Skip to content

Commit 5cec98b

Browse files
lmq1999lmq1999
committed
Add error custom
1 parent d59e4ad commit 5cec98b

7 files changed

+47
-26
lines changed

‎src/ngx_http_modsecurity_body_filter.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ ngx_http_modsecurity_body_filter(ngx_http_request_t *r, ngx_chain_t *in)
4848
return ngx_http_next_body_filter(r, in);
4949
}
5050

51-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
51+
ctx = ngx_http_modsecurity_get_module_ctx(r)
5252

5353
dd("body filter, recovering ctx: %p", ctx);
5454

‎src/ngx_http_modsecurity_common.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,7 @@ typedef struct {
9999
unsigned processed:1;
100100
unsigned logged:1;
101101
unsigned intervention_triggered:1;
102+
unsigned request_body_processed:1;
102103
} ngx_http_modsecurity_ctx_t;
103104

104105

@@ -139,6 +140,7 @@ extern ngx_module_t ngx_http_modsecurity_module;
139140
/* ngx_http_modsecurity_module.c */
140141
int ngx_http_modsecurity_process_intervention (Transaction *transaction, ngx_http_request_t *r, ngx_int_t early_log);
141142
ngx_http_modsecurity_ctx_t *ngx_http_modsecurity_create_ctx(ngx_http_request_t *r);
143+
ngx_http_modsecurity_ctx_t *ngx_http_modsecurity_get_module_ctx(ngx_http_request_t *r);
142144
char *ngx_str_to_char(ngx_str_t a, ngx_pool_t *p);
143145
#if (NGX_PCRE2)
144146
#define ngx_http_modsecurity_pcre_malloc_init(x) NULL

‎src/ngx_http_modsecurity_header_filter.c

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ ngx_http_modsecurity_store_ctx_header(ngx_http_request_t *r, ngx_str_t *name, ng
107107
ngx_http_modsecurity_conf_t *mcf;
108108
ngx_http_modsecurity_header_t *hdr;
109109

110-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
110+
ctx = ngx_http_modsecurity_get_module_ctx(r);
111111
if (ctx == NULL || ctx->sanity_headers_out == NULL) {
112112
return NGX_ERROR;
113113
}
@@ -150,7 +150,7 @@ ngx_http_modsecurity_resolv_header_server(ngx_http_request_t *r, ngx_str_t name,
150150
ngx_str_t value;
151151

152152
clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
153-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
153+
ctx = ngx_http_modsecurity_get_module_ctx(r);
154154

155155
if (r->headers_out.server == NULL) {
156156
if (clcf->server_tokens) {
@@ -184,7 +184,7 @@ ngx_http_modsecurity_resolv_header_date(ngx_http_request_t *r, ngx_str_t name, o
184184
ngx_http_modsecurity_ctx_t *ctx = NULL;
185185
ngx_str_t date;
186186

187-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
187+
ctx = ngx_http_modsecurity_get_module_ctx(r);
188188

189189
if (r->headers_out.date == NULL) {
190190
date.data = ngx_cached_http_time.data;
@@ -214,7 +214,7 @@ ngx_http_modsecurity_resolv_header_content_length(ngx_http_request_t *r, ngx_str
214214
ngx_str_t value;
215215
char buf[NGX_INT64_LEN+2];
216216

217-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
217+
ctx = ngx_http_modsecurity_get_module_ctx(r);
218218

219219
if (r->headers_out.content_length_n > 0)
220220
{
@@ -241,7 +241,7 @@ ngx_http_modsecurity_resolv_header_content_type(ngx_http_request_t *r, ngx_str_t
241241
{
242242
ngx_http_modsecurity_ctx_t *ctx = NULL;
243243

244-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
244+
ctx = ngx_http_modsecurity_get_module_ctx(r);
245245

246246
if (r->headers_out.content_type.len > 0)
247247
{
@@ -268,7 +268,7 @@ ngx_http_modsecurity_resolv_header_last_modified(ngx_http_request_t *r, ngx_str_
268268
u_char buf[1024], *p;
269269
ngx_str_t value;
270270

271-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
271+
ctx = ngx_http_modsecurity_get_module_ctx(r);
272272

273273
if (r->headers_out.last_modified_time == -1) {
274274
return 1;
@@ -300,7 +300,7 @@ ngx_http_modsecurity_resolv_header_connection(ngx_http_request_t *r, ngx_str_t n
300300
ngx_str_t value;
301301

302302
clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
303-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
303+
ctx = ngx_http_modsecurity_get_module_ctx(r);
304304

305305
if (r->headers_out.status == NGX_HTTP_SWITCHING_PROTOCOLS) {
306306
connection = "upgrade";
@@ -351,7 +351,7 @@ ngx_http_modsecurity_resolv_header_transfer_encoding(ngx_http_request_t *r, ngx_
351351
if (r->chunked) {
352352
ngx_str_t value = ngx_string("chunked");
353353

354-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
354+
ngx_http_modsecurity_get_module_ctx(r);
355355

356356
#if defined(MODSECURITY_SANITY_CHECKS) && (MODSECURITY_SANITY_CHECKS)
357357
ngx_http_modsecurity_store_ctx_header(r, &name, &value);
@@ -378,7 +378,7 @@ ngx_http_modsecurity_resolv_header_vary(ngx_http_request_t *r, ngx_str_t name, o
378378
if (r->gzip_vary && clcf->gzip_vary) {
379379
ngx_str_t value = ngx_string("Accept-Encoding");
380380

381-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
381+
ctx = ngx_http_modsecurity_get_module_ctx(r);
382382

383383
#if defined(MODSECURITY_SANITY_CHECKS) && (MODSECURITY_SANITY_CHECKS)
384384
ngx_http_modsecurity_store_ctx_header(r, &name, &value);
@@ -420,7 +420,7 @@ ngx_http_modsecurity_header_filter(ngx_http_request_t *r)
420420

421421
/* XXX: if NOT_MODIFIED, do we need to process it at all? see xslt_header_filter() */
422422

423-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
423+
ctx = ngx_http_modsecurity_get_module_ctx(r);
424424

425425
dd("header filter, recovering ctx: %p", ctx);
426426

‎src/ngx_http_modsecurity_log.c

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -39,17 +39,9 @@ ngx_http_modsecurity_log_handler(ngx_http_request_t *r)
3939
{
4040
ngx_pool_t *old_pool;
4141
ngx_http_modsecurity_ctx_t *ctx;
42-
ngx_http_modsecurity_conf_t *mcf;
4342

4443
dd("catching a new _log_ phase handler");
4544

46-
mcf = ngx_http_get_module_loc_conf(r, ngx_http_modsecurity_module);
47-
if (mcf == NULL || mcf->enable != 1)
48-
{
49-
dd("ModSecurity not enabled... returning");
50-
return NGX_OK;
51-
}
52-
5345
/*
5446
if (r->method != NGX_HTTP_GET &&
5547
r->method != NGX_HTTP_POST && r->method != NGX_HTTP_HEAD) {
@@ -58,13 +50,13 @@ ngx_http_modsecurity_log_handler(ngx_http_request_t *r)
5850
return NGX_OK;
5951
}
6052
*/
61-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
53+
ctx = ngx_http_modsecurity_get_module_ctx(r);
6254

6355
dd("recovering ctx: %p", ctx);
6456

6557
if (ctx == NULL) {
66-
dd("something really bad happened here. returning NGX_ERROR");
67-
return NGX_ERROR;
58+
dd("ModSecurity not enabled or error occurred");
59+
return NGX_OK;
6860
}
6961

7062
if (ctx->logged) {

‎src/ngx_http_modsecurity_module.c

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,7 @@ ngx_http_modsecurity_process_intervention (Transaction *transaction, ngx_http_re
144144

145145
dd("processing intervention");
146146

147-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
147+
ctx = ngx_http_modsecurity_get_module_ctx(r);
148148
if (ctx == NULL)
149149
{
150150
return NGX_HTTP_INTERNAL_SERVER_ERROR;
@@ -308,6 +308,27 @@ ngx_http_modsecurity_create_ctx(ngx_http_request_t *r)
308308
return ctx;
309309
}
310310

311+
ngx_inline ngx_http_modsecurity_ctx_t *
312+
ngx_http_modsecurity_get_module_ctx(ngx_http_request_t *r)
313+
{
314+
ngx_http_modsecurity_ctx_t *ctx;
315+
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
316+
if (ctx == NULL) {
317+
/*
318+
* refer <nginx>/src/http/modules/ngx_http_realip_module.c
319+
* if module context was reset, the original address
320+
* can still be found in the cleanup handler
321+
*/
322+
ngx_pool_cleanup_t *cln;
323+
for (cln = r->pool->cleanup; cln; cln = cln->next) {
324+
if (cln->handler == ngx_http_modsecurity_cleanup) {
325+
ctx = cln->data;
326+
break;
327+
}
328+
}
329+
}
330+
return ctx;
331+
}
311332

312333
char *
313334
ngx_conf_set_rules(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)

‎src/ngx_http_modsecurity_pre_access.c

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ ngx_http_modsecurity_request_read(ngx_http_request_t *r)
2525
{
2626
ngx_http_modsecurity_ctx_t *ctx;
2727

28-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
28+
ctx = ngx_http_modsecurity_get_module_ctx(r);
2929

3030
#if defined(nginx_version) && nginx_version >= 8011
3131
r->main->count--;
@@ -68,7 +68,7 @@ ngx_http_modsecurity_pre_access_handler(ngx_http_request_t *r)
6868
}
6969
*/
7070

71-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
71+
ctx = ngx_http_modsecurity_get_module_ctx(r);
7272

7373
dd("recovering ctx: %p", ctx);
7474

@@ -78,6 +78,11 @@ ngx_http_modsecurity_pre_access_handler(ngx_http_request_t *r)
7878
return NGX_HTTP_INTERNAL_SERVER_ERROR;
7979
}
8080

81+
if (ctx->request_body_processed) {
82+
// should we use r->internal or r->filter_finalize?
83+
return NGX_DECLINED;
84+
}
85+
8186
if (ctx->intervention_triggered) {
8287
return NGX_DECLINED;
8388
}
@@ -210,6 +215,7 @@ ngx_http_modsecurity_pre_access_handler(ngx_http_request_t *r)
210215

211216
old_pool = ngx_http_modsecurity_pcre_malloc_init(r->pool);
212217
msc_process_request_body(ctx->modsec_transaction);
218+
ctx->request_body_processed = 1;
213219
ngx_http_modsecurity_pcre_malloc_done(old_pool);
214220

215221
ret = ngx_http_modsecurity_process_intervention(ctx->modsec_transaction, r, 0);

‎src/ngx_http_modsecurity_rewrite.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ ngx_http_modsecurity_rewrite_handler(ngx_http_request_t *r)
4444

4545
dd("catching a new _rewrite_ phase handler");
4646

47-
ctx = ngx_http_get_module_ctx(r, ngx_http_modsecurity_module);
47+
ctx = ngx_http_modsecurity_get_module_ctx(r);
4848

4949
dd("recovering ctx: %p", ctx);
5050

0 commit comments

Comments
 (0)