Skip to content

Commit 7012449

Browse files
airweenairween
committed
Picked up modifications from owasp-modsecurity#273 
1 parent 6ee9481 commit 7012449

7 files changed

+47
-26
lines changed

Diff for: ‎src/ngx_http_modsecurity_body_filter.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ ngx_http_modsecurity_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
5050
return ngx_http_next_body_filter(r, in);
5151
}
5252

53-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
53+
ctx = ngx_http_modsecurity_get_module_ctx(r);
5454

5555
dd("body filter, recovering ctx: %p", ctx);
5656

Diff for: ‎src/ngx_http_modsecurity_common.h

+2
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,7 @@ typedef struct {
9999
unsigned processed:1;
100100
unsigned logged:1;
101101
unsigned intervention_triggered:1;
102+
unsigned request_body_processed:1;
102103
} ngx_http_modsecurity_ctx_t;
103104

104105

@@ -139,6 +140,7 @@ extern ngx_module_t ngx_http_modsecurity_module;
139140
/* ngx_http_modsecurity_module.c */
140141
int ngx_http_modsecurity_process_intervention (Transaction *transaction, ngx_http_request_t *r, ngx_int_t early_log);
141142
ngx_http_modsecurity_ctx_t *ngx_http_modsecurity_create_ctx(ngx_http_request_t *r);
143+
ngx_http_modsecurity_ctx_t *ngx_http_modsecurity_get_module_ctx(ngx_http_request_t *r);
142144
char *ngx_str_to_char(ngx_str_t a, ngx_pool_t *p);
143145
#if (NGX_PCRE2)
144146
#define ngx_http_modsecurity_pcre_malloc_init(x) NULL

Diff for: ‎src/ngx_http_modsecurity_header_filter.c

+10-10
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ ngx_http_modsecurity_store_ctx_header(ngx_http_request_t *r, ngx_str_t *name, ng
109109
ngx_http_modsecurity_conf_t *mcf;
110110
ngx_http_modsecurity_header_t *hdr;
111111

112-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
112+
ctx = ngx_http_modsecurity_get_module_ctx(r);
113113
if (ctx == NULL || ctx->sanity_headers_out == NULL) {
114114
return NGX_ERROR;
115115
}
@@ -152,7 +152,7 @@ ngx_http_modsecurity_resolv_header_server(ngx_http_request_t *r, ngx_str_t name,
152152
ngx_str_t value;
153153

154154
clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
155-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
155+
ctx = ngx_http_modsecurity_get_module_ctx(r);
156156

157157
if (r->headers_out.server == NULL) {
158158
if (clcf->server_tokens) {
@@ -186,7 +186,7 @@ ngx_http_modsecurity_resolv_header_date(ngx_http_request_t *r, ngx_str_t name, o
186186
ngx_http_modsecurity_ctx_t *ctx = NULL;
187187
ngx_str_t date;
188188

189-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
189+
ctx = ngx_http_modsecurity_get_module_ctx(r);
190190

191191
if (r->headers_out.date == NULL) {
192192
date.data = ngx_cached_http_time.data;
@@ -216,7 +216,7 @@ ngx_http_modsecurity_resolv_header_content_length(ngx_http_request_t *r, ngx_str
216216
ngx_str_t value;
217217
char buf[NGX_INT64_LEN+2];
218218

219-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
219+
ctx = ngx_http_modsecurity_get_module_ctx(r);
220220

221221
if (r->headers_out.content_length_n > 0)
222222
{
@@ -243,7 +243,7 @@ ngx_http_modsecurity_resolv_header_content_type(ngx_http_request_t *r, ngx_str_t
243243
{
244244
ngx_http_modsecurity_ctx_t *ctx = NULL;
245245

246-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
246+
ctx = ngx_http_modsecurity_get_module_ctx(r);
247247

248248
if (r->headers_out.content_type.len > 0)
249249
{
@@ -270,7 +270,7 @@ ngx_http_modsecurity_resolv_header_last_modified(ngx_http_request_t *r, ngx_str_
270270
u_char buf[1024], *p;
271271
ngx_str_t value;
272272

273-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
273+
ctx = ngx_http_modsecurity_get_module_ctx(r);
274274

275275
if (r->headers_out.last_modified_time == -1) {
276276
return 1;
@@ -302,7 +302,7 @@ ngx_http_modsecurity_resolv_header_connection(ngx_http_request_t *r, ngx_str_t n
302302
ngx_str_t value;
303303

304304
clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
305-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
305+
ctx = ngx_http_modsecurity_get_module_ctx(r);
306306

307307
if (r->headers_out.status == NGX_HTTP_SWITCHING_PROTOCOLS) {
308308
connection = "upgrade";
@@ -353,7 +353,7 @@ ngx_http_modsecurity_resolv_header_transfer_encoding(ngx_http_request_t *r, ngx_
353353
if (r->chunked) {
354354
ngx_str_t value = ngx_string("chunked");
355355

356-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
356+
ctx = ngx_http_modsecurity_get_module_ctx(r);
357357

358358
#if defined(MODSECURITY_SANITY_CHECKS) && (MODSECURITY_SANITY_CHECKS)
359359
ngx_http_modsecurity_store_ctx_header(r, &name, &value);
@@ -380,7 +380,7 @@ ngx_http_modsecurity_resolv_header_vary(ngx_http_request_t *r, ngx_str_t name, o
380380
if (r->gzip_vary && clcf->gzip_vary) {
381381
ngx_str_t value = ngx_string("Accept-Encoding");
382382

383-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
383+
ctx = ngx_http_modsecurity_get_module_ctx(r);
384384

385385
#if defined(MODSECURITY_SANITY_CHECKS) && (MODSECURITY_SANITY_CHECKS)
386386
ngx_http_modsecurity_store_ctx_header(r, &name, &value);
@@ -422,7 +422,7 @@ ngx_http_modsecurity_header_filter(ngx_http_request_t *r)
422422

423423
/* XXX: if NOT_MODIFIED, do we need to process it at all? see xslt_header_filter() */
424424

425-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
425+
ctx = ngx_http_modsecurity_get_module_ctx(r);
426426

427427
dd("header filter, recovering ctx: %p", ctx);
428428

Diff for: ‎src/ngx_http_modsecurity_log.c

+3-11
Original file line numberDiff line numberDiff line change
@@ -41,17 +41,9 @@ ngx_http_modsecurity_log_handler(ngx_http_request_t *r)
4141
{
4242
ngx_pool_t *old_pool;
4343
ngx_http_modsecurity_ctx_t *ctx;
44-
ngx_http_modsecurity_conf_t *mcf;
4544

4645
dd("catching a new _log_ phase handler");
4746

48-
mcf = ngx_http_get_module_loc_conf(r, ngx_http_modsecurity_module);
49-
if (mcf == NULL || mcf->enable != 1)
50-
{
51-
dd("ModSecurity not enabled... returning");
52-
return NGX_OK;
53-
}
54-
5547
/*
5648
if (r->method != NGX_HTTP_GET &&
5749
r->method != NGX_HTTP_POST && r->method != NGX_HTTP_HEAD) {
@@ -60,13 +52,13 @@ ngx_http_modsecurity_log_handler(ngx_http_request_t *r)
6052
return NGX_OK;
6153
}
6254
*/
63-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
55+
ctx = ngx_http_modsecurity_get_module_ctx(r);
6456

6557
dd("recovering ctx: %p", ctx);
6658

6759
if (ctx == NULL) {
68-
dd("something really bad happened here. returning NGX_ERROR");
69-
return NGX_ERROR;
60+
dd("ModSecurity not enabled or error occurred");
61+
return NGX_OK;
7062
}
7163

7264
if (ctx->logged) {

Diff for: ‎src/ngx_http_modsecurity_module.c

+22-1
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,7 @@ ngx_http_modsecurity_process_intervention (Transaction *transaction, ngx_http_re
149149

150150
dd("processing intervention");
151151

152-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
152+
ctx = ngx_http_modsecurity_get_module_ctx(r);
153153
if (ctx == NULL)
154154
{
155155
return NGX_HTTP_INTERNAL_SERVER_ERROR;
@@ -313,6 +313,27 @@ ngx_http_modsecurity_create_ctx(ngx_http_request_t *r)
313313
return ctx;
314314
}
315315

316+
ngx_inline ngx_http_modsecurity_ctx_t *
317+
ngx_http_modsecurity_get_module_ctx(ngx_http_request_t *r)
318+
{
319+
ngx_http_modsecurity_ctx_t *ctx;
320+
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
321+
if (ctx == NULL) {
322+
/*
323+
* refer <nginx>/src/http/modules/ngx_http_realip_module.c
324+
* if module context was reset, the original address
325+
* can still be found in the cleanup handler
326+
*/
327+
ngx_pool_cleanup_t *cln;
328+
for (cln = r->pool->cleanup; cln; cln = cln->next) {
329+
if (cln->handler == ngx_http_modsecurity_cleanup) {
330+
ctx = cln->data;
331+
break;
332+
}
333+
}
334+
}
335+
return ctx;
336+
}
316337

317338
char *
318339
ngx_conf_set_rules(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)

Diff for: ‎src/ngx_http_modsecurity_pre_access.c

+8-2
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ ngx_http_modsecurity_request_read(ngx_http_request_t *r)
2727
{
2828
ngx_http_modsecurity_ctx_t *ctx;
2929

30-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
30+
ctx = ngx_http_modsecurity_get_module_ctx(r);
3131

3232
#if defined(nginx_version) && nginx_version >= 8011
3333
r->main->count--;
@@ -70,7 +70,7 @@ ngx_http_modsecurity_pre_access_handler(ngx_http_request_t *r)
7070
}
7171
*/
7272

73-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
73+
ctx = ngx_http_modsecurity_get_module_ctx(r);
7474

7575
dd("recovering ctx: %p", ctx);
7676

@@ -80,6 +80,11 @@ ngx_http_modsecurity_pre_access_handler(ngx_http_request_t *r)
8080
return NGX_HTTP_INTERNAL_SERVER_ERROR;
8181
}
8282

83+
if (ctx->request_body_processed) {
84+
// should we use r->internal or r->filter_finalize?
85+
return NGX_DECLINED;
86+
}
87+
8388
if (ctx->intervention_triggered) {
8489
return NGX_DECLINED;
8590
}
@@ -212,6 +217,7 @@ ngx_http_modsecurity_pre_access_handler(ngx_http_request_t *r)
212217

213218
old_pool = ngx_http_modsecurity_pcre_malloc_init(r->pool);
214219
msc_process_request_body(ctx->modsec_transaction);
220+
ctx->request_body_processed = 1;
215221
ngx_http_modsecurity_pcre_malloc_done(old_pool);
216222

217223
ret = ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r, 0);

Diff for: ‎src/ngx_http_modsecurity_rewrite.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ ngx_http_modsecurity_rewrite_handler(ngx_http_request_t *r)
4646

4747
dd("catching a new _rewrite_ phase handler");
4848

49-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
49+
ctx = ngx_http_modsecurity_get_module_ctx(r);
5050

5151
dd("recovering ctx: %p", ctx);
5252

0 commit comments

Comments
 (0)