mod-security-users — General discussion about mod_security

Re: [mod-security-users] regex for matching urls

[Peter W. <prw...@gm...>]

Ivan,

Thanks for the response. Can you suggest any way to work around this
so that we can match 'http://'? Would '/{2}' work, or would that also
be normalized?

Thanks,

Peter


On Mon, 07 Mar 2005 16:45:58 +0000, Ivan Ristic <iv...@we...> wrote:
> Peter Wood wrote:
> > Greetings,
> 
> > What is wrong with '[a-z]+://' ?
> 
>    Before regular expression is applied to a piece of data
>    mod_security performs data normalization and reduces
>    redundant forward slashes. Thus "http://" becomes "http:/".
> 
>    (No, I don't like it either. That's why in 1.9 normalization
>     will become optional and configurable per-rule.)
> 
> --
> Ivan Ristic
> Apache Security (O'Reilly) - http://www.apachesecurity.net
> Open source web application firewall - http://www.modsecurity.org
> 
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> 


-- 
Peter R. Wood | email: prw...@gm... | blog: http://prwdot.org/

Re: [mod-security-users] regex for matching urls

[Ivan R. <iv...@we...>]

Peter Wood wrote:
> Greetings,

> What is wrong with '[a-z]+://' ?

   Before regular expression is applied to a piece of data
   mod_security performs data normalization and reduces
   redundant forward slashes. Thus "http://" becomes "http:/".

   (No, I don't like it either. That's why in 1.9 normalization
    will become optional and configurable per-rule.)

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] regex for matching urls

[Peter W. <prw...@gm...>]

Greetings,

I'm trying to create a mod_security rule that uses regexes to match a
certain piece of text, but only if it is found within a URL. Here is
the initial attempt:

SecFilterSelective HTTP_Referer|ARGS
"[a-z]+://[\w\-_.]*poker[\w\-_.]*\.[a-z]{2,}"

This does *not* match 'poker' if it is found within a URL (e.g.
http://www.high-stakes-poker.com/). However, if you take the
'[a-z]+://' off of the beginning, it *does* work:

SecFilterSelective HTTP_Referer|ARGS "[\w\-_.]*poker[\w\-_.]*\.[a-z]{2,}"

What is wrong with '[a-z]+://' ? I tried escaping the /'s, and that
didn't seem to make any difference.

Thanks,

Peter
-- 
Peter R. Wood | email: prw...@gm... | blog: http://prwdot.org/

Re: [mod-security-users] SecChrootDir -> Premature end of script

[Ivan R. <iv...@we...>]

he...@gm... wrote:
>>>PHP is configured to run as CGI with suPHP.
>>
>>  This is the problem. Your jail probably does not contain all
>>  the files needed for a new PHP process to start (with or
>>  without suPHP). Because your Apache setup requires new
>>  processes to be created at runtime you must setup the
>>  jail the old-fashioned way.
>>
>>  Chapter 2 of Apache Security, Installation and Configuration,
>>  is available free of charge:
>>
>>  http://www.apachesecurity.net/download/apachesecurity-ch02-beta.pdf
>>
>>  It contains detailed instructions how to create a jail
>>  from scratch. Good luck :)
> 
> But its still working with mod_php. Just mod_suphp make Problems. Are you
> working on this Problem ?

   There is nothing I (or anyone else) can do to make CGI scripts
   (or mod_suphp) work in a partial jail. The only way out is to
   create a proper jail, as I described in my previous email.

   mod_php works because PHP is embedded in Apache. With mod_suphp,
   PHP is just a CGI script.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] SecChrootDir -> Premature end of script

[<he...@gm...>]

>> PHP is configured to run as CGI with suPHP.
>
>   This is the problem. Your jail probably does not contain all
>   the files needed for a new PHP process to start (with or
>   without suPHP). Because your Apache setup requires new
>   processes to be created at runtime you must setup the
>   jail the old-fashioned way.
>
>   Chapter 2 of Apache Security, Installation and Configuration,
>   is available free of charge:
>
>   http://www.apachesecurity.net/download/apachesecurity-ch02-beta.pdf
>
>   It contains detailed instructions how to create a jail
>   from scratch. Good luck :)

But its still working with mod_php. Just mod_suphp make Problems. Are you
working on this Problem ?
Thanks for your Help.

-- 
DSL Komplett von GMX +++ Supergünstig und stressfrei einsteigen!
AKTION "Kein Einrichtungspreis" nutzen: http://www.gmx.net/de/go/dsl

Re: [mod-security-users] SecChrootDir -> Premature end of script headers

[Ivan R. <iv...@we...>]

he...@gm... wrote:
> Hello there,
> I've got some Problems but at first some Informations:

   With the wealth of information you have provided it's much easier
   to diagnose the problem.


> My mod_security:
> debian:/etc/apache2/mods-enabled# apt-cache show libapache2-mod-security
> Package: libapache2-mod-security
> Priority: optional
> Section: web
> Installed-Size: 128
> Maintainer: Bruno Rodrigues
> Architecture: i386
> Source: libapache-mod-security
> Version: 1.8.4-1.1

   You would be better off using 1.8.7, I've fixed a dozen or
   so bugs since 1.8.4.


> PHP is configured to run as CGI with suPHP.

   This is the problem. Your jail probably does not contain all
   the files needed for a new PHP process to start (with or
   without suPHP). Because your Apache setup requires new
   processes to be created at runtime you must setup the
   jail the old-fashioned way.

   Chapter 2 of Apache Security, Installation and Configuration,
   is available free of charge:

   http://www.apachesecurity.net/download/apachesecurity-ch02-beta.pdf

   It contains detailed instructions how to create a jail
   from scratch. Good luck :)

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] SecChrootDir -> Premature end of script headers

[<he...@gm...>]

Hello there,
I've got some Problems but at first some Informations:

Operating System:
Linux debian 2.4.27 #3 SMP Fri Oct 22 13:50:24 CEST 2004 i686 GNU/Linux

Server version: Apache/2.0.53
Server built: Feb 25 2005 08:29:30
Server's Module Magic Number: 20020903:9
Architecture: 32-bit
Server compiled with....
-D APACHE_MPM_DIR="server/mpm/worker"
-D APR_HAS_SENDFILE
-D APR_HAS_MMAP
-D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
-D APR_USE_SYSVSEM_SERIALIZE
-D APR_USE_PTHREAD_SERIALIZE
-D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
-D APR_HAS_OTHER_CHILD
-D AP_HAVE_RELIABLE_PIPED_LOGS
-D HTTPD_ROOT=""
-D SUEXEC_BIN="/usr/lib/apache2/suexec2"
-D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
-D DEFAULT_ERRORLOG="logs/error_log"
-D AP_TYPES_CONFIG_FILE="/etc/apache2/mime.types"
-D SERVER_CONFIG_FILE="/etc/apache2/apache2.conf"

Compiled in modules:
core.c
mod_access.c
mod_auth.c
mod_log_config.c
mod_logio.c
mod_env.c
mod_setenvif.c
worker.c
http_core.c
mod_mime.c
mod_status.c
mod_autoindex.c
mod_negotiation.c
mod_dir.c
mod_alias.c
mod_so.c

My mod_security:
debian:/etc/apache2/mods-enabled# apt-cache show libapache2-mod-security
Package: libapache2-mod-security
Priority: optional
Section: web
Installed-Size: 128
Maintainer: Bruno Rodrigues
Architecture: i386
Source: libapache-mod-security
Version: 1.8.4-1.1
Depends: mod-security-common (= 1.8.4-1.1), apache2-common, libc6
(>=
2.3.2.ds1-4)
Filename:
pool/main/liba/libapache-mod-security/libapache2-mod-security_1.8.4-1.1_i386.deb
Size: 32874
MD5sum: e8dba8ed671ab0e8346aeef1619a1a0e
Description: Tighten the Web application security for Apache 2.x

Apache error log:
[Sat Mar 05 21:23:31 2005] [notice] mod_security: chroot checkpoint #1
(pid=7334 ppid=7332)
[Sat Mar 05 21:23:31 2005] [notice] mod_security: chroot checkpoint #2
(pid=7335 ppid=1)
[Sat Mar 05 21:23:31 2005] [notice] mod_security: chroot successful,
path=/chroot/apache
[Sat Mar 05 21:23:31 2005] [notice] Apache/2.0.53 (Debian GNU/Linux)
proxy_html/2.4 mod_perl/1.999.20 Perl/v5.8.4 configured -- resuming normal
operations
[Sat Mar 05 21:23:31 2005] [info] Server built: Feb 25 2005 08:29:30
[Sat Mar 05 21:23:31 2005]
[debug]
/home/adconrad/apache2/apache2-2.0.53/build-tree/apache2/server/mpm/worker/worker.c(1632):
AcceptMutex: sysvsem (default: sysvsem)
[Sat Mar 05 21:24:00 2005] [error] [client xxx] Premature end of script
headers: index.php

mod_security Debug log:
[05/Mar/2005:21:24:00 +0100] [xxx/sid#81afd70][rid#83dff70][/index.php]
sec_check_access, path=(null)
[05/Mar/2005:21:24:00 +0100] [xxx/sid#81afd70][rid#83dff70][/index.php]
Filtering off, switched off for path "(null)"
[05/Mar/2005:21:24:00 +0100] [xxx/sid#81afd70][rid#83dff70][/index.php]
Filtering off, switched off for path "(null)"
[05/Mar/2005:21:24:00 +0100] [xxx/sid#81afd70][rid#83dff70][/index.php]
find_last_request: start with 83dff70 "/index.php"
[05/Mar/2005:21:24:00 +0100] [xxx/sid#81afd70][rid#83dff70][/index.php]
sec_logger: start
[05/Mar/2005:21:24:00 +0100] [xxx/sid#81afd70][rid#83dff70][/index.php]
Audit log off here

There are no informations in the php log file.

System description:
Apache is used for normal Website Providing. Users could access their
Webspaces during FTP and upload HTML Sites, PHP and CGI Script, so that
their Pages are provided to the www. A mysql Server is also running.
PHP is configured to run as CGI with suPHP. This is provided by the
mod_suphp for apache.
I tried to configure Apache to run with mod_security and its SecChrootDir
Directive. But there must be the error. Either in mod_security or in
mod_suphp.
When I access a simple PHP Script, with the phpinfo() function I got the
following error in the apache log:

[Sat Mar 05 21:24:00 2005] [error] [client xxx] Premature end of script
headers: index.php

And a 500 Internal Server Error at the Browser.

Please help me, I don't know what I could do...

-- 
SMS bei wichtigen e-mails und Ihre Gedanken sind frei ...
Alle Infos zur SMS-Benachrichtigung: http://www.gmx.net/de/go/sms

-- 
DSL Komplett von GMX +++ Supergünstig und stressfrei einsteigen!
AKTION "Kein Einrichtungspreis" nutzen: http://www.gmx.net/de/go/dsl

Re: [mod-security-users] Just received Apache Security

[<bu...@cg...>]

I've also received a copy. Anyone caring about apache security should check out the book
ISBN: 0596007248 at http://www.amazon.com/exec/obidos/ASIN/0596007248/wwwcgisecuricom




> 
> Ivan,
> 
> I've just received my copy of Apache Security today and would like to
> say congratulations, Thank You, and Excellent job.  A wealth of useful
> knowledge in one well organized source.
> 
> 
> -- 
>  +==================================================================+
>  | Christopher Cuevas                                               |
>  | FCLA Open Systems Group                                          |
>  | fclcac (at) cns (dot) ufl (dot) edu                              |
>  +------------------------------------------------------------------+
>  gpg fingerprint = CB8E B1B5 43DE 94C9 AFA8  8E89 6B1F 3546 87E0  DCF0
>  +==================================================================+
>  
>   (o_              "Why waste time learning,
>   //\                      when ignorance is instantaneous?" -  Calvin
>   V_/_
>                 quod erat demonstrandum
> 
> 
> 
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> 

[mod-security-users] Just received Apache Security

[Christopher C. <fc...@cn...>]

Ivan,

I've just received my copy of Apache Security today and would like to
say congratulations, Thank You, and Excellent job.  A wealth of useful
knowledge in one well organized source.


-- 
 +==================================================================+
 | Christopher Cuevas                                               |
 | FCLA Open Systems Group                                          |
 | fclcac (at) cns (dot) ufl (dot) edu                              |
 +------------------------------------------------------------------+
 gpg fingerprint = CB8E B1B5 43DE 94C9 AFA8  8E89 6B1F 3546 87E0  DCF0
 +==================================================================+
 
  (o_              "Why waste time learning,
  //\                      when ignorance is instantaneous?" -  Calvin
  V_/_
                quod erat demonstrandum

Re: [mod-security-users] mod_security build for windows - problem

[Ivan R. <iv...@we...>]

Spence, Ian (ELS-CAM) wrote:
> Ivan,
> 
> A colleague of mine has tried to build the dev1.9 source but is seeing the
> following error. I know you have said other people have warned of
> mod_security not building on Windows. Is getpwuid the wrong method call for
> windows, can we simply replace this with an alternative method? Can you
> suggest any solution?

   If that's the only problem then simply comment out the offending
   parts. The getpwuid call only makes sense on Unix platforms anyway.

   Or surround the code with #if !(defined(WIN32)) and #endif

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] mod_security build for windows - problem

[Spence, I. (ELS-CAM) <I.S...@El...>]

Ivan,

A colleague of mine has tried to build the dev1.9 source but is seeing the
following error. I know you have said other people have warned of
mod_security not building on Windows. Is getpwuid the wrong method call for
windows, can we simply replace this with an alternative method? Can you
suggest any solution?

Regards,
Ian Spence 

-----Original Message-----
From: Graham, Phillip (ELS) 
Sent: 03 March 2005 15:58
To: Spence, Ian (ELS-CAM)
Subject: mod_security

Hi Ian

after much trying and searching for an answer it would seem that 1.9 does
not build on windows (it uses getpwuid - which is a function not provided on
Win32).  I've posted a question on the newsgroup - and then spotted a reply
to a message from you - which says 1.9 does not compile on windows.

Phill

[mod-security-users] Where Do Web Application Firewalls Fit in the Overall Defense Strategy?

[Ivan R. <iv...@we...>]

I think people on this list will find my recent blog
entry interesting:

Where Do Web Application Firewalls Fit in the Overall Defense Strategy?
http://www.modsecurity.org/blog/archives/000052.html

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] 1.9 binary windows

[Ivan R. <iv...@we...>]

Spence, Ian (ELS-CAM) wrote:
> Ivan,
> 
> Yes, this sounds good.
> 
> Is there any other apache module that will do token processing?

   No, not that I know.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] RE: Mod_security question

[Ivan R. <iv...@we...>]

Spence, Ian (ELS-CAM) wrote:
> Ivan
> 
> Our target platform is Windows server.
> 
> Given the download page states testing has stopped for Windows would you
> advise on deploying 1.9 codebase on Windows? I am very interesting in
> deploying your suggested enhancement "SecFilterExternal".

   Well, "stopped testing" is not entirely accurate. The truth is I never
   test mod_security on Windows. I develop and test on Linux, but I only
   compile and run a set of automated tests on Windows. This does not
   mean mod_security does not run or runs badly on Windows. In fact, I
   have had many reports from people who are happily running it on
   Windows. I am merely stating the facts to let people to make their
   own minds.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

RE: [mod-security-users] 1.9 binary windows

[Spence, I. (ELS-CAM) <I.S...@El...>]

Ivan,

Yes, this sounds good.

Is there any other apache module that will do token processing?

I like the vast array of features in mod_security but all we need right now
is some token processing - MD5 digest/undigest etc.

Ian Spence 

-----Original Message-----
From: mod...@li...
[mailto:mod...@li...] On Behalf Of Ivan
Ristic
Sent: 02 March 2005 10:58
To: mod...@li...
Subject: Re: [mod-security-users] 1.9 binary windows

Spence, Ian (ELS-CAM) wrote:
> Ivan,
> 
> I am interested in obtaining a binary version of mod_security 1.9 for 
> Windows. I am aware this is a development release.

   I've been told recently it does not compile on Windows. (This happens
   sometimes because I only try to build mod_security on Windows for
   the release.)


> I have downloaded the source zip from the download page but I do not 
> have a full build environment to create a DLL etc.
> 
> I would like to test the enhancement SecFilterExternal as discussed 
> previously.

   I would love to help but I have recently reinstalled my workstation
   so I don't have a development environment either. But I've been
   planning to release a pretty solid 1.9dev2 next week and I'll make
   the effort to make it compile on Windows too. OK?

--
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net Open source web
application firewall - http://www.modsecurity.org


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
mod-security-users mailing list
mod...@li...
https://lists.sourceforge.net/lists/listinfo/mod-security-users

Re: [mod-security-users] 1.9 binary windows

[Ivan R. <iv...@we...>]

Spence, Ian (ELS-CAM) wrote:
> Ivan,
> 
> I am interested in obtaining a binary version of mod_security 1.9 for 
> Windows. I am aware this is a development release.

   I've been told recently it does not compile on Windows. (This happens
   sometimes because I only try to build mod_security on Windows for
   the release.)


> I have downloaded the source zip from the download page but I do not 
> have a full build environment to create a DLL etc.
> 
> I would like to test the enhancement SecFilterExternal as discussed 
> previously.

   I would love to help but I have recently reinstalled my workstation
   so I don't have a development environment either. But I've been
   planning to release a pretty solid 1.9dev2 next week and I'll make
   the effort to make it compile on Windows too. OK?

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

[mod-security-users] 1.9 binary windows

[Spence, I. (ELS-CAM) <I.S...@El...>]

Ivan,

I am interested in obtaining a binary version of mod_security 1.9 for
Windows. I am aware this is a development release.

I have downloaded the source zip from the download page but I do not have a
full build environment to create a DLL etc.

I would like to test the enhancement SecFilterExternal as discussed
previously. 


____________________________________
Ian Spence
Developer, Clinical Decision Support 
Elsevier Health Sciences Division

Elsevier
32 Jamestown Road
London NW1 7BY
UK
[t] +44 (0)20 7424 4240
[m] +44 (0)7891 875735
[e] i.s...@el...
____________________________________
CONFIDENTIALITY NOTICE: This email message and any accompanying data are
confidential and intended solely for use of the named recipient(s). If you
are not the intended recipient(s), you are hereby notified that the
dissemination, distribution, and or copying of this message is strictly
prohibited. If you receive this message in error, or are not the named
recipient(s), please notify the sender at the email address above, delete
this email from your computer, and destroy any copies in any form
immediately.

[mod-security-users] RE: Mod_security question

[Spence, I. (ELS-CAM) <I.S...@El...>]

Ivan

Our target platform is Windows server.

Given the download page states testing has stopped for Windows would you
advise on deploying 1.9 codebase on Windows? I am very interesting in
deploying your suggested enhancement "SecFilterExternal".

Ian Spence

-----Original Message-----
From: Ivan Ristic [mailto:iv...@we...] 
Sent: 01 March 2005 15:04
To: Spence, Ian (ELS-CAM)
Cc: mod...@li...
Subject: Re: Mod_security question

Spence, Ian (ELS-CAM) wrote:
> Ivan
> 
> Can mod_security check on a token parameter in the URL?
> 
> E.g. _http://server/app?token=digestTokenValue_
> 
> I want the receiving web server to check the token value against an 
> agreed algorithm, for a start it will be MD5 digested.
> 
> I notice with the mod_security rules you can trap on certain parameter 
> values i.e. regex, but given a match can you run a script and then 
> depending on the result of the script, either reject or accept the 
> http request.

   Yes, mod_security can do that. I've added that functionality
   to the 1.9.x branch, so far only in the Apache 1.x version of
   the module. The new directive is called SecFilterExternal and it
   takes only one parameter - the name of the script to execute.

   The script will get the path to the file containing request
   parameters (only that at the moment) as its first parameter.
   Here's an example of a script that uses this feature to interface
   to SpamAssassin:
 
http://cvs.sourceforge.net/viewcvs.py/mod-security/mod_security/util/filter_
spamc.pl?rev=1.1&view=auto

   This functionality is still rough and I plan to change the
   data exchange format before the final 1.9.x. version (e.g. to
   include the request headers). But it works and you can play with
   it in the meantime.

--
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net Open source web
application firewall - http://www.modsecurity.org

[mod-security-users] Re: Mod_security question

[Ivan R. <iv...@we...>]

Spence, Ian (ELS-CAM) wrote:
> Ivan
> 
> Can mod_security check on a token parameter in the URL?
> 
> E.g. _http://server/app?token=digestTokenValue_
> 
> I want the receiving web server to check the token value against an 
> agreed algorithm, for a start it will be MD5 digested.
> 
> I notice with the mod_security rules you can trap on certain parameter 
> values i.e. regex, but given a match can you run a script and then 
> depending on the result of the script, either reject or accept the http 
> request.

   Yes, mod_security can do that. I've added that functionality
   to the 1.9.x branch, so far only in the Apache 1.x version of
   the module. The new directive is called SecFilterExternal and it
   takes only one parameter - the name of the script to execute.

   The script will get the path to the file containing request
   parameters (only that at the moment) as its first parameter.
   Here's an example of a script that uses this feature to interface
   to SpamAssassin:
 
http://cvs.sourceforge.net/viewcvs.py/mod-security/mod_security/util/filter_spamc.pl?rev=1.1&view=auto

   This functionality is still rough and I plan to change the
   data exchange format before the final 1.9.x. version (e.g. to
   include the request headers). But it works and you can play with
   it in the meantime.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org

Re: [mod-security-users] Invalid cookie format error, why?

[Ivan R. <iv...@we...>]

Aditya wrote:
> With:
> 
>    SecFilterCheckCookieFormat On
> 
> we are seeing the following error:
> 
>  Cookie: DYN_CAL='fdow':null,'history':"2005/02/21/19/23",'hsize':9
>  mod_security-message: Invalid cookie format: Cookie value is missing #1
>  mod_security-action: 500
> 
> However, looking at the module code, it seems like the "=" isn't being
> matched, but I can't really tell why:

   Your cookie is in v0 format, while the mod_security 1.8.6 parser
   expects v1 format. I originally thought the 1.8.6 parser will be able
   to handle both but I was mistaken. I realized this recently (when I
   was investigating Stefan's claims, see here

   http://www.modsecurity.org/documentation/known-issues.html

   ) so that's why 1.8.7 now has two cookie parsers. It will correctly
   parse your cookie (I just tried it with 1.8.7RC1).

 >  Cookie: DYN_CAL='fdow':null,'history':"2005/02/21/19/23",'hsize':9
                               ^
   In v1 the comma is used as cookie separator, so the parser was
   expecting two cookies there.

-- 
Ivan Ristic (http://www.modsecurity.org)

[mod-security-users] Invalid cookie format error, why?

[Aditya <ad...@gr...>]

With:

   SecFilterCheckCookieFormat On

we are seeing the following error:

 Cookie: DYN_CAL='fdow':null,'history':"2005/02/21/19/23",'hsize':9
 mod_security-message: Invalid cookie format: Cookie value is missing #1
 mod_security-action: 500

However, looking at the module code, it seems like the "=" isn't being
matched, but I can't really tell why:

  p = header_copy;
    while(*p != 0) {
        attr_name = NULL;
        attr_value = NULL;

        /* attribute name */
        while(isspace(*p)) p++;
        attr_name = p;
        while((*p != 0)&&(*p != '=')) p++;

        if (*p == 0) {
            /* we've reached the end of the string,
             * and the attribute value is missing
             */
            *error_msg = ap_psprintf(r->pool, "Cookie value is missing #1");
            return -1;
        }

Any hints?

Thanks,
Adi

Re: [mod-security-users] mod_security & apache

[Ivan R. <iv...@we...>]

Evgeniy wrote:
> Can I   make  "apachectl restart" and "apachectl -k graceful" for  apache
> (2.0.53)  with mod_securtiy (1.8.7rc1)  without  full  copying  apache & perl
> &php  files to chroot  tree ?    apachectl stop & star  actions works normally,
>   but restart requires access to binary files   & conf...

   No, not that I know of.

-- 
Ivan Ristic (http://www.modsecurity.org)

[mod-security-users] =?utf-8?b?bW9kX3NlY3VyaXR5?= & apache

[Evgeniy <evg...@ya...>]

Can I   make  "apachectl restart" and "apachectl -k graceful" for  apache
(2.0.53)  with mod_securtiy (1.8.7rc1)  without  full  copying  apache & perl
&php  files to chroot  tree ?    apachectl stop & star  actions works normally,
  but restart requires access to binary files   & conf...

Re: [mod-security-users] Validation type of upload files

[Troy A. <tr...@ze...>]

On Tue, Feb 22, 2005 at 11:33:08PM +0000, Ivan Ristic wrote:
> Jochen Kaechelin wrote:
> >
> >Now I wan't to allow only image-files to be uploaded.
> >But the following does not work:
> >
> >    <Location /var/www/noeinfo.noe.de/upload/upload.php>
> >            SecFilterInheritance Off
> >            SecFilterSelective POST_PAYLOAD "!image/(jpeg|bmp|gif)"
> >    </Location>
> >
> >What's wrong here?
> 
>   To restrict file uploads you have the following options:
> 
>   1) Use an approver script
> 
>      1a) If filtering using the extension is good enough for you
>          I am pretty sure the temporary file you get in the
>          approver script will have the same extension as the
>          original (sorry, I can't check at the moment).
> 
>      1b) You don't have to rely on the extension -- you can have
>          a "smart" script figure out the actual content of the
>          file. Something like the "file" tool.

This is slightly OT, but see the poorly named 'getimagesize()' php
function: 
http://www.php.net/manual/en/function.getimagesize.php

It returns an array of information about the given file, including its
image type.  It's safe to say that if it doesn't have a type and size,
then it's not a valid image file.

-troy

Re: [mod-security-users] Validation type of upload files

[Ivan R. <iv...@we...>]

Jochen Kaechelin wrote:
> I have a PHP-form running at
> 
>  http://127.0.0.1/xxx.xxx/upload/upload.php
> 
> with a file-selection field.
> 
> All the date ist transmitted to
> 
> http://127.0.0.1/noeinfo.noe.de/upload/do_upload.php
> 
> Now I wan't to allow only image-files to be uploaded.
> But the following does not work:
> 
>     <Location /var/www/noeinfo.noe.de/upload/upload.php>
>             SecFilterInheritance Off
>             SecFilterSelective POST_PAYLOAD "!image/(jpeg|bmp|gif)"
>     </Location>
> 
> What's wrong here?

   That cannot work for several reasons. First, the content type
   transported with the file is client-generated and can be
   faked.

   ModSecurity will not give you access to the raw request body
   when multipart/form-data is used, because it doesn't make
   sense. It is trivial to bypass any type of regular expression.
   Also, regular expressions would most likely not work because
   of the binary content.

   So what you actually get with POST_PAYLOAD and multipart/form-data
   is a simulated application/x-www-form-urlencoded body.

   To restrict file uploads you have the following options:

   1) Use an approver script

      1a) If filtering using the extension is good enough for you
          I am pretty sure the temporary file you get in the
          approver script will have the same extension as the
          original (sorry, I can't check at the moment).

      1b) You don't have to rely on the extension -- you can have
          a "smart" script figure out the actual content of the
          file. Something like the "file" tool.

   2) In 1.9.x there is the FILE_NAMES variable that allows
      filtering using the name of the file.

-- 
Ivan Ristic (http://www.modsecurity.org)