape(r->pool, buf));
148 if (output != NULL) *output = apr_pstrdup(r->pool, buf);
150 /* Soak up the remaining data. */
152 while(apr_file_read(script_out, buf, &nbytes) == APR_SUCCESS) nbytes = 255;
154 msr_log(msr, 1, "Exec: Execution failed while reading output: %s (%s)",
155 log_escape_nq(r->pool, command),
156 get_apr_error(r->pool, rc2));
161 apr_proc_wait(procnew, NULL, NULL, APR_WAIT);
167 * Record the current time and store for later.
169 void record_time_checkpoint(modsec_rec *msr, int checkpoint_no) {
170 char note[100], note_name[100];
173 now = apr_time_now();
174 switch(checkpoint_no) {
176 msr->time_checkpoint_1 = now;
179 msr->time_checkpoint_2 = now;
182 msr->time_checkpoint_3 = now;
185 msr_log(msr, 1, "Internal Error: Unknown checkpoint: %d", checkpoint_no);
190 /* Apache-specific stuff. */
191 apr_snprintf(note, 99, "%" APR_TIME_T_FMT, (now - msr->request_time));
192 apr_snprintf(note_name, 99, "mod_security-time%d", checkpoint_no);
193 apr_table_set(msr->r->notes, note_name, note);
195 if (msr->txcfg->debuglog_level >= 4) {
196 msr_log(msr, 4, "Time #%d: %s", checkpoint_no, note);
201 * Returns a new string that contains the error
202 * message for the given return code.
204 char *get_apr_error(apr_pool_t *p, apr_status_t rc) {
205 char *text = apr_pcalloc(p, 201);
206 if (text == NULL) return NULL;
207 apr_strerror(rc, text, 200);
212 * Retrieve named environment variable.
214 char *get_env_var(request_rec *r, char *name) {
215 char *result = (char *)apr_table_get(r->notes, name);
217 if (result == NULL) {
218 result = (char *)apr_table_get(r->subprocess_env, name);
221 if (result == NULL) {
222 result = getenv(name);
229 * Extended internal log helper function. Use msr_log instead. If fixup is
230 * true, the message will be stripped of any trailing newline and any
231 * required bytes will be escaped.
233 void internal_log_ex(request_rec *r, directory_config *dcfg, modsec_rec *msr,
234 int level, int fixup, const char *text, va_list ap)
236 apr_size_t nbytes, nbytes_written;
237 apr_file_t *debuglog_fd = NULL;
238 int filter_debug_level = 0;
239 char str1[1024] = "";
240 char str2[1256] = "";
242 /* Find the logging FD and determine the logging level from configuration. */
244 if ((dcfg->debuglog_fd != NULL)&&(dcfg->debuglog_fd != NOT_SET_P)) {
245 debuglog_fd = dcfg->debuglog_fd;
248 if (dcfg->debuglog_level != NOT_SET) {
249 filter_debug_level = dcfg->debuglog_level;
253 /* Return immediately if we don't have where to write
254 * or if the log level of the message is higher than
257 if ((level > 3)&&( (debuglog_fd == NULL) || (level > filter_debug_level) )) return;
259 /* Construct the message. */
260 apr_vsnprintf(str1, sizeof(str1), text, ap);
262 int len = strlen(str1);
264 /* Strip line ending. */
265 if (len && str1[len - 1] == '\n') {
266 str1[len - 1] = '\0';
268 if (len > 1 && str1[len - 2] == '\r') {
269 str1[len - 2] = '\0';
273 /* Construct the log entry. */
274 apr_snprintf(str2, sizeof(str2),
275 "[%s] [%s/sid#%pp][rid#%pp][%s][%d] %s\n",
276 current_logtime(msr->mp), ap_get_server_name(r), (r->server),
277 r, ((r->uri == NULL) ? "" : log_escape_nq(msr->mp, r->uri)),
278 level, (fixup ? log_escape_nq(msr->mp, str1) : str1));
280 /* Write to the debug log. */
281 if ((debuglog_fd != NULL)&&(level <= filter_debug_level)) {
282 nbytes = strlen(str2);
283 apr_file_write_full(debuglog_fd, str2, nbytes, &nbytes_written);
286 /* Send message levels 1-3 to the Apache error log and
287 * add it to the message list in the audit log. */
289 char *unique_id = (char *)get_env_var(r, "UNIQUE_ID");
290 char *hostname = (char *)msr->hostname;
292 if (unique_id != NULL) {
293 unique_id = apr_psprintf(msr->mp, " [unique_id \"%s\"]",
294 log_escape(msr->mp, unique_id));
298 if (hostname != NULL) {
299 hostname = apr_psprintf(msr->mp, " [hostname \"%s\"]",
300 log_escape(msr->mp, hostname));
304 ap_log_error(APLOG_MARK, APLOG_ERR | APLOG_NOERRNO, 0, r->server,
305 "[client %s] ModSecurity: %s%s [uri \"%s\"]%s", r->connection->remote_ip, str1,
306 hostname, log_escape(msr->mp, r->uri), unique_id);
308 /* Add this message to the list. */
310 /* Force relevency if this is an alert */
313 *(const char **)apr_array_push(msr->alerts) = apr_pstrdup(msr->mp, str1);
321 * Internal log helper function. Use msr_log instead.
323 void internal_log(request_rec *r, directory_config *dcfg, modsec_rec *msr,
324 int level, const char *text, va_list ap)
326 internal_log_ex(r, dcfg, msr, level, 0, text, ap);
330 * Logs one message at the given level to the debug log (and to the
331 * Apache error log if the message is important enough.
333 void msr_log(modsec_rec *msr, int level, const char *text, ...) {
337 internal_log_ex(msr->r, msr->txcfg, msr, level, 0, text, ap);
343 * Logs one message at level 3 to the debug log and to the
344 * Apache error log. This is intended for error callbacks.
346 void msr_log_error(modsec_rec *msr, const char *text, ...) {
350 internal_log_ex(msr->r, msr->txcfg, msr, 3, 1, text, ap);
355 * Logs one message at level 4 to the debug log and to the
356 * Apache error log. This is intended for warning callbacks.
358 * The 'text' will first be escaped.
360 void msr_log_warn(modsec_rec *msr, const char *text, ...) {
364 internal_log_ex(msr->r, msr->txcfg, msr, 4, 1, text, ap);
370 * Converts an Apache error log message into one line of text.
372 char *format_error_log_message(apr_pool_t *mp, error_message *em) {
373 char *s_file = "", *s_line = "", *s_level = "";
374 char *s_status = "", *s_message = "";
377 if (em == NULL) return NULL;
379 if (em->file != NULL) {
380 s_file = apr_psprintf(mp, "[file \"%s\"] ",
381 log_escape(mp, (char *)em->file));
382 if (s_file == NULL) return NULL;
386 s_line = apr_psprintf(mp, "[line %d] ", em->line);
387 if (s_line == NULL) return NULL;
390 s_level = apr_psprintf(mp, "[level %d] ", em->level);
391 if (s_level == NULL) return NULL;
393 if (em->status != 0) {
394 s_status = apr_psprintf(mp, "[status %d] ", em->status);
395 if (s_status == NULL) return NULL;
398 if (em->message != NULL) {
399 s_message = log_escape_nq(mp, em->message);
400 if (s_message == NULL) return NULL;
403 msg = apr_psprintf(mp, "%s%s%s%s%s", s_file, s_line, s_level, s_status, s_message);
404 if (msg == NULL) return NULL;
410 * Determines the reponse protocol Apache will use (or has used)
411 * to respond to the given request.
413 const char *get_response_protocol(request_rec *r) {
414 int proto_num = r->proto_num;
416 if (r->assbackwards) {
420 if (proto_num > HTTP_VERSION(1,0)
421 && apr_table_get(r->subprocess_env, "downgrade-1.0"))
423 proto_num = HTTP_VERSION(1,0);
426 if (proto_num == HTTP_VERSION(1,0)
427 && apr_table_get(r->subprocess_env, "force-response-1.0"))
432 return AP_SERVER_PROTOCOL;