Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit bec3381

Browse files
Move log opening to appropriate execution phase
When piped logs are opened during parsing of configuration it results in unexpected situations in apache httpd and can cause hang of process which is trying to log into auditlog. Code should work as before, with the exception of one additional condition evaluation when primary audit log is not set and secondary audit log path to piped executable is now not relative to server root.
1 parent d7f2be6 commit bec3381

File tree

4 files changed

+56
-58
lines changed

4 files changed

+56
-58
lines changed

‎apache2/apache2_config.c

Lines changed: 0 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -1239,35 +1239,6 @@ static const char *cmd_audit_log(cmd_parms *cmd, void *_dcfg, const char *p1)
12391239
directory_config *dcfg = _dcfg;
12401240

12411241
dcfg->auditlog_name = (char *)p1;
1242-
1243-
if (dcfg->auditlog_name[0] == '|') {
1244-
const char *pipe_name = dcfg->auditlog_name + 1;
1245-
piped_log *pipe_log;
1246-
1247-
pipe_log = ap_open_piped_log(cmd->pool, pipe_name);
1248-
if (pipe_log == NULL) {
1249-
return apr_psprintf(cmd->pool, "ModSecurity: Failed to open the audit log pipe: %s",
1250-
pipe_name);
1251-
}
1252-
dcfg->auditlog_fd = ap_piped_log_write_fd(pipe_log);
1253-
}
1254-
else {
1255-
const char *file_name = ap_server_root_relative(cmd->pool, dcfg->auditlog_name);
1256-
apr_status_t rc;
1257-
1258-
if (dcfg->auditlog_fileperms == NOT_SET) {
1259-
dcfg->auditlog_fileperms = CREATEMODE;
1260-
}
1261-
rc = apr_file_open(&dcfg->auditlog_fd, file_name,
1262-
APR_WRITE | APR_APPEND | APR_CREATE | APR_BINARY,
1263-
dcfg->auditlog_fileperms, cmd->pool);
1264-
1265-
if (rc != APR_SUCCESS) {
1266-
return apr_psprintf(cmd->pool, "ModSecurity: Failed to open the audit log file: %s",
1267-
file_name);
1268-
}
1269-
}
1270-
12711242
return NULL;
12721243
}
12731244

@@ -1283,35 +1254,6 @@ static const char *cmd_audit_log2(cmd_parms *cmd, void *_dcfg, const char *p1)
12831254
}
12841255

12851256
dcfg->auditlog2_name = (char *)p1;
1286-
1287-
if (dcfg->auditlog2_name[0] == '|') {
1288-
const char *pipe_name = ap_server_root_relative(cmd->pool, dcfg->auditlog2_name + 1);
1289-
piped_log *pipe_log;
1290-
1291-
pipe_log = ap_open_piped_log(cmd->pool, pipe_name);
1292-
if (pipe_log == NULL) {
1293-
return apr_psprintf(cmd->pool, "ModSecurity: Failed to open the secondary audit log pipe: %s",
1294-
pipe_name);
1295-
}
1296-
dcfg->auditlog2_fd = ap_piped_log_write_fd(pipe_log);
1297-
}
1298-
else {
1299-
const char *file_name = ap_server_root_relative(cmd->pool, dcfg->auditlog2_name);
1300-
apr_status_t rc;
1301-
1302-
if (dcfg->auditlog_fileperms == NOT_SET) {
1303-
dcfg->auditlog_fileperms = CREATEMODE;
1304-
}
1305-
rc = apr_file_open(&dcfg->auditlog2_fd, file_name,
1306-
APR_WRITE | APR_APPEND | APR_CREATE | APR_BINARY,
1307-
dcfg->auditlog_fileperms, cmd->pool);
1308-
1309-
if (rc != APR_SUCCESS) {
1310-
return apr_psprintf(cmd->pool, "ModSecurity: Failed to open the secondary audit log file: %s",
1311-
file_name);
1312-
}
1313-
}
1314-
13151257
return NULL;
13161258
}
13171259

‎apache2/mod_security2.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1735,6 +1735,7 @@ static void register_hooks(apr_pool_t *mp) {
17351735

17361736
/* Logging */
17371737
ap_hook_error_log(hook_error_log, NULL, NULL, APR_HOOK_MIDDLE);
1738+
ap_hook_open_logs(modsec_open_logs, NULL, NULL, APR_HOOK_MIDDLE);
17381739
ap_hook_log_transaction(hook_log_transaction, NULL, transaction_afterme_list, APR_HOOK_MIDDLE);
17391740

17401741
/* Filter hooks */

‎apache2/msc_logging.c

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2316,3 +2316,55 @@ void sec_audit_logger(modsec_rec *msr) {
23162316
}
23172317
#endif
23182318
}
2319+
2320+
static int open_audit_log(char *auditlog_name, unsigned char primary, apr_file_t **auditlog_fd,
2321+
apr_fileperms_t *auditlog_fileperms, apr_pool_t *p) {
2322+
if (auditlog_name == NOT_SET_P) {
2323+
return OK;
2324+
}
2325+
if (auditlog_name[0] == '|') {
2326+
const char *pipe_name = auditlog_name + 1;
2327+
piped_log *pipe_log;
2328+
2329+
pipe_log = ap_open_piped_log(p, pipe_name);
2330+
if (pipe_log == NULL) {
2331+
ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL,
2332+
"ModSecurity: Failed to open the %saudit log pipe: %s",
2333+
primary ? "" : "secondary ", pipe_name);
2334+
return primary ? DONE : OK;
2335+
}
2336+
*auditlog_fd = ap_piped_log_write_fd(pipe_log);
2337+
}
2338+
else {
2339+
const char *file_name = ap_server_root_relative(p, auditlog_name);
2340+
apr_status_t rc;
2341+
2342+
if (*auditlog_fileperms == NOT_SET) {
2343+
*auditlog_fileperms = CREATEMODE;
2344+
}
2345+
rc = apr_file_open(auditlog_fd, file_name,
2346+
APR_WRITE | APR_APPEND | APR_CREATE | APR_BINARY,
2347+
*auditlog_fileperms, p);
2348+
2349+
if (rc != APR_SUCCESS) {
2350+
ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL,
2351+
"ModSecurity: Failed to open the %saudit log file: %s",
2352+
primary ? "" : "secondary ", file_name);
2353+
return primary ? DONE : OK;
2354+
}
2355+
}
2356+
2357+
return OK;
2358+
}
2359+
2360+
int modsec_open_logs(apr_pool_t *pconf, apr_pool_t *p, apr_pool_t *ptemp, server_rec *s_main) {
2361+
directory_config *dcfg = ap_get_module_config(s_main->lookup_defaults, &security2_module);
2362+
2363+
int primary_log_rc = open_audit_log(dcfg->auditlog_name, 1,
2364+
&dcfg->auditlog_fd, &dcfg->auditlog_fileperms, p);
2365+
if (primary_log_rc != OK) {
2366+
return primary_log_rc;
2367+
}
2368+
return open_audit_log(dcfg->auditlog2_name, 0,
2369+
&dcfg->auditlog2_fd, &dcfg->auditlog_fileperms, p);
2370+
}

‎apache2/msc_logging.h

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@
4343
#define AUDITLOG_PART_ENDMARKER 'Z'
4444

4545
#include "modsecurity.h"
46+
#include "httpd.h"
4647
#include "apr_pools.h"
4748

4849
int DSOLOCAL is_valid_parts_specification(char *p);
@@ -51,4 +52,6 @@ char DSOLOCAL *construct_log_vcombinedus_limited(modsec_rec *msr, int _limit, in
5152

5253
void DSOLOCAL sec_audit_logger(modsec_rec *msr);
5354

55+
int modsec_open_logs(apr_pool_t *pconf, apr_pool_t *p, apr_pool_t *ptemp, server_rec *s_main);
56+
5457
#endif

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /