Skip to content

Commit 6adc53f

Browse files
author
b1v1r
committed
Merge 2.5.x changes to trunk.
1 parent 73fb8ea commit 6adc53f

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+6885
-694
lines changed

Diff for: ‎CHANGES

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
23 July 2009 - trunk
1+
27 July 2009 - trunk
22
--------------------
33

44
* Allow mlogc to periodically flush memory pools.

Diff for: ‎apache2/mlogc-src/mlogc-default.conf

+7
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,13 @@ ErrorLogLevel 3
6464
# over a slow link (e.g. not over a LAN).
6565
MaxConnections 10
6666

67+
# How many requests a worker will process before recycling itself.
68+
# This is to help prevent problems due to any memory leaks that may
69+
# exists. If this is set to 0, then no maximum is imposed. The default
70+
# is 1000 requests per worker (the number of workers is controlled by the
71+
# MaxConnections limit).
72+
MaxWorkerRequests 1000
73+
6774
# The time each connection will sit idle before being reused,
6875
# in milliseconds. Increase if you don't want ModSecurity Console
6976
# to be hit with too many log collector requests.

Diff for: ‎apache2/mlogc-src/mlogc.c

+23
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,7 @@ int keep_entries = 0;
151151
const char *log_repository = NULL;
152152
void *logline_regex = NULL;
153153
int max_connections = 10;
154+
int max_worker_requests = 1000;
154155
apr_global_mutex_t *gmutex = NULL;
155156
apr_thread_mutex_t *mutex = NULL;
156157
apr_pool_t *pool = NULL;
@@ -835,6 +836,13 @@ static void init_configuration(void)
835836
error_log(LOG_DEBUG2, NULL, "MaxConnections=%d", max_connections);
836837
}
837838

839+
s = apr_table_get(conf, "MaxWorkerRequests");
840+
if (s != NULL) {
841+
int v = atoi(s);
842+
if (v >= 0) max_worker_requests = v;
843+
error_log(LOG_DEBUG2, NULL, "MaxWorkerRequests=%d", max_worker_requests);
844+
}
845+
838846
s = apr_table_get(conf, "KeepAlive");
839847
if (s != NULL) {
840848
int v = atoi(s);
@@ -1221,6 +1229,7 @@ static void * APR_THREAD_FUNC thread_worker(apr_thread_t *thread, void *data)
12211229
apr_pool_t *tpool;
12221230
struct curl_slist *headerlist = NULL;
12231231
char curl_error_buffer[CURL_ERROR_SIZE] = "";
1232+
int num_requests = 0;
12241233

12251234
/* There is no need to do the sleep if this was an invalid entry
12261235
* as the sleep is just to protect flooding the console server
@@ -1311,6 +1320,11 @@ static void * APR_THREAD_FUNC thread_worker(apr_thread_t *thread, void *data)
13111320
error_log(LOG_DEBUG, thread, "Processing entry.");
13121321
take_new = 0;
13131322

1323+
/* Keep track of requests processed if we need to */
1324+
if (max_worker_requests > 0) {
1325+
num_requests++;
1326+
}
1327+
13141328
rc = pcre_exec(logline_regex, NULL, entry->line, entry->line_size, 0, 0,
13151329
capturevector, CAPTUREVECTORSIZE);
13161330
if (rc == PCRE_ERROR_NOMATCH) { /* No match. */
@@ -1479,6 +1493,15 @@ static void * APR_THREAD_FUNC thread_worker(apr_thread_t *thread, void *data)
14791493
take_new = 1;
14801494
nodelay = 1;
14811495
}
1496+
1497+
/* If we are tracking num_requests, then shutdown if we are
1498+
* over our threshold.
1499+
*/
1500+
if (num_requests && (num_requests >= max_worker_requests)) {
1501+
error_log(LOG_NOTICE, thread, "Reached max requests (%d) for this worker, exiting.", max_worker_requests);
1502+
1503+
goto THREAD_SHUTDOWN;
1504+
}
14821505
}
14831506

14841507
THREAD_CLEANUP:

Diff for: ‎apache2/t/regression/action/10-logging.t

+1-3
Original file line numberDiff line numberDiff line change
@@ -134,9 +134,7 @@
134134
SecAction "phase:1,pass,nolog,auditlog"
135135
),
136136
match_log => {
137-
-error => [ qr/ModSecurity: /, 1 ],
138-
# No message, but should have data. This may need changed
139-
audit => [ qr/-H--\s+Stopwatch: /s, 1 ],
137+
audit => [ qr/-H--\s+Message: .*Stopwatch: /s, 1 ],
140138
},
141139
match_response => {
142140
status => qr/^200$/,

Diff for: ‎apache2/t/regression/misc/00-multipart-parser.t

+20-20
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,11 @@
3030
q(
3131
-----------------------------69343412719991675451336310646
3232
Content-Disposition: form-data; name="a"
33-
33+
3434
1
3535
-----------------------------69343412719991675451336310646
3636
Content-Disposition: form-data; name="b"
37-
37+
3838
2
3939
-----------------------------69343412719991675451336310646--
4040
),
@@ -70,11 +70,11 @@
7070
q(
7171
-----------------------------69343412719991675451336310646
7272
Content-Disposition: form-data; name="a"
73-
73+
7474
1
7575
-----------------------------69343412719991675451336310646
7676
Content-Disposition: form-data; name="b"
77-
77+
7878
2
7979
-----------------------------69343412719991675451336310646--),
8080
),
@@ -111,11 +111,11 @@
111111
q(
112112
--------------------------------------------------boundary
113113
Content-Disposition: form-data; name="a"
114-
114+
115115
1
116116
--------------------------------------------------boundary
117117
Content-Disposition: form-data; name="b"
118-
118+
119119
2
120120
--------------------------------------------------boundary--
121121
),
@@ -154,11 +154,11 @@
154154
q(
155155
----------0xKhTmLbOuNdArY
156156
Content-Disposition: form-data; name="a"
157-
157+
158158
1
159159
----------0xKhTmLbOuNdArY
160160
Content-Disposition: form-data; name="b"
161-
161+
162162
2
163163
----------0xKhTmLbOuNdArY--
164164
),
@@ -195,11 +195,11 @@
195195
q(
196196
-----------------------------69343412719991675451336310646
197197
Content-Disposition: form-data; name="a"
198-
198+
199199
--test
200200
-----------------------------69343412719991675451336310646
201201
Content-Disposition: form-data; name="b"
202-
202+
203203
--
204204
-----------------------------69343412719991675451336310646--),
205205
),
@@ -235,11 +235,11 @@
235235
q(
236236
-----------------------------69343412719991675451336310646
237237
Content-Disposition: form-data; name="a"
238-
238+
239239
1
240240
-----------------------------69343412719991675451336310646
241241
Content-Disposition: form-data; name="b"
242-
242+
243243
2
244244
),
245245
),
@@ -273,10 +273,10 @@
273273
normalize_raw_request_data(
274274
q(
275275
-----------------------------69343412719991675451336310646
276-
276+
277277
1
278278
-----------------------------69343412719991675451336310646
279-
279+
280280
2
281281
-----------------------------69343412719991675451336310646--
282282
),
@@ -311,11 +311,11 @@
311311
q(
312312
-----------------------------69343412719991675451336310646
313313
Content-Disposition: form-data name="a"
314-
314+
315315
1
316316
-----------------------------69343412719991675451336310646
317317
Content-Disposition: form-data name="b"
318-
318+
319319
2
320320
-----------------------------69343412719991675451336310646--
321321
),
@@ -351,11 +351,11 @@
351351
q(
352352
-----------------------------69343412719991675451336310646
353353
Content-Disposition: form-data;
354-
354+
355355
1
356356
-----------------------------69343412719991675451336310646
357357
Content-Disposition: form-data;
358-
358+
359359
2
360360
-----------------------------69343412719991675451336310646--
361361
),
@@ -391,13 +391,13 @@
391391
q(
392392
-----------------------------69343412719991675451336310646
393393
Content-Disposition: form-data; name="a"
394-
394+
395395
1
396396
-----------------------------69343412719991675451336310646
397397
:
398398
-----------------------------69343412719991675451336310646
399399
Content-Disposition: form-data; name="b"
400-
400+
401401
2
402402
-----------------------------69343412719991675451336310646--
403403
),

Diff for: ‎doc/modsecurity2-apache-reference.xml

+48-8
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
Manual</title>
77

88
<articleinfo>
9-
<releaseinfo>Version 2.6.0-trunk (July 23, 2009)</releaseinfo>
9+
<releaseinfo>Version 2.6.0-trunk (July 27, 2009)</releaseinfo>
1010

1111
<copyright>
1212
<year>2004-2009</year>
@@ -249,11 +249,12 @@
249249
<section id="installation">
250250
<title>Installation</title>
251251

252-
<para>ModSecurity installation consists of the following steps:</para>
252+
<para>ModSecurity installation requirements:</para>
253253

254254
<orderedlist continuation="restarts" inheritnum="ignore">
255255
<listitem>
256-
<para>ModSecurity 2.x works with Apache 2.0.x or better.</para>
256+
<para>ModSecurity 2.x works only with Apache 2.0.x or higher. Version
257+
2.2.x is highly recommended.</para>
257258
</listitem>
258259

259260
<listitem>
@@ -264,17 +265,31 @@
264265
</listitem>
265266

266267
<listitem>
267-
<para>Install the latest version of libxml2, if it isn't already
268-
installed on the server.</para>
268+
<para>libapr and libapr-util</para>
269+
270+
<para><ulink type=""
271+
url="http://apr.apache.org/">http://apr.apache.org/</ulink></para>
272+
</listitem>
273+
274+
<listitem>
275+
<para>libpcre</para>
276+
277+
<para><ulink type=""
278+
url="http://www.pcre.org/">http://www.pcre.org/</ulink></para>
279+
</listitem>
280+
281+
<listitem>
282+
<para>libxml2</para>
269283

270284
<para><ulink type=""
271285
url="http://xmlsoft.org/downloads.html">http://xmlsoft.org/downloads.html</ulink></para>
272286
</listitem>
273287

274288
<listitem>
275-
<para>Optionally install the latest version of Lua in the 5.1.x
276-
branch, if it isn't already installed on the server and you will be
277-
using the new Lua engine.</para>
289+
<para>liblua v5.1.x</para>
290+
291+
<para>This library is optional and only needed if you will be using
292+
the new Lua engine.</para>
278293

279294
<para><ulink type=""
280295
url="http://www.lua.org/download.html">http://www.lua.org/download.html</ulink></para>
@@ -284,6 +299,21 @@
284299
distribution is recommended.</para>
285300
</listitem>
286301

302+
<listitem>
303+
<para>libcurl v7.15.1 or higher</para>
304+
305+
<para>If you will be using the ModSecurity Log Collector (mlogc) to
306+
send audit logs to a central repository, then you will also need the
307+
curl library.</para>
308+
309+
<para><ulink type=""
310+
url="http://curl.haxx.se/libcurl/">http://curl.haxx.se/libcurl/</ulink></para>
311+
</listitem>
312+
</orderedlist>
313+
314+
<para>ModSecurity installation consists of the following steps:</para>
315+
316+
<orderedlist continuation="restarts" inheritnum="ignore">
287317
<listitem>
288318
<para>Stop Apache httpd</para>
289319
</listitem>
@@ -444,6 +474,16 @@ LoadFile /usr/lib/liblua5.1.so</programlisting></para>
444474
moreinfo="none">WITH_PCRE_STUDY</literal> defined,which would possibly
445475
give you a slight performance edge in regular expression
446476
processing.</para>
477+
478+
<para>Non-gcc compilers may have problems running out-of-the-box as the
479+
current build system was designed around the gcc compiler and some
480+
compiler/linker flags may differ. To use a non-gcc compiler you may need
481+
some manual Makefile tweaks if issues cannot be solved by exporting
482+
custom CFLAGS and CPPFLAGS environment variables.</para>
483+
484+
<para>If you are upgrading from ModSecurity 1.x, please refer to the
485+
migration matrix at <ulink type=""
486+
url="http://www.modsecurity.org/documentation/ModSecurity-Migration-Matrix.pdf">http://www.modsecurity.org/documentation/ModSecurity-Migration-Matrix.pdf</ulink></para>
447487
</note>
448488
</section>
449489

0 commit comments

Comments
 (0)