Blame apache2/apache2_util.c

Packit 284210
/*
Packit 284210
* ModSecurity for Apache 2.x, http://www.modsecurity.org/
Packit 284210
* Copyright (c) 2004-2013 Trustwave Holdings, Inc. (http://www.trustwave.com/)
Packit 284210
*
Packit 284210
* You may not use this file except in compliance with
Packit 284210
* the License.  You may obtain a copy of the License at
Packit 284210
*
Packit 284210
*     http://www.apache.org/licenses/LICENSE-2.0
Packit 284210
*
Packit 284210
* If any of the files related to licensing are missing or if you have any
Packit 284210
* other questions related to licensing please contact Trustwave Holdings, Inc.
Packit 284210
* directly using the email address security@modsecurity.org.
Packit 284210
*/
Packit 284210
Packit 284210
#include "modsecurity.h"
Packit 284210
#include "apache2.h"
Packit 284210
#include "http_core.h"
Packit 284210
#include "util_script.h"
Packit 284210
Packit 284210
/**
Packit 284210
 * Sends a brigade with an error bucket down the filter chain.
Packit 284210
 */
Packit 284210
apr_status_t send_error_bucket(modsec_rec *msr, ap_filter_t *f, int status) {
Packit 284210
    apr_bucket_brigade *brigade = NULL;
Packit 284210
    apr_bucket *bucket = NULL;
Packit 284210
Packit 284210
    /* Set the status line explicitly for the error document */
Packit 284210
    f->r->status_line = ap_get_status_line(status);
Packit 284210
Packit 284210
    brigade = apr_brigade_create(f->r->pool, f->r->connection->bucket_alloc);
Packit 284210
    if (brigade == NULL) return APR_EGENERAL;
Packit 284210
Packit 284210
    bucket = ap_bucket_error_create(status, NULL, f->r->pool, f->r->connection->bucket_alloc);
Packit 284210
    if (bucket == NULL) return APR_EGENERAL;
Packit 284210
Packit 284210
    APR_BRIGADE_INSERT_TAIL(brigade, bucket);
Packit 284210
Packit 284210
    bucket = apr_bucket_eos_create(f->r->connection->bucket_alloc);
Packit 284210
    if (bucket == NULL) return APR_EGENERAL;
Packit 284210
Packit 284210
    APR_BRIGADE_INSERT_TAIL(brigade, bucket);
Packit 284210
Packit 284210
    ap_pass_brigade(f->next, brigade);
Packit 284210
Packit 284210
    /* NOTE:
Packit 284210
     * It may not matter what we do from the filter as it may be too
Packit 284210
     * late to even generate an error (already sent to client).  Nick Kew
Packit 284210
     * recommends to return APR_EGENERAL in hopes that the handler in control
Packit 284210
     * will notice and do The Right Thing.  So, that is what we do now.
Packit 284210
     */
Packit 284210
Packit 284210
    return APR_EGENERAL;
Packit 284210
}
Packit 284210
Packit 284210
/**
Packit 284210
 * Execute system command. First line of the output will be returned in
Packit 284210
 * the "output" parameter.
Packit 284210
 */
Packit 284210
int apache2_exec(modsec_rec *msr, const char *command, const char **argv, char **output) {
Packit 284210
    apr_procattr_t *procattr = NULL;
Packit 284210
    apr_proc_t *procnew = NULL;
Packit 284210
    apr_status_t rc = APR_SUCCESS;
Packit 284210
    const char *const *env = NULL;
Packit 284210
    apr_file_t *script_out = NULL;
Packit 284210
    request_rec *r = msr->r;
Packit 284210
Packit 284210
    if (argv == NULL) {
Packit 284210
        argv = apr_pcalloc(r->pool, 3 * sizeof(char *));
Packit 284210
        argv[0] = command;
Packit 284210
        argv[1] = NULL;
Packit 284210
    }
Packit 284210
Packit 284210
    ap_add_cgi_vars(r);
Packit 284210
    ap_add_common_vars(r);
Packit 284210
Packit 284210
    /* PHP hack, getting around its silly security checks. */
Packit 284210
    apr_table_add(r->subprocess_env, "PATH_TRANSLATED", command);
Packit 284210
    apr_table_add(r->subprocess_env, "REDIRECT_STATUS", "302");
Packit 284210
Packit 284210
    env = (const char * const *)ap_create_environment(r->pool, r->subprocess_env);
Packit 284210
    if (env == NULL) {
Packit 284210
        msr_log(msr, 1, "Exec: Unable to create environment.");
Packit 284210
        return -1;
Packit 284210
    }
Packit 284210
Packit 284210
    procnew = apr_pcalloc(r->pool, sizeof(*procnew));
Packit 284210
    if (procnew == NULL) {
Packit 284210
        msr_log(msr, 1, "Exec: Unable to allocate %lu bytes.", (unsigned long)sizeof(*procnew));
Packit 284210
        return -1;
Packit 284210
    }
Packit 284210
Packit 284210
    apr_procattr_create(&procattr, r->pool);
Packit 284210
    if (procattr == NULL) {
Packit 284210
        msr_log(msr, 1, "Exec: Unable to create procattr.");
Packit 284210
        return -1;
Packit 284210
    }
Packit 284210
Packit 284210
    apr_procattr_io_set(procattr, APR_NO_PIPE, APR_FULL_BLOCK, APR_NO_PIPE);
Packit 284210
    apr_procattr_cmdtype_set(procattr, APR_SHELLCMD);
Packit 284210
Packit 284210
    if (msr->txcfg->debuglog_level >= 9) {
Packit 284210
        msr_log(msr, 9, "Exec: %s", log_escape_nq(r->pool, command));
Packit 284210
    }
Packit 284210
Packit 284210
    rc = apr_proc_create(procnew, command, argv, env, procattr, r->pool);
Packit 284210
    if (rc != APR_SUCCESS) {
Packit 284210
        msr_log(msr, 1, "Exec: Execution failed: %s (%s)", log_escape_nq(r->pool, command),
Packit 284210
            get_apr_error(r->pool, rc));
Packit 284210
        return -1;
Packit 284210
    }
Packit 284210
Packit 284210
    apr_pool_note_subprocess(r->pool, procnew, APR_KILL_AFTER_TIMEOUT);
Packit 284210
Packit 284210
    script_out = procnew->out;
Packit 284210
    if (!script_out) {
Packit 284210
        msr_log(msr, 1, "Exec: Failed to get script output pipe.");
Packit 284210
        return -1;
Packit 284210
    }
Packit 284210
Packit 284210
    apr_file_pipe_timeout_set(script_out, r->server->timeout);
Packit 284210
Packit 284210
    /* Now read from the pipe. */
Packit 284210
    {
Packit 284210
        char buf[260] = "";
Packit 284210
        char *p = buf;
Packit 284210
        apr_size_t nbytes = 255;
Packit 284210
        apr_status_t rc2;
Packit 284210
Packit 284210
        rc2 = apr_file_read(script_out, buf, &nbytes);
Packit 284210
        if (rc2 == APR_SUCCESS) {
Packit 284210
            buf[nbytes] = 0;
Packit 284210
Packit 284210
            /* if there is more than one line ignore them */
Packit 284210
            while(*p != 0) {
Packit 284210
                if (*p == 0x0a) *p = 0;
Packit 284210
                p++;
Packit 284210
            }
Packit 284210
Packit 284210
            if (msr->txcfg->debuglog_level >= 4) {
Packit 284210
                msr_log(msr, 4, "Exec: First line from script output: \"%s\"",
Packit 284210
                    log_escape(r->pool, buf));
Packit 284210
            }
Packit 284210
Packit 284210
            if (output != NULL) *output = apr_pstrdup(r->pool, buf);
Packit 284210
Packit 284210
            /* Soak up the remaining data. */
Packit 284210
            nbytes = 255;
Packit 284210
            while(apr_file_read(script_out, buf, &nbytes) == APR_SUCCESS) nbytes = 255;
Packit 284210
        } else {
Packit 284210
            msr_log(msr, 1, "Exec: Execution failed while reading output: %s (%s)",
Packit 284210
                log_escape_nq(r->pool, command),
Packit 284210
                get_apr_error(r->pool, rc2));
Packit 284210
            return -1;
Packit 284210
        }
Packit 284210
    }
Packit 284210
Packit 284210
    apr_proc_wait(procnew, NULL, NULL, APR_WAIT);
Packit 284210
Packit 284210
    return 1;
Packit 284210
}
Packit 284210
Packit 284210
/**
Packit 284210
 * Returns a new string that contains the error
Packit 284210
 * message for the given return code.
Packit 284210
 */
Packit 284210
char *get_apr_error(apr_pool_t *p, apr_status_t rc) {
Packit 284210
    char *text = apr_pcalloc(p, 201);
Packit 284210
    if (text == NULL) return NULL;
Packit 284210
    apr_strerror(rc, text, 200);
Packit 284210
    return text;
Packit 284210
}
Packit 284210
Packit 284210
/**
Packit 284210
 * Retrieve named environment variable.
Packit 284210
 */
Packit 284210
char *get_env_var(request_rec *r, char *name) {
Packit 284210
    char *result = (char *)apr_table_get(r->notes, name);
Packit 284210
Packit 284210
    if (result == NULL) {
Packit 284210
        result = (char *)apr_table_get(r->subprocess_env, name);
Packit 284210
    }
Packit 284210
Packit 284210
    if (result == NULL) {
Packit 284210
        result = getenv(name);
Packit 284210
    }
Packit 284210
Packit 284210
    return result;
Packit 284210
}
Packit 284210
Packit 284210
/**
Packit 284210
 * Extended internal log helper function. Use msr_log instead. If fixup is
Packit 284210
 * true, the message will be stripped of any trailing newline and any
Packit 284210
 * required bytes will be escaped.
Packit 284210
 */
Packit 284210
static void internal_log_ex(request_rec *r, directory_config *dcfg, modsec_rec *msr,
Packit 284210
    int level, int fixup, const char *text, va_list ap)
Packit 284210
{
Packit 284210
    apr_size_t nbytes, nbytes_written;
Packit 284210
    apr_file_t *debuglog_fd = NULL;
Packit 284210
    int filter_debug_level = 0;
Packit 284210
    char *remote = NULL;
Packit 284210
    char *parse_remote = NULL;
Packit 284210
    char *saved = NULL;
Packit 284210
    char *str = NULL;
Packit 284210
    char str1[1024] = "";
Packit 284210
    char str2[1256] = "";
Packit 284210
Packit 284210
    /* Find the logging FD and determine the logging level from configuration. */
Packit 284210
    if (dcfg != NULL) {
Packit 284210
        if ((dcfg->debuglog_fd != NULL)&&(dcfg->debuglog_fd != NOT_SET_P)) {
Packit 284210
            debuglog_fd = dcfg->debuglog_fd;
Packit 284210
        }
Packit 284210
Packit 284210
        if (dcfg->debuglog_level != NOT_SET) {
Packit 284210
            filter_debug_level = dcfg->debuglog_level;
Packit 284210
        }
Packit 284210
    }
Packit 284210
Packit 284210
    /* Return immediately if we don't have where to write
Packit 284210
     * or if the log level of the message is higher than
Packit 284210
     * wanted in the log.
Packit 284210
     */
Packit 284210
    if ((level > 3)&&( (debuglog_fd == NULL) || (level > filter_debug_level) )) return;
Packit 284210
Packit 284210
    /* Construct the message. */
Packit 284210
    apr_vsnprintf(str1, sizeof(str1), text, ap);
Packit 284210
    if (fixup) {
Packit 284210
        int len = strlen(str1);
Packit 284210
Packit 284210
        /* Strip line ending. */
Packit 284210
        if (len && str1[len - 1] == '\n') {
Packit 284210
            str1[len - 1] = '\0';
Packit 284210
        }
Packit 284210
        if (len > 1 && str1[len - 2] == '\r') {
Packit 284210
            str1[len - 2] = '\0';
Packit 284210
        }
Packit 284210
    }
Packit 284210
Packit 284210
    /* Construct the log entry. */
Packit 284210
    apr_snprintf(str2, sizeof(str2), 
Packit 284210
        "[%s] [%s/sid#%pp][rid#%pp][%s][%d] %s\n",
Packit 284210
        current_logtime(msr->mp), ap_get_server_name(r), (r->server),
Packit 284210
        r, ((r->uri == NULL) ? "" : log_escape_nq(msr->mp, r->uri)),
Packit 284210
        level, (fixup ? log_escape_nq(msr->mp, str1) : str1));
Packit 284210
Packit 284210
    /* Write to the debug log. */
Packit 284210
    if ((debuglog_fd != NULL)&&(level <= filter_debug_level)) {
Packit 284210
        nbytes = strlen(str2);
Packit 284210
        apr_file_write_full(debuglog_fd, str2, nbytes, &nbytes_written);
Packit 284210
    }
Packit 284210
Packit 284210
    /* Send message levels 1-3 to the Apache error log and 
Packit 284210
     * add it to the message list in the audit log. */
Packit 284210
    if (level <= 3) {
Packit 284210
        char *unique_id = (char *)get_env_var(r, "UNIQUE_ID");
Packit 284210
        char *hostname = (char *)msr->hostname;
Packit 284210
Packit 284210
        if (unique_id != NULL) {
Packit 284210
            unique_id = apr_psprintf(msr->mp, " [unique_id \"%s\"]",
Packit 284210
                log_escape(msr->mp, unique_id));
Packit 284210
        }
Packit 284210
        else unique_id = "";
Packit 284210
Packit 284210
        if (hostname != NULL) {
Packit 284210
            hostname = apr_psprintf(msr->mp, " [hostname \"%s\"]",
Packit 284210
                log_escape(msr->mp, hostname));
Packit 284210
        }
Packit 284210
        else hostname = "";
Packit 284210
Packit 284210
#if AP_SERVER_MAJORVERSION_NUMBER > 1 && AP_SERVER_MINORVERSION_NUMBER > 2
Packit 284210
	ap_log_rerror(APLOG_MARK, APLOG_ERR | APLOG_NOERRNO, 0, r,
Packit 284210
            "[client %s] ModSecurity: %s%s [uri \"%s\"]%s", r->useragent_ip ? r->useragent_ip : r->connection->client_ip, str1,
Packit 284210
            hostname, log_escape(msr->mp, r->uri), unique_id);
Packit 284210
#else
Packit 284210
        ap_log_error(APLOG_MARK, APLOG_ERR | APLOG_NOERRNO, 0, r->server,
Packit 284210
                "[client %s] ModSecurity: %s%s [uri \"%s\"]%s", msr->remote_addr ? msr->remote_addr : r->connection->remote_ip, str1,
Packit 284210
                hostname, log_escape(msr->mp, r->uri), unique_id);
Packit 284210
#endif
Packit 284210
Packit 284210
        /* Add this message to the list. */
Packit 284210
        if (msr != NULL) {
Packit 284210
            /* Force relevency if this is an alert */
Packit 284210
            msr->is_relevant++;
Packit 284210
Packit 284210
            *(const char **)apr_array_push(msr->alerts) = apr_pstrdup(msr->mp, str1);
Packit 284210
        }
Packit 284210
    }
Packit 284210
Packit 284210
    return;
Packit 284210
}
Packit 284210
Packit 284210
/**
Packit 284210
 * Logs one message at the given level to the debug log (and to the
Packit 284210
 * Apache error log if the message is important enough.
Packit 284210
 */
Packit 284210
void msr_log(modsec_rec *msr, int level, const char *text, ...) {
Packit 284210
    va_list ap;
Packit 284210
Packit 284210
    va_start(ap, text);
Packit 284210
    internal_log_ex(msr->r, msr->txcfg, msr, level, 0, text, ap);
Packit 284210
    va_end(ap);
Packit 284210
}
Packit 284210
Packit 284210
Packit 284210
/**
Packit 284210
 * Logs one message at level 3 to the debug log and to the
Packit 284210
 * Apache error log. This is intended for error callbacks.
Packit 284210
 */
Packit 284210
void msr_log_error(modsec_rec *msr, const char *text, ...) {
Packit 284210
    va_list ap;
Packit 284210
Packit 284210
    va_start(ap, text);
Packit 284210
    internal_log_ex(msr->r, msr->txcfg, msr, 3, 1, text, ap);
Packit 284210
    va_end(ap);
Packit 284210
}
Packit 284210
Packit 284210
/**
Packit 284210
 * Logs one message at level 4 to the debug log and to the
Packit 284210
 * Apache error log. This is intended for warning callbacks.
Packit 284210
 *
Packit 284210
 * The 'text' will first be escaped.
Packit 284210
 */
Packit 284210
void msr_log_warn(modsec_rec *msr, const char *text, ...) {
Packit 284210
    va_list ap;
Packit 284210
Packit 284210
    va_start(ap, text);
Packit 284210
    internal_log_ex(msr->r, msr->txcfg, msr, 4, 1, text, ap);
Packit 284210
    va_end(ap);
Packit 284210
}
Packit 284210
Packit 284210
Packit 284210
/**
Packit 284210
 * Converts an Apache error log message into one line of text.
Packit 284210
 */
Packit 284210
char *format_error_log_message(apr_pool_t *mp, error_message_t *em) {
Packit 284210
    char *s_file = "", *s_line = "", *s_level = "";
Packit 284210
    char *s_status = "", *s_message = "";
Packit 284210
    char *msg = NULL;
Packit 284210
Packit 284210
    if (em == NULL) return NULL;
Packit 284210
Packit 284210
#ifndef LOG_NO_FILENAME
Packit 284210
    if (em->file != NULL) {
Packit 284210
        s_file = apr_psprintf(mp, "[file \"%s\"] ",
Packit 284210
            log_escape(mp, (char *)em->file));
Packit 284210
        if (s_file == NULL) return NULL;
Packit 284210
    }
Packit 284210
Packit 284210
    if (em->line > 0) {
Packit 284210
        s_line = apr_psprintf(mp, "[line %d] ", em->line);
Packit 284210
        if (s_line == NULL) return NULL;
Packit 284210
    }
Packit 284210
#endif
Packit 284210
Packit 284210
    s_level = apr_psprintf(mp, "[level %d] ", em->level);
Packit 284210
    if (s_level == NULL) return NULL;
Packit 284210
Packit 284210
    if (em->status != 0) {
Packit 284210
        s_status = apr_psprintf(mp, "[status %d] ", em->status);
Packit 284210
        if (s_status == NULL) return NULL;
Packit 284210
    }
Packit 284210
Packit 284210
    if (em->message != NULL) {
Packit 284210
        s_message = log_escape_nq(mp, em->message);
Packit 284210
        if (s_message == NULL) return NULL;
Packit 284210
    }
Packit 284210
Packit 284210
    msg = apr_psprintf(mp, "%s%s%s%s%s", s_file, s_line, s_level, s_status, s_message);
Packit 284210
    if (msg == NULL) return NULL;
Packit 284210
Packit 284210
    return msg;
Packit 284210
}
Packit 284210
Packit 284210
/**
Packit 284210
 * Determines the reponse protocol Apache will use (or has used)
Packit 284210
 * to respond to the given request.
Packit 284210
 */
Packit 284210
const char *get_response_protocol(request_rec *r) {
Packit 284210
    int proto_num = r->proto_num;
Packit 284210
Packit 284210
    if (r->assbackwards) {
Packit 284210
        return NULL;
Packit 284210
    }
Packit 284210
Packit 284210
    if (proto_num > HTTP_VERSION(1,0)
Packit 284210
        && apr_table_get(r->subprocess_env, "downgrade-1.0"))
Packit 284210
    {
Packit 284210
        proto_num = HTTP_VERSION(1,0);
Packit 284210
    }
Packit 284210
Packit 284210
    if (proto_num == HTTP_VERSION(1,0)
Packit 284210
        && apr_table_get(r->subprocess_env, "force-response-1.0"))
Packit 284210
    {
Packit 284210
        return "HTTP/1.0";
Packit 284210
    }
Packit 284210
Packit 284210
    return AP_SERVER_PROTOCOL;
Packit 284210
}