Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit a6b32c3

Browse files
mlevogianniskolotourosthanosgn
committed
Fix phase 2 and 3 audit logging in case of internal redirect
Phase 2 and 3 log entries were not logged in the audit log in case of an internal redirect. Only phase 1 and 4 ones were logged, the former because early logging was explicitly enabled and the latter because the internal redirect does not work in this phase. This commit unconditionally enables early logging in all ModSecurity phases. Since the Nginx log phase may not be executed in case of an intervention, the process intervention function is the only place which is guaranteed to call the log handler in such a case. Co-authored-by: Dimitris Kolotouros <dkolotouros@noc.grnet.gr> Co-authored-by: Thanos Giannopoulos <thanosgn@noc.grnet.gr>
1 parent 3e26840 commit a6b32c3

7 files changed

+13
-15
lines changed

‎src/ngx_http_modsecurity_body_filter.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,7 @@ ngx_http_modsecurity_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
145145
int ret;
146146

147147
msc_append_response_body(ctx->modsec_transaction, data, chain->buf->last - data);
148-
ret = ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r, 0);
148+
ret = ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r);
149149
if (ret > 0) {
150150
return ngx_http_filter_finalize_request(r,
151151
&ngx_http_modsecurity_module, ret);
@@ -163,7 +163,7 @@ ngx_http_modsecurity_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
163163

164164
/* XXX: I don't get how body from modsec being transferred to nginx's buffer. If so - after adjusting of nginx's
165165
XXX: body we can proceed to adjust body size (content-length). see xslt_body_filter() for example */
166-
ret = ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r, 0);
166+
ret = ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r);
167167
if (ret > 0) {
168168
return ret;
169169
}

‎src/ngx_http_modsecurity_common.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ typedef struct {
137137
extern ngx_module_t ngx_http_modsecurity_module;
138138

139139
/* ngx_http_modsecurity_module.c */
140-
int ngx_http_modsecurity_process_intervention (Transaction *transaction, ngx_http_request_t *r, ngx_int_tearly_log);
140+
int ngx_http_modsecurity_process_intervention (Transaction *transaction, ngx_http_request_t *r);
141141
ngx_http_modsecurity_ctx_t *ngx_http_modsecurity_create_ctx(ngx_http_request_t *r);
142142
char *ngx_str_to_char(ngx_str_t a, ngx_pool_t *p);
143143
ngx_pool_t *ngx_http_modsecurity_pcre_malloc_init(ngx_pool_t *pool);

‎src/ngx_http_modsecurity_header_filter.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -526,7 +526,7 @@ ngx_http_modsecurity_header_filter(ngx_http_request_t *r)
526526
old_pool = ngx_http_modsecurity_pcre_malloc_init(r->pool);
527527
msc_process_response_headers(ctx->modsec_transaction, status, http_response_ver);
528528
ngx_http_modsecurity_pcre_malloc_done(old_pool);
529-
ret = ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r, 0);
529+
ret = ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r);
530530
if (r->error_page) {
531531
return ngx_http_next_header_filter(r);
532532
}

‎src/ngx_http_modsecurity_log.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ ngx_http_modsecurity_log_handler(ngx_http_request_t *r)
7676
old_pool = ngx_http_modsecurity_pcre_malloc_init(r->pool);
7777
msc_process_logging(ctx->modsec_transaction);
7878
ngx_http_modsecurity_pcre_malloc_done(old_pool);
79+
ctx->logged = 1;
7980

8081
return NGX_OK;
8182
}

‎src/ngx_http_modsecurity_module.c‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -130,7 +130,7 @@ ngx_inline char *ngx_str_to_char(ngx_str_t a, ngx_pool_t *p)
130130

131131

132132
ngx_inline int
133-
ngx_http_modsecurity_process_intervention(Transaction *transaction, ngx_http_request_t *r, ngx_int_tearly_log)
133+
ngx_http_modsecurity_process_intervention(Transaction *transaction, ngx_http_request_t *r)
134134
{
135135
char *log = NULL;
136136
ModSecurityIntervention intervention;
@@ -215,11 +215,8 @@ ngx_http_modsecurity_process_intervention (Transaction *transaction, ngx_http_re
215215
*/
216216
msc_update_status_code(ctx->modsec_transaction, intervention.status);
217217

218-
if (early_log) {
219-
dd("intervention -- calling log handler manually with code: %d", intervention.status);
220-
ngx_http_modsecurity_log_handler(r);
221-
ctx->logged = 1;
222-
}
218+
dd("intervention -- calling log handler manually with code: %d", intervention.status);
219+
ngx_http_modsecurity_log_handler(r);
223220

224221
if (r->header_sent)
225222
{

‎src/ngx_http_modsecurity_pre_access.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -193,7 +193,7 @@ ngx_http_modsecurity_pre_access_handler(ngx_http_request_t *r)
193193
* it may ask for a intervention in consequence of that.
194194
*
195195
*/
196-
ret = ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r, 0);
196+
ret = ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r);
197197
if (ret > 0) {
198198
return ret;
199199
}
@@ -212,7 +212,7 @@ ngx_http_modsecurity_pre_access_handler(ngx_http_request_t *r)
212212
msc_process_request_body(ctx->modsec_transaction);
213213
ngx_http_modsecurity_pcre_malloc_done(old_pool);
214214

215-
ret = ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r, 0);
215+
ret = ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r);
216216
if (r->error_page) {
217217
return NGX_DECLINED;
218218
}

‎src/ngx_http_modsecurity_rewrite.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ ngx_http_modsecurity_rewrite_handler(ngx_http_request_t *r)
115115
*
116116
*/
117117
dd("Processing intervention with the connection information filled in");
118-
ret = ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r, 1);
118+
ret = ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r);
119119
if (ret > 0) {
120120
ctx->intervention_triggered = 1;
121121
return ret;
@@ -156,7 +156,7 @@ ngx_http_modsecurity_rewrite_handler(ngx_http_request_t *r)
156156
ngx_http_modsecurity_pcre_malloc_done(old_pool);
157157

158158
dd("Processing intervention with the transaction information filled in (uri, method and version)");
159-
ret = ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r, 1);
159+
ret = ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r);
160160
if (ret > 0) {
161161
ctx->intervention_triggered = 1;
162162
return ret;
@@ -205,7 +205,7 @@ ngx_http_modsecurity_rewrite_handler(ngx_http_request_t *r)
205205
msc_process_request_headers(ctx->modsec_transaction);
206206
ngx_http_modsecurity_pcre_malloc_done(old_pool);
207207
dd("Processing intervention with the request headers information filled in");
208-
ret = ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r, 1);
208+
ret = ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r);
209209
if (r->error_page) {
210210
return NGX_DECLINED;
211211
}

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /