/*

* ModSecurity for Apache 2.x, http://www.modsecurity.org/

* Copyright (c) 2004-2013 Trustwave Holdings, Inc. (http://www.trustwave.com/)

*

* You may not use this file except in compliance with

* the License.  You may obtain a copy of the License at

*

*     http://www.apache.org/licenses/LICENSE-2.0

*

* If any of the files related to licensing are missing or if you have any

* other questions related to licensing please contact Trustwave Holdings, Inc.

* directly using the email address security@modsecurity.org.

*/

#include "modsecurity.h"

#include <sys/stat.h>

#include "re.h"

#include "msc_logging.h"

#include "httpd.h"

#include "apr_strings.h"

#include "apr_global_mutex.h"

#include "msc_util.h"

#include "apr_version.h"

#include <libxml/xmlversion.h>

#ifdef WITH_YAJL

#include <yajl/yajl_gen.h>

#include "msc_logging_json.h"

#endif

/**

 * Write the supplied data to the audit log (if the FD is ready), update

 * the size counters, update the hash context.

 */

static int sec_auditlog_write(modsec_rec *msr, const char *data, unsigned int len) {

    apr_size_t nbytes_written, nbytes = len;

    apr_status_t rc;

    /* Do nothing if there's no data. */

    if (data == NULL) return -1;

    /* Update size counters and the hash calculation. We always do this,

     * even in cases where write fails. That will make it easier to detect

     * problems with partial writes.

     */

    msr->new_auditlog_size += len;

    apr_md5_update(&msr->new_auditlog_md5ctx, data, len);

    /* Do not write if we do not have a file descriptor. */

    if (msr->new_auditlog_fd == NULL) return -1;

    /* Write data to file. */

    rc = apr_file_write_full(msr->new_auditlog_fd, data, nbytes, &nbytes_written);

    if (rc != APR_SUCCESS) {

        char errstr[1024];

        msr_log(msr, 1, "Audit log: Failed writing (requested %" APR_SIZE_T_FMT

            " bytes, written %" APR_SIZE_T_FMT "): %s", nbytes, nbytes_written,

            apr_strerror(rc, errstr, sizeof(errstr)));

        /* Concurrent log format: don't leak file handle. */

        if (msr->txcfg->auditlog_type == AUDITLOG_CONCURRENT) {

            apr_file_close(msr->new_auditlog_fd);

        }

        /* Set to NULL to prevent more than one error message on

         * out-of-disk-space events and to prevent further attempts

         * to write to the same file in this request.

         *

         * Serial log format: Note that, as we opened the file through the

         * pool mechanism of the APR, we do not need to close the file

         * here. It will be closed automatically at the end of the request.

         */

        msr->new_auditlog_fd = NULL;

        return -1;

    }

    return 1;

}

/**

 * Constructs a log line in vcombined log format trying to truncate

 * some of the fields to make the log line shorter than _limit bytes.

 */

char *construct_log_vcombinedus_limited(modsec_rec *msr, int _limit, int *was_limited) {

    char *hostname;

    char *local_user, *remote_user;

    char *referer, *user_agent, *uniqueid;

    const char *sessionid;

    char *the_request, *bytes_sent;

    int limit = _limit;

    /* hostname */

    hostname = (msr->hostname == NULL ? "-" : log_escape_nq(msr->mp, msr->hostname));

    /* remote log name */

    if (msr->remote_user == NULL) remote_user = "-";

    else remote_user = log_escape_nq(msr->mp, msr->remote_user);

    /* authenticated user */

    if (msr->local_user == NULL) local_user = "-";

    else local_user = log_escape_nq(msr->mp, msr->local_user);

    /* unique id */

    if (msr->txid == NULL) uniqueid = "-";

    else uniqueid = log_escape(msr->mp, msr->txid);

    /* referer */

    referer = "-";

    /*

    referer = (char *)apr_table_get(msr->request_headers, "Referer");

    if (referer == NULL) referer = "-";

    else referer = log_escape(msr->mp, referer);

    */

    /* user agent */

    user_agent = "-";

    /*

    user_agent = (char *)apr_table_get(msr->request_headers, "User-Agent");

    if (user_agent == NULL) user_agent = "-";

    else user_agent = log_escape(msr->mp, user_agent);

    */

    /* sessionid */

    sessionid = (msr->sessionid == NULL) ? "-" : log_escape(msr->mp, msr->sessionid);

    the_request = (msr->request_line == NULL) ? "" : log_escape(msr->mp, msr->request_line);

    bytes_sent = apr_psprintf(msr->mp, "%" APR_OFF_T_FMT, msr->bytes_sent);

    /* first take away the size of the

     * information we must log

     */

    limit -= 22;                                 /* spaces and double quotes */

    limit -= strlen(hostname);                   /* server name or IP */

    limit -= strlen(msr->remote_addr);           /* remote IP */

    limit -= 28;                                 /* current_logtime */

    limit -= 3;                                  /* status */

    limit -= strlen(bytes_sent);                 /* bytes sent */

    limit -= strlen(uniqueid);                   /* unique id */

    limit -= strlen(sessionid);                  /* session id */

    if (limit <= 0) {

        msr_log(msr, 1, "GuardianLog: Atomic pipe write size too small: %d", PIPE_BUF);

        return NULL;

    }

    /* we hope to be able to squeeze everything in */

    if (limit < (int)(strlen(remote_user) + strlen(local_user) + strlen(referer)

        + strlen(user_agent) + strlen(the_request)))

    {

        /* Boo hoo hoo, there's not enough space available. */

        *was_limited = 1;

        /* Let's see if we can reduce the size of something. This

         * is a very crude approach but it seems to work for our

         * needs.

         */

        if (strlen(remote_user) > 32) {

            msr_log(msr, 9, "GuardianLog: Reduced remote_user to 32.");

            remote_user[32] = '\0';

        }

        limit -= strlen(remote_user);

        if (strlen(local_user) > 32) {

            msr_log(msr, 9, "GuardianLog: Reduced local_user to 32.");

            local_user[32] = '\0';

        }

        limit -= strlen(local_user);

        if (strlen(referer) > 64) {

            msr_log(msr, 9, "GuardianLog: Reduced referer to 64.");

            referer[64] = '\0';

        }

        limit -= strlen(referer);

        if (strlen(user_agent) > 64) {

            msr_log(msr, 9, "GuardianLog: Reduced user_agent to 64.");

            user_agent[64] = '\0';

        }

        limit -= strlen(user_agent);

        if (limit <= 0) {

            msr_log(msr, 1, "GuardianLog: Atomic pipe write size too small: %d.", PIPE_BUF);

            return NULL;

        }

        /* use what's left for the request line */

        if ((int)strlen(the_request) > limit) {

            the_request[limit] = '\0';

            msr_log(msr, 9, "GuardianLog: Reduced the_request to %d bytes.", limit);

        }

    } else {

        /* Yay! We have enough space! */

        *was_limited = 0;

    }

    return apr_psprintf(msr->mp, "%s %s %s %s [%s] \"%s\" %u %s \"%s\" \"%s\" %s \"%s\"",

        hostname, msr->remote_addr, remote_user,

        local_user, current_logtime(msr->mp), the_request,

        msr->response_status, bytes_sent, referer, user_agent,

        uniqueid, sessionid

    );

}

/**

 * Checks if the provided string is a valid audit log parts specification.

 */

int is_valid_parts_specification(char *p) {

    char c, *t = p;

    while((c = *(t++)) != '\0') {

        if ((c != AUDITLOG_PART_ENDMARKER)&&((c < AUDITLOG_PART_FIRST)||(c > AUDITLOG_PART_LAST))) {

            return 0;

        }

    }

    return 1;

}

/**

 * Constructs a filename that will be used to store an

 * audit log entry.

 */

static char *construct_auditlog_filename(apr_pool_t *mp, const char *uniqueid) {

    apr_time_exp_t t;

    char tstr[300];

    apr_size_t len;

    apr_time_exp_lt(&t, apr_time_now());

    apr_strftime(tstr, &len, 299, "/%Y%m%d/%Y%m%d-%H%M/%Y%m%d-%H%M%S", &t);

    return apr_psprintf(mp, "%s-%s", tstr, uniqueid);

}

/**

 * Creates a random 8-character string that

 * consists of hexadecimal numbers, to be used

 * as an audit log boundary.

 */

static char *create_auditlog_boundary(request_rec *r) {

#ifdef LINUX_S390

    int data = swap_int32(rand());

#else

    unsigned long data = rand();

#endif

    /* Do note that I tried using apr_generate_random_bytes but it turned

     * out to be terribly slow for some reason. Needs further investigation.

     */

    return bytes2hex(r->pool, (void *)&data, 4);

}

/**

 * Sanitises the request line by removing the parameters

 * that have been marked as sensitive.

 */

static void sanitize_request_line(modsec_rec *msr) {

    const apr_array_header_t *tarr = NULL;

    const apr_table_entry_t *telts = NULL;

    const apr_array_header_t *tarr_pattern = NULL;

    const apr_table_entry_t *telts_pattern = NULL;

    msc_parm *mparm = NULL;

    int i, k;

    char *qspos;

    char *buf = NULL;

    int sanitized_partial = 0;

    int sanitize_matched = 0;

    /* Locate the query string. */

    qspos = strstr(msr->request_line, "?");

    if (qspos == NULL) return;

    qspos++;

    /* Loop through the list of sensitive parameters. */

    tarr = apr_table_elts(msr->arguments_to_sanitize);

    telts = (const apr_table_entry_t*)tarr->elts;

    for (i = 0; i < tarr->nelts; i++) {

        msc_arg *arg = (msc_arg *)telts[i].val;

        /* Only look at the parameters that appeared in the query string. */

        if (strcmp(arg->origin, "QUERY_STRING") == 0) {

            char *pat = NULL;

            char *p;

            int j, arg_min, arg_max;

            /* Go to the beginning of the parameter. */

            p = qspos;

            j = arg->value_origin_offset;

            while((*p != '\0')&&(j--)) p++;

            if (*p == '\0') {

                msr_log(msr, 1, "Unable to sanitize variable \"%s\" at offset %u of QUERY_STRING"

                        "because the request line is too short.",

                        log_escape_ex(msr->mp, arg->name, arg->name_len),

                        arg->value_origin_offset);

                continue;

            }

            tarr_pattern = apr_table_elts(msr->pattern_to_sanitize);

            telts_pattern = (const apr_table_entry_t*)tarr_pattern->elts;

            sanitized_partial = 0;

            sanitize_matched = 0;

            buf = apr_psprintf(msr->mp, "%s",p);

            for ( k = 0; k < tarr_pattern->nelts; k++)  {

                if(strncmp(telts_pattern[k].key,arg->name,strlen(arg->name)) ==0 ) {

                    mparm = (msc_parm *)telts_pattern[k].val;

                    pat = strstr(buf,mparm->value);

                    if(mparm->pad_1 == -1)

                        sanitize_matched = 1;

                    if (pat != NULL) {

                        j = strlen(mparm->value);

                        arg_min = j;

                        arg_max = 1;

                        while((*pat != '\0')&&(j--)) {

                            if(arg_max > mparm->pad_2)  {

                                int off = (strlen(mparm->value) - arg_max);

                                int pos = (mparm->pad_1-1);

                                if(off > pos)    {

                                    *pat = '*';

                                }

                            }

                            arg_max++;

                            arg_min--;

                            pat++;

                        }

                    }

                    sanitized_partial = 1;

                }

            }

            if(sanitized_partial == 1 && sanitize_matched == 0)  {

                while(*buf != '\0') {

                    *p++ = *buf++;

                }

                continue;

            } else {

                /* Write over the value. */

                j = arg->value_origin_len;

                while((*p != '\0')&&(j--)) {

                    *p++ = '*';

                }

                if (*p == '\0') {

                    msr_log(msr, 1, "Unable to sanitize variable \"%s\" at offset %u (size %d) "

                            "of QUERY_STRING because the request line is too short.",

                            log_escape_ex(msr->mp, arg->name, arg->name_len),

                            arg->value_origin_offset, arg->value_origin_len);

                    continue;

                }

            }

        }

    }

}

/**

 * Output the Producer header.

 */

static void sec_auditlog_write_producer_header(modsec_rec *msr) {

    char **signatures = NULL;

    char *text = NULL;

    int i;

    /* Try to write everything in one go. */

    if (msr->txcfg->component_signatures->nelts == 0) {

        text = apr_psprintf(msr->mp, "Producer: %s.\n", MODSEC_MODULE_NAME_FULL);

        sec_auditlog_write(msr, text, strlen(text));

        return;

    }

    /* Start with the ModSecurity signature. */

    text = apr_psprintf(msr->mp, "Producer: %s", MODSEC_MODULE_NAME_FULL);

    sec_auditlog_write(msr, text, strlen(text));

    /* Then loop through the components and output individual signatures. */

    signatures = (char **)msr->txcfg->component_signatures->elts;

    for(i = 0; i < msr->txcfg->component_signatures->nelts; i++) {

        text = apr_psprintf(msr->mp, "; %s", (char *)signatures[i]);

        sec_auditlog_write(msr, text, strlen(text));

    }

    sec_auditlog_write(msr, ".\n", 2);

}

#ifdef WITH_YAJL

/**

 * Ouput the Producer header into a JSON generator

 */

static void sec_auditlog_write_producer_header_json(modsec_rec *msr, yajl_gen g) {

    char **signatures = NULL;

    int i;

    // this is written no matter what

    yajl_string(g, "producer");

    /* Try to write verything in one go. */

    if (msr->txcfg->component_signatures->nelts == 0) {

        yajl_string(g, MODSEC_MODULE_NAME_FULL);

        return;

    }

    // we'll need an array if there are component signatures

    yajl_gen_array_open(g);

    /* Start with the ModSecurity signature. */

    yajl_string(g, MODSEC_MODULE_NAME_FULL);

    /* Then loop through the components and output individual signatures. */

    signatures = (char **)msr->txcfg->component_signatures->elts;

    for(i = 0; i < msr->txcfg->component_signatures->nelts; i++) {

        yajl_string(g, (char *)signatures[i]);

    }

    yajl_gen_array_close(g); // array for producers is finished

}

#endif

/*

* \brief This function will returns the next chain node

*

* \param current Pointer to current chined rule

* \param msr Pointer to modsec_rec

*

* \retval NULL On failure

* \retval next_rule On Success

*/

static msre_rule *return_chained_rule(const msre_rule *current, modsec_rec *msr)   {

    apr_array_header_t *arr = NULL;

    msre_rule **rules = NULL;

    msre_rule *rule = NULL, *next_rule = NULL;

    int i;

    int phase;

    if (current == NULL || current->actionset == NULL || current->ruleset == NULL)

        return NULL;

    phase = current->actionset->phase;

    switch (phase) {

        case PHASE_REQUEST_HEADERS :

            arr = current->ruleset->phase_request_headers;

            break;

        case PHASE_REQUEST_BODY :

            arr = current->ruleset->phase_request_body;

            break;

        case PHASE_RESPONSE_HEADERS :

            arr = current->ruleset->phase_response_headers;

            break;

        case PHASE_RESPONSE_BODY :

            arr = current->ruleset->phase_response_body;

            break;

        case PHASE_LOGGING :

            arr = current->ruleset->phase_logging;

            break;

        default :

            msr_log(msr, 1, "Logging: Invalid phase %d",phase);

            return NULL;

    }

    rules = (msre_rule **)arr->elts;

    for (i = 0; i < arr->nelts; i++) {

        rule = rules[i];

        if (rule != NULL)    {

            if (strncmp(current->unparsed,rule->unparsed,strlen(current->unparsed)) == 0) {

                if (i < arr->nelts -1)   {

                    next_rule = rules[i+1];

                } else  {

                    next_rule = rules[i];

                }

                if (next_rule == NULL || next_rule->chain_starter == NULL)

                    return NULL;

                if(current->chain_starter == NULL && next_rule->chain_starter != NULL)  {

                    if (strncmp(current->unparsed, next_rule->chain_starter->unparsed, strlen(current->unparsed)) != 0)

                        return NULL;

                }

                if(current->chain_starter != NULL && next_rule->chain_starter != NULL)  {

                    if (strncmp(current->chain_starter->unparsed, rule->chain_starter->unparsed, strlen(current->chain_starter->unparsed)) != 0)

                        return NULL;

                }

                return next_rule;

            }

        }

    }

    return NULL;

}

/*

* \brief This function will check if a chained rule

* appears into matched array.

*

* \param msr Pointer to modsec_rec

* \param next_rule Pointer to chained rule

*

* \retval 0 On failure

* \retval 1 On Success

*/

static int chained_is_matched(modsec_rec *msr, const msre_rule *next_rule) {

    int i = 0;

    const msre_rule *rule = NULL;

    for (i = 0; i < msr->matched_rules->nelts; i++) {

        rule = ((msre_rule **)msr->matched_rules->elts)[i];

        if (rule != NULL && (strncmp(rule->unparsed,next_rule->unparsed,strlen(rule->unparsed)) == 0))  {

            return 1;

        }

    }

    return 0;

}

#ifdef WITH_YAJL

/**

 * Write detailed information about performance metrics into a JSON generator

 */

static void format_performance_variables_json(modsec_rec *msr, yajl_gen g) {

    yajl_string(g, "stopwatch");

    yajl_gen_map_open(g);

    yajl_kv_int(g, "p1", msr->time_phase1);

    yajl_kv_int(g, "p2", msr->time_phase2);

    yajl_kv_int(g, "p3", msr->time_phase3);

    yajl_kv_int(g, "p4", msr->time_phase4);

    yajl_kv_int(g, "p5", msr->time_phase5);

    yajl_kv_int(g, "sr", msr->time_storage_read);

    yajl_kv_int(g, "sw", msr->time_storage_write);

    yajl_kv_int(g, "l", msr->time_logging);

    yajl_kv_int(g, "gc", msr->time_gc);

    yajl_gen_map_close(g);

}

/**

 * Write detailed information about a rule and its actionset into a JSON generator

 */

static void write_rule_json(modsec_rec *msr, const msre_rule *rule, yajl_gen g) {

    const apr_array_header_t *tarr;

    const apr_table_entry_t *telts;

    int been_opened = 0;

    int k;

    yajl_gen_map_open(g);

    yajl_string(g, "actionset");

    yajl_gen_map_open(g);

    if (rule->actionset->id) {

        yajl_kv_string(g, "id", log_escape(msr->mp, rule->actionset->id));

    }

    if (rule->actionset->rev) {

        yajl_kv_string(g, "rev", log_escape(msr->mp, rule->actionset->rev));

    }

    if (rule->actionset->version) {

        yajl_kv_string(g, "version", log_escape(msr->mp, rule->actionset->version));

    }

    if (rule->actionset->severity != NOT_SET) {

        yajl_kv_int(g, "severity", rule->actionset->severity);

    }

    if (rule->actionset->accuracy != NOT_SET) {

        yajl_kv_int(g, "accuracy", rule->actionset->accuracy);

    }

    if (rule->actionset->maturity != NOT_SET) {

        yajl_kv_int(g, "maturity", rule->actionset->maturity);

    }

    if (rule->actionset->phase != NOT_SET) {

        yajl_kv_int(g, "phase", rule->actionset->phase);

    }

    yajl_kv_bool(g, "is_chained", rule->actionset->is_chained || (rule->chain_starter != NULL));

    if (rule->actionset->is_chained && (rule->chain_starter == NULL)) {

        yajl_kv_bool(g, "chain_starter", 1);

    }

    // tags, lazily opened

    tarr = apr_table_elts(rule->actionset->actions);

    telts = (const apr_table_entry_t*)tarr->elts;

    for (k = 0; k < tarr->nelts; k++) {

        msre_action *action = (msre_action *)telts[k].val;

        if (strcmp(telts[k].key, "tag") == 0) {

            msc_string *var = NULL;

            if (been_opened == 0) {

                yajl_string(g, "tags");

                yajl_gen_array_open(g);

                been_opened = 1;

            }

            // expand variables in the tag

            var = (msc_string *)apr_pcalloc(msr->mp, sizeof(msc_string));

            var->value = (char *)action->param;

            var->value_len = strlen(action->param);

            expand_macros(msr, var, NULL, msr->mp);

            yajl_string(g, log_escape(msr->mp, var->value));

        }

    }

    if (been_opened == 1) {

        yajl_gen_array_close(g);

    }

    yajl_gen_map_close(g);

    yajl_string(g, "operator");

    yajl_gen_map_open(g);

    yajl_kv_string(g, "operator", rule->op_name);

    yajl_kv_string(g, "operator_param", rule->op_param);

    yajl_kv_string(g, "target", rule->p1);

    yajl_kv_bool(g, "negated", rule->op_negated);

    yajl_gen_map_close(g);

    yajl_string(g, "config");

    yajl_gen_map_open(g);

    yajl_kv_string(g, "filename", rule->filename);

    yajl_kv_int(g, "line_num", rule->line_num);

    yajl_gen_map_close(g);

    yajl_kv_string(g, "unparsed", rule->unparsed);

    yajl_kv_bool(g, "is_matched", chained_is_matched(msr, rule));

    yajl_gen_map_close(g);

}

/*

 * Produce an audit log entry in JSON format.

 */

void sec_audit_logger_json(modsec_rec *msr) {

    const apr_array_header_t *arr = NULL;

    apr_table_entry_t *te = NULL;

    const apr_array_header_t *tarr_pattern = NULL;

    const apr_table_entry_t *telts_pattern = NULL;

    char *str1 = NULL, *str2 = NULL, *text = NULL;

    const msre_rule *rule = NULL, *next_rule = NULL;

    apr_size_t nbytes, nbytes_written;

    unsigned char md5hash[APR_MD5_DIGESTSIZE];

    int was_limited = 0;

    int present = 0;

    int wrote_response_body = 0;

    char *entry_filename, *entry_basename;

    apr_status_t rc;

    int i, limit, k, sanitized_partial, j;

    char *buf = NULL, *pat = NULL;

    msc_parm *mparm = NULL;

    int arg_min, arg_max, sanitize_matched;

    yajl_gen g;

    int been_opened = 0; // helper flag for conditionally opening maps

    const unsigned char *final_buf;

    size_t len;

    /* Return silently if we don't have a request line. This

     * means we will not be logging request timeouts.

     */

    if (msr->request_line == NULL) {

        msr_log(msr, 4, "Audit log: Skipping request whose request_line is null.");

        return;

    }

    /* Also return silently if we don't have a file descriptor. */

    if (msr->txcfg->auditlog_fd == NULL) {

        msr_log(msr, 4, "Audit log: Skipping request since there is nowhere to write to.");

        return;

    }

    if (msr->txcfg->auditlog_type != AUDITLOG_CONCURRENT) {

        /* Serial logging - we already have an open file

         * descriptor to write to.

         */

        msr->new_auditlog_fd = msr->txcfg->auditlog_fd;

    } else {

        /* Concurrent logging - we need to create a brand

         * new file for this request.

         */

        apr_md5_init(&msr->new_auditlog_md5ctx);

        msr->new_auditlog_filename = construct_auditlog_filename(msr->mp, msr->txid);

        if (msr->new_auditlog_filename == NULL) return;

        /* The audit log storage directory should be explicitly

         * defined. But if it isn't try to write to the same

         * directory where the index file is placed. Of course,

         * it is *very* bad practice to allow the Apache user

         * to write to the same directory where a root user is

         * writing to but it's not us that's causing the problem

         * and there isn't anything we can do about that.

         *

         * ENH Actually there is something we can do! We will make

         * SecAuditStorageDir mandatory, ask the user to explicitly

         * define the storage location *and* refuse to work if the

         * index and the storage location are in the same folder.

         */

        if (msr->txcfg->auditlog_storage_dir == NULL) {

            entry_filename = file_dirname(msr->mp, msr->txcfg->auditlog_name);

        }

        else {

            entry_filename = msr->txcfg->auditlog_storage_dir;

        }

        if (entry_filename == NULL) return;

        entry_filename = apr_psprintf(msr->mp, "%s%s", entry_filename, msr->new_auditlog_filename);

        if (entry_filename == NULL) return;

        entry_basename = file_dirname(msr->mp, entry_filename);

        if (entry_basename == NULL) return;

        /* IMP1 Surely it would be more efficient to check the folders for

         * the audit log repository base path in the configuration phase, to reduce

         * the work we do on every request. Also, since our path depends on time,

         * we could cache the time we last checked and don't check if we know

         * the folder is there.

         */

        rc = apr_dir_make_recursive(entry_basename, msr->txcfg->auditlog_dirperms, msr->mp);

        if ((rc != APR_SUCCESS) && (rc != APR_EEXIST)) {

            msr_log(msr, 1, "Audit log: Failed to create subdirectories: %s (%s)",

                entry_basename, get_apr_error(msr->mp, rc));

            return;

        }

        rc = apr_file_open(&msr->new_auditlog_fd, entry_filename,

            APR_WRITE | APR_TRUNCATE | APR_CREATE | APR_BINARY | APR_FILE_NOCLEANUP,

            msr->txcfg->auditlog_fileperms, msr->mp);

        if (rc != APR_SUCCESS) {

            msr_log(msr, 1, "Audit log: Failed to create file: %s (%s)",

                entry_filename, get_apr_error(msr->mp, rc));

            return;

        }

    }

    /* Lock the mutex, but only if we are using serial format. */

    if (msr->txcfg->auditlog_type != AUDITLOG_CONCURRENT) {

        rc = apr_global_mutex_lock(msr->modsecurity->auditlog_lock);

        if (rc != APR_SUCCESS) {

            msr_log(msr, 1, "Audit log: Failed to lock global mutex: %s",

                get_apr_error(msr->mp, rc));

        }

    }

    /**

     * allocate the buffer for the JSON generator

     * passing null will force yajl to use malloc/realloc/free

     * need to perf test using APR routines

     */

    g = yajl_gen_alloc(NULL);

    /**

     * don't pretty print JSON

     * this is harder to eyeball but much easier to parse programmatically

     */

    yajl_gen_config(g, yajl_gen_beautify, 0);

    yajl_gen_map_open(g); // IT BEGINS

    /* AUDITLOG_PART_HEADER */

    yajl_string(g, "transaction");

    yajl_gen_map_open(g); // transaction top-level key

    yajl_kv_string(g, "time", current_logtime(msr->mp));

    yajl_kv_string(g, "transaction_id", msr->txid);

    yajl_kv_string(g, "remote_address", msr->remote_addr);

    yajl_kv_int(g, "remote_port", (int)msr->remote_port); // msr->remote_port is unsigned, yajl wants signed

    yajl_kv_string(g, "local_address", msr->local_addr);

    yajl_kv_int(g, "local_port", (int)msr->local_port);

    yajl_gen_map_close(g); // transaction top-level key is finished

    yajl_string(g, "request");

    yajl_gen_map_open(g); // request top-level key

    /* AUDITLOG_PART_REQUEST_HEADERS */

    if (strchr(msr->txcfg->auditlog_parts, AUDITLOG_PART_REQUEST_HEADERS) != NULL) {

        sanitize_request_line(msr);

        yajl_kv_string(g, "request_line", msr->request_line);

        yajl_string(g, "headers");

        yajl_gen_map_open(g); // separate map for request headers

        arr = apr_table_elts(msr->request_headers);

        te = (apr_table_entry_t *)arr->elts;

        tarr_pattern = apr_table_elts(msr->pattern_to_sanitize);

        telts_pattern = (const apr_table_entry_t*)tarr_pattern->elts;

        for (i = 0; i < arr->nelts; i++) {

            sanitized_partial = 0;

            sanitize_matched = 0;

            text = apr_psprintf(msr->mp, "%s: %s\n", te[i].key, te[i].val);

            // write the key no matter what

            // since sanitization only occurs on the value

            yajl_string(g, te[i].key);

            if (apr_table_get(msr->request_headers_to_sanitize, te[i].key) != NULL) {

                buf = apr_psprintf(msr->mp, "%s",text+strlen(te[i].key)+2);

                for ( k = 0; k < tarr_pattern->nelts; k++)  {

                    if(strncmp(telts_pattern[k].key,te[i].key,strlen(te[i].key)) ==0 ) {

                        mparm = (msc_parm *)telts_pattern[k].val;

                        if(mparm->pad_1 == -1)

                            sanitize_matched = 1;

                        pat = strstr(buf,mparm->value);

                        if (pat != NULL)    {

                            j = strlen(mparm->value);

                            arg_min = j;

                            arg_max = 1;

                            while((*pat != '\0')&&(j--)) {

                                if(arg_max > mparm->pad_2)  {

                                    int off = strlen(mparm->value) - arg_max;

                                    int pos = mparm->pad_1-1;

                                    if(off > pos)    {

                                        *pat = '*';

                                    }

                                }

                                arg_max++;

                                arg_min--;

                                pat++;

                            }

                            sanitized_partial = 1;

                        }

                    }

                }

                if(sanitized_partial == 1 && sanitize_matched == 0)  {

                    yajl_string(g, buf);

                } else {

                    memset(buf, '*', strlen(buf)); // strlen also includes the appended newline on the header

                    yajl_string(g, buf);

                }

            } else {

            // we diverge from the original logic a bit because we always print the key

            // at this no point sanitization had occured, so we just print the value

                yajl_string(g, te[i].val);

            }

        }

        yajl_gen_map_close(g); // request headers map is finished

    }

    /* AUDITLOG_PART_REQUEST_BODY */

    /* Output this part of it was explicitly requested (C) or if it was the faked

     * request body that was requested (I) but we have no reason to fake it (it's

     * already in the correct format).

     */

    if ( (strchr(msr->txcfg->auditlog_parts, AUDITLOG_PART_REQUEST_BODY) != NULL)

        || ( (strchr(msr->txcfg->auditlog_parts, AUDITLOG_PART_FAKE_REQUEST_BODY) != NULL)

            && (msr->mpd == NULL) ) )

    {

        if (msr->msc_reqbody_read) {

            const apr_array_header_t *tarr;

            const apr_table_entry_t *telts;

            apr_array_header_t *sorted_args;

            unsigned int offset = 0, last_offset = 0;

            msc_arg *nextarg = NULL;

            int sanitize = 0; /* IMP1 Use constants for "sanitize" values. */

            char *my_error_msg = NULL;

            sorted_args = apr_array_make(msr->mp, 25, sizeof(const msc_arg *));

            /* First we need to sort the arguments that need to be

             * sanitized in descending order (we are using a stack structure

             * to store then so the order will be ascending when we start

             * popping them out). This is because we will

             * be reading the request body sequentially and must

             * sanitize it as we go.

             */

            for(;;) {

                nextarg = NULL;

                /* Find the next largest offset (excluding

                 * the ones we've used up already).

                 */

                tarr = apr_table_elts(msr->arguments_to_sanitize);

                telts = (const apr_table_entry_t*)tarr->elts;

                for(i = 0; i < tarr->nelts; i++) {

                    msc_arg *arg = (msc_arg *)telts[i].val;

                    if (arg->origin != NULL &&