Skip to content

Commit 9fe72b7

Browse files
author
Felipe Zimmerle
committed
Improves the CA validation
On IIS CA validation was not working as libcurl on windows does not look for a certificate store, unless it is specified. The resource downloads are now respecting the SecRemoteRulesFailAction.
1 parent b02256c commit 9fe72b7

File tree

9 files changed

+3969
-12
lines changed

9 files changed

+3969
-12
lines changed

‎apache2/apache2_config.c‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2217,7 +2217,6 @@ static const char *cmd_remote_rules_fail(cmd_parms *cmd, void *_dcfg, const char
22172217
{
22182218
directory_config *dcfg = (directory_config *)_dcfg;
22192219
if (dcfg == NULL) return NULL;
2220-
#ifdef WITH_REMOTE_RULES_SUPPORT
22212220
if (strncasecmp(p1, "warn", 4) == 0)
22222221
{
22232222
remote_rules_fail_action = REMOTE_RULES_WARN_ON_FAIL;
@@ -2231,10 +2230,6 @@ static const char *cmd_remote_rules_fail(cmd_parms *cmd, void *_dcfg, const char
22312230
return apr_psprintf(cmd->pool, "ModSecurity: Invalid value for " \
22322231
"SecRemoteRulesFailAction, expected: Abort or Warn.");
22332232
}
2234-
#else
2235-
return apr_psprintf(cmd->pool, "ModSecurity: " \
2236-
"SecRemoteRules: ModSecurity was not compiled with such functionality.");
2237-
#endif
22382233

22392234
return NULL;
22402235
}

‎apache2/mod_security2.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,8 +70,8 @@ unsigned long int DSOLOCAL msc_pcre_match_limit_recursion = 0;
7070

7171
#ifdef WITH_REMOTE_RULES_SUPPORT
7272
msc_remote_rules_server DSOLOCAL *remote_rules_server = NULL;
73-
int DSOLOCAL remote_rules_fail_action = REMOTE_RULES_ABORT_ON_FAIL;
7473
#endif
74+
int DSOLOCAL remote_rules_fail_action = REMOTE_RULES_ABORT_ON_FAIL;
7575

7676
int DSOLOCAL status_engine_state = STATUS_ENGINE_DISABLED;
7777

‎apache2/modsecurity.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -148,8 +148,8 @@ extern DSOLOCAL unsigned long int msc_pcre_match_limit_recursion;
148148

149149
#ifdef WITH_REMOTE_RULES_SUPPORT
150150
extern DSOLOCAL msc_remote_rules_server *remote_rules_server;
151-
extern DSOLOCAL int remote_rules_fail_action;
152151
#endif
152+
extern DSOLOCAL int remote_rules_fail_action;
153153

154154
extern DSOLOCAL int status_engine_state;
155155

‎apache2/msc_remote_rules.c‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -274,6 +274,11 @@ int msc_remote_grab_content(apr_pool_t *mp, const char *uri, const char *key,
274274
if (curl)
275275
{
276276
struct curl_slist *headers_chunk = NULL;
277+
#ifdef WIN32
278+
char *buf = malloc(sizeof(TCHAR) * (2048 + 1));
279+
char *ptr = NULL;
280+
DWORD res_len;
281+
#endif
277282
curl_easy_setopt(curl, CURLOPT_URL, remote_rules_server->uri);
278283

279284
headers_chunk = curl_slist_append(headers_chunk, apr_id);
@@ -286,6 +291,14 @@ int msc_remote_grab_content(apr_pool_t *mp, const char *uri, const char *key,
286291
/* Make it TLS 1.x only. */
287292
curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);
288293

294+
#ifdef WIN32
295+
res_len = SearchPathA(NULL, "curl-ca-bundle.crt", NULL, (2048 + 1), buf, &ptr);
296+
if (res_len > 0) {
297+
curl_easy_setopt(curl, CURLOPT_CAINFO, strdup(buf));
298+
}
299+
free(buf);
300+
#endif
301+
289302
/* those are the default options, but lets make sure */
290303
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1);
291304
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 1);

‎apache2/msc_util.c‎

Lines changed: 28 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2673,6 +2673,11 @@ int ip_tree_from_uri(TreeRoot **rtree, char *uri,
26732673

26742674
if (curl) {
26752675
struct curl_slist *headers_chunk = NULL;
2676+
#ifdef WIN32
2677+
char *buf = malloc(sizeof(TCHAR) * (2048 + 1));
2678+
char *ptr = NULL;
2679+
DWORD res_len;
2680+
#endif
26762681
curl_easy_setopt(curl, CURLOPT_URL, uri);
26772682

26782683
headers_chunk = curl_slist_append(headers_chunk, apr_id);
@@ -2687,7 +2692,15 @@ int ip_tree_from_uri(TreeRoot **rtree, char *uri,
26872692
/* Make it TLS 1.x only. */
26882693
curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);
26892694

2690-
/* those are the default options, but lets make sure */
2695+
#ifdef WIN32
2696+
res_len = SearchPathA(NULL, "curl-ca-bundle.crt", NULL, (2048 + 1), buf, &ptr);
2697+
if (res_len > 0) {
2698+
curl_easy_setopt(curl, CURLOPT_CAINFO, strdup(buf));
2699+
}
2700+
free(buf);
2701+
#endif
2702+
2703+
/* thoseeare the default options, but lets make sure */
26912704
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1);
26922705
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 1);
26932706

@@ -2700,8 +2713,20 @@ int ip_tree_from_uri(TreeRoot **rtree, char *uri,
27002713

27012714
if (res != CURLE_OK)
27022715
{
2703-
*error_msg = apr_psprintf(mp, "Failed to fetch \"%s\" error: %s ", uri, curl_easy_strerror(res));
2704-
return -1;
2716+
if (remote_rules_fail_action == REMOTE_RULES_WARN_ON_FAIL)
2717+
{
2718+
ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
2719+
"Failed to fetch \"%s\" error: %s ",
2720+
uri, curl_easy_strerror(res));
2721+
return 0;
2722+
}
2723+
else
2724+
{
2725+
*error_msg = apr_psprintf(mp, "Failed to fetch \"%s\" " \
2726+
"error: %s ", uri,
2727+
curl_easy_strerror(res));
2728+
return -1;
2729+
}
27052730
}
27062731

27072732
curl_easy_cleanup(curl);

‎apache2/re_operators.c‎

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
* directly using the email address security@modsecurity.org.
1313
*/
1414

15+
#include "modsecurity.h"
1516
#include "re.h"
1617
#include "msc_pcre.h"
1718
#include "msc_geo.h"
@@ -1307,6 +1308,11 @@ static int msre_op_pmFromFile_param_init(msre_rule *rule, char **error_msg) {
13071308

13081309
if (curl) {
13091310
struct curl_slist *headers_chunk = NULL;
1311+
#ifdef WIN32
1312+
char *buf = malloc(sizeof(TCHAR) * (2048 + 1));
1313+
char *ptr = NULL;
1314+
DWORD res_len;
1315+
#endif
13101316
curl_easy_setopt(curl, CURLOPT_URL, fn);
13111317

13121318
headers_chunk = curl_slist_append(headers_chunk, apr_id);
@@ -1321,6 +1327,14 @@ static int msre_op_pmFromFile_param_init(msre_rule *rule, char **error_msg) {
13211327
/* Make it TLS 1.x only. */
13221328
curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);
13231329

1330+
#ifdef WIN32
1331+
res_len = SearchPathA(NULL, "curl-ca-bundle.crt", NULL, (2048 + 1), buf, &ptr);
1332+
if (res_len > 0) {
1333+
curl_easy_setopt(curl, CURLOPT_CAINFO, strdup(buf));
1334+
}
1335+
free(buf);
1336+
#endif
1337+
13241338
/* those are the default options, but lets make sure */
13251339
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1);
13261340
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 1);
@@ -1333,7 +1347,22 @@ static int msre_op_pmFromFile_param_init(msre_rule *rule, char **error_msg) {
13331347
res = curl_easy_perform(curl);
13341348

13351349
if (res != CURLE_OK)
1336-
fprintf(stderr, "curl_easy_perform() failed: %s\n", curl_easy_strerror(res));
1350+
{
1351+
if (remote_rules_fail_action == REMOTE_RULES_WARN_ON_FAIL)
1352+
{
1353+
ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
1354+
"Failed to fetch \"%s\" error: %s ", fn,
1355+
curl_easy_strerror(res));
1356+
return 1;
1357+
}
1358+
else
1359+
{
1360+
*error_msg = apr_psprintf(rule->ruleset->mp,
1361+
"Failed to fetch \"%s\" error: %s ", fn,
1362+
curl_easy_strerror(res));
1363+
return 0;
1364+
}
1365+
}
13371366

13381367
curl_easy_cleanup(curl);
13391368
curl_slist_free_all(headers_chunk);

0 commit comments

Comments
 (0)